About us
We watched a build break because a package was unpublished
Parcel was built after a two-line dependency vanished from the public registry and took a release with it.
Origin
The dependency was eleven bytes and load-bearing
A maintainer unpublished a package. Every build in the company failed within the hour, including the ones with lockfiles, because the artefact was simply gone. A cache would have made it a non-event, and once you have a cache the supply-chain controls become possible almost for free.
- Cached versions are served forever, including unpublished ones
- Artefact bytes are never rewritten, so hashes always verify
- Quarantine and provenance run at fetch time, not after the build
An npm cache in a closet
One team, one very bad week.
PyPI and Maven
Second and third ecosystems.
Provenance verification
sigstore attestations checked on fetch.
Quarantine windows
Malicious releases stop reaching builds.
2.1 B requests a day
Nine ecosystems, 38 TB served daily.
How we work
Boring on purpose
We would rather run software that is three years old and understood than something new that pages us at 04:00.
Own the path
We buy transit from multiple carriers and peer directly wherever it is possible, so a single bad hop is never a single point of failure.
Write it down
Every incident gets a public write-up. Every design decision gets an RFC. Institutional memory beats heroics.
Some of the people behind it
A quarter of the company has been here since the first rack.
We are hiring
Remote-first across EU time zones, with a small office network for people who prefer one.