Package Mirroring | CodeSync

Fast, GDPR-compliant package infrastructure for Germany — real-time synchronization with global registries.

How It Works Supported Registries

Technical Architecture

CodeSync operates a dedicated mirror cluster in Frankfurt (DE-CIX) that ingests, indexes, and serves packages from npm, PyPI, and Maven Central with sub-second propagation latency. Every artifact is validated, cached locally, and served over HTTPS from edge nodes in Berlin, Munich, and Stuttgart.

Our synchronization pipeline runs on a continuous pull model. Dedicated fetch nodes contact upstream registries every 15 seconds, diffing metadata against our local SQLite-backed index. When new versions or updated package metadata are detected, the fetcher downloads the artifact, computes SHA-256 and SHA-512 checksums, verifies integrity against the upstream signature, and writes the object to our S3-compatible storage tier. Within 200 ms of write completion, the CDN cache is invalidated and the new package becomes resolvable through our registry API.

We maintain a full read replica of each upstream registry's package index. This means clients can run npm config set registry https://registry.codesync.de or configure Maven's settings.xml to point to our endpoint and receive identical results — just faster, and with all traffic staying within the EU. Our mirror currently holds 1.4 million npm packages, 890 thousand PyPI distributions, and 3.2 million Maven artifacts, totaling 4.7 TB of stored data across 12 redundant storage nodes.

All synchronization logs, access patterns, and metadata snapshots are retained for 90 days and stored exclusively on servers located in Germany and Austria, ensuring full GDPR compliance. No package download telemetry is shared with upstream registries or third parties. You can request a complete data export or deletion of your organization's access logs at any time through the dashboard.

Supported Registries

We mirror three major package ecosystems with full feature parity, including scoped packages, pre-release versions, and deprecated-package tombstones.

npm Registry

Mirror URL https://registry.codesync.de/npm

Full mirror of the public npm registry, including scoped packages (@org/pkg), bundled dependencies, and tarball assets. Supports the npm v1 API, including /-/all metadata streaming. Currently syncing 1,412,847 packages with a median propagation delay of 18 seconds. Compatible with npm 8+, yarn 1.x/4+, and pnpm 7+. Binary-native packages (node-sass, sharp, canvas) are served as-is; we do not rebuild binaries.

Configuration Run npm config set registry https://registry.codesync.de/npm or add a .npmrc entry to your project root. CI pipelines on GitHub Actions, GitLab CI, and Jenkins can reference the mirror via environment variable NPM_CONFIG_REGISTRY.

PyPI Registry

Mirror URL https://registry.codesync.de/pypi

Complete mirror of the Python Package Index, including wheels, sdists, and metadata files in Simple API and JSON API v1/v2 formats. We currently host 893,210 distributions spanning 412,500 unique projects. Wheel files are stored with their full filename hash to support pip's content-addressable cache. Supports pip 21.1+, poetry 1.2+, and uv 0.1+.

Configuration Use pip install --index-url https://registry.codesync.de/pypi/simple/ <package> or configure your pyproject.toml with a custom index URL. For Poetry, add the mirror as a secondary source with priority "secondary" to fall back to PyPI for unmapped packages.

Maven Central

Mirror URL https://registry.codesync.de/maven

Full mirror of Maven Central Repository, including all GAV coordinates, POM files, JARs, sources, and JavaDoc artifacts. We currently index 3,217,490 artifacts across 148,300 groups. Repository metadata files (maven-metadata.xml) are regenerated hourly to reflect the latest version ranges. Supports Maven 3.6+, Gradle 7+, and Ivy-compatible resolvers.

Configuration Add a mirror entry to your ~/.m2/settings.xml under <mirrors> with id central and URL https://registry.codesync.de/maven. For Gradle, set maven { url 'https://registry.codesync.de/maven' } in your repositories block. SNAPSHOT repositories are not mirrored; configure your own internal Nexus or Artifactory for mutable versions.