About

Why it exists

OpenDepot started in 2014 as a private mirror for a build cluster whose upstream fetches kept failing at the worst possible moment. Upstreams move files, retire old releases, and occasionally go offline entirely. A build that pinned a tarball in 2019 should not fail in 2026 because a project cleaned up its download directory.

The depot solves one problem and tries not to solve others: keep the bytes, keep the checksums, keep serving. It is not a package manager, it does not resolve dependencies, and it has no opinion about which version you should use.

Hardware

All three nodes run the same nginx build, serve from a read-only bind mount, and hold no session state. A node can be rebuilt from the replication pair in under an hour.

Funding

Hosting is paid for by three recurring sponsors and a small number of one-off donations. There is no advertising, no tracking and no paid tier. Donations cover bandwidth overage, nothing else; the project does not pay salaries and has no employees.

Sponsors have no influence over which projects are mirrored. If a sponsor asks for a project to be added, the request is treated the same as any other and published in the changelog.

Governance

Changes to retention policy, the signing key, or the mirror list require approval from two of the four maintainers. Routine package additions are handled by whoever is on rotation. The signing key ceremony is documented, filmed, and the recording is retained; it has been performed twice, in 2014 and 2019.

Contact

Mirror operators, packaging bugs and takedown requests: ops@opendepot.example. Security reports should go through the process described on the documentation page; please do not open a public issue for a vulnerability in the index signing path.

Postal address available on request. The project has no office and no phone number.