FerroRepo is a universal artifact repository in Rust — OCI Distribution v1.1, Cargo sparse registry, Maven, PyPI, Helm, Go module proxy, and APT/YUM, with Sigstore / SLSA / TUF supply-chain primitives. Live on AWS Marketplace.

Measured record (as of 2026-07-10)

Quality gates passed

• OCI Distribution v1.1 conformance suite green (the upstream opencontainers/distribution-spec suite, not a home-grown one).
• The nightly fuzz farm found a real DoS in YUM rpm_header parsing — self-discovered, fixed same-day, kept as a regression test. That is the fuzz farm working as designed.
• Four of its server-side protocol implementations are published as standalone Apache-2.0 crates on crates.io — ferro-oci-server, ferro-cargo-registry-server, ferro-maven-layout, ferro-blob-store — several of them, as far as we could find at publication time, the first server-side implementations of their protocol on crates.io. Public code is the audit trail (and the fastest way to correct that claim if we missed one).

Honest limitations

• v0.1.0: single-node. Replication and HA stories are roadmap.
• Registry formats differ wildly in edge-case depth; OCI and Cargo are conformance-gated, the others are tested but not suite-certified.