Sindri
The artifact repository that knows what's approved where.
Sindri is a lightweight, multi-protocol artifact repository in a single Go binary, open source under Apache 2.0. An artifact isn't copied between repositories as it matures. It keeps one identity, and its trust status changes per environment, so Sindri can answer "is exactly this artifact approved for this environment?"
Sindri's documentation lives with its code, so it stays versioned and reviewed alongside each release. Start here:
Quickstart
Run Sindri, Postgres, and a development identity provider from one Compose file, with nothing but Docker.
Configuration
Declare repositories, stages, and access in one YAML file.
Upgrading
Replace the binary or image, and migrations apply themselves.
Architecture
The design, invariants, and data model.
What works today
- Protocols: OCI (Docker, and Helm charts as OCI artifacts) and PyPI
- Repository types: hosted, proxy, and virtual
- Lifecycle: stages and promotion that change trust status instead of copying bytes
- Evidence: attach SBOMs and signatures produced elsewhere, and gate promotion on their presence
- Auth: OpenID Connect login, role-based access control, and machine tokens for CI, with no anonymous access
- Storage: a filesystem or any S3-compatible object store
- UI: read-only browsing of repositories and artifacts
Not available yet
The roadmap has the order and detail. npm is next. Further out are running scanners, verifying signatures, Maven, and a Kubernetes install with a Helm chart and an admission webhook.