Design a Package Registry
HardSystem design · Developer Tools
Design a package registry like npm, PyPI or Maven Central. Authors publish versioned packages; millions of builds resolve dependency metadata and download tarballs; users search packages; security teams need malware scanning and vulnerability advisories. Focus on immutability, content-addressed storage behind a CDN, metadata documents, search and supply-chain security. Out of scope: building a dependency resolver and a build system.
Requirements
- Make published versions immutable, enforced by the database, with content verified by digest
- Serve downloads and metadata through a cache/CDN; metadata fan-out is the install bottleneck
- Support scoped namespaces, authentication, search and reverse-dependency lookups
- Defend the supply chain: strong publisher auth, provenance, typosquat and malware scanning, advisories