工具介绍
kkRepo 是一个与 Nexus 兼容的自主托管的 Maven、npm、PyPI、Go、Helm、NuGet 等项目库。
kkRepo
English | 中文
kkRepo is a community-driven, fully open-source, self-hosted artifact repository designed to address the limitations and pain points of Sonatype Nexus Community Edition and provide the community with an open, reliable, and sustainably evolving artifact management solution. It currently supports Maven, npm, PyPI, Go, Helm, Cargo/Rust, Dart/Pub, Composer/PHP, Terraform, Swift Package Registry, Ansible Galaxy, Conda, APT/Debian, Conan 2, Alpine/APK, R/CRAN, Docker/OCI, NuGet, RubyGems, Yum, Raw, and other artifact formats.
Features
- Support for 20+ mainstream repository formats across hosted, proxy, and group repository types.
- Supports AOT compilation and runtime, with about one-second startup readiness and memory usage below 200 MB.
- Per-repository outbound HTTP or SOCKS5 proxy configuration for proxy repositories, with optional proxy authentication and HTTPS upstream tunneling.
- Artifact security scanning with CycloneDX SBOM generation, known-vulnerability matching, policy and waiver management, and optional download enforcement.
- Rich artifact cleanup policies for enterprise-grade artifact lifecycle management.
- Compatibility with Sonatype Nexus APIs, user permission model, and the
/repository//...URL layout. - Use kkRepo as a drop-in replacement for Sonatype Nexus, with one-click migration of existing data while preserving repository domains and URLs, so client configurations and CI workflows continue unchanged.
- Comprehensive identity and access control with Local, LDAP, and OIDC authentication, configurable anonymous access policies, and fine-grained permissions.
- Comprehensive observability with Prometheus metrics export and Grafana dashboards.
- MySQL or PostgreSQL-backed metadata and shared runtime state; MySQL remains the default.
- OSS/S3/File storage support for artifact blobs.
- Multi-replica high-availability deployment support.
Trademark Notice
Sonatype, Nexus, and Nexus Repository are trademarks of Sonatype, Inc. kkRepo is an independent open source project and is not affiliated with, endorsed by, sponsored by, or connected to Sonatype, Inc. References to Sonatype Nexus Repository are used only to describe compatibility, migration, or interoperability.
Quick Start
Start a local trial environment with the public release image and MySQL:
curl -fsSL https://raw.githubusercontent.com/klboke/kkrepo/main/scripts/quickstart.sh | bashTo run the same image with the default PostgreSQL 16 quickstart instead (the runtime supports PostgreSQL 12+):
curl -fsSL https://raw.githubusercontent.com/klboke/kkrepo/main/scripts/quickstart.sh | KKREPO_DATABASE_TYPE=postgresql bashTo use the multi-architecture Native image instead of the default JVM image:
curl -fsSL https://raw.githubusercontent.com/klboke/kkrepo/main/scripts/quickstart.sh | KKREPO_RUNTIME=native bashKKREPO_RUNTIME and KKREPO_DATABASE_TYPE are independent and can be combined, for example with KKREPO_RUNTIME=native KKREPO_DATABASE_TYPE=postgresql.
Open:
- Admin console:
http://127.0.0.1:19090/admin/ - User browser:
http://127.0.0.1:19090/browse/ - Health check:
http://127.0.0.1:19091/actuator/health
On the first visit, create the initial Local/admin administrator password in the UI. The quickstart uses File blob storage for local trials; use OSS/S3 and your own encryption secrets for production.
If you prefer to inspect the script before running it, download scripts/quickstart.sh first and then run it with bash.
Build And Deployment
Local quick start, Spring Boot executable jar, Docker image, archive package, production deployment architecture, resource sizing, and upgrade flow are documented in the Build And Deployment Guide.
For measured startup, memory, image-size, and warmed-throughput tradeoffs between the default JVM runtime and the opt-in Native Image runtime, see the Native Image or JVM Selection Guide.
If kkRepo is deployed behind Nginx or another HTTPS reverse proxy, follow the Nginx Reverse Proxy Notes so generated repository URLs, such as npm dist.tarball, keep the public https:// scheme and host.
Local hot-reload development and testing are documented in the Development Guide.
Supported Capabilities
| Format | Repository types | Client publish/upload | Browse and search | Nexus migration |
|---|---|---|---|---|
| Maven | hosted / proxy / group | Maven deploy, PUT upload, and admin UI upload | Supported | Hosted repositories are migrated by default; proxy repositories can be migrated optionally |
| npm | hosted / proxy / group | npm publish, dist-tag, and admin UI upload |
Supported | Hosted repositories are migrated by default; proxy repositories can be migrated optionally |
| PyPI | hosted / proxy / group | twine upload and admin UI upload | simple index supported | Hosted repositories are migrated by default; proxy repositories can be migrated optionally |
| Go | hosted / proxy / group | Nexus-compatible .zip PUT plus UI/API upload; Go clients resolve private hosted and public proxied modules through one group |
Supported | Hosted repositories are migrated by default; proxy repositories can be migrated optionally |
| Helm | hosted / proxy / group | chart push, PUT upload, ordered group resolution, and admin UI upload | index.yaml aggregation supported | Hosted repositories are migrated by default; proxy repositories are optional; group definitions are migrated |
| Cargo / Rust | hosted / proxy / group | cargo publish, yank/unyank, CargoToken auth, and UI/API .crate upload |
Sparse index and cargo search supported |
Cargo repository migration is supported |
| Dart / Pub | hosted / proxy / group | dart pub publish, dart pub get, flutter pub get, PubToken auth, and UI/API .tar.gz upload |
Package/version metadata, archive attributes, and Pub search supported | Nexus 3.92.0 Pub hosted migration and explicitly selected proxy cache migration are supported |
| Composer / PHP | hosted / proxy / group | Composer has no standard publish command; Components API and UI zip/tar archive upload plus Composer 2 installation are supported | Package/version metadata, dist, HTML View, Browse/Search, and Usage supported | Native Nexus Composer proxy configuration is migrated; cache migration requires explicit administrator selection and a proven source profile |
| Terraform Provider / Module Registry | hosted / proxy / group | Nexus-compatible PUT and UI/API archive upload; terraform init resolves hosted and proxied modules/providers through groups |
Module/provider coordinates, versions, platforms, Browse/Search, and Usage supported | Nexus Terraform hosted data and explicitly selected proxy archive caches are migrated; proxy/group configuration is also migrated |
| Swift Package Registry | hosted / proxy / group | swift package-registry publish, Basic/Bearer login, and UI/API source archive upload |
Registry v1 release/manifest/archive metadata, Browse/Search, and Usage supported | Swift hosted data is FULL only for verified Nexus 3.92.x-3.94.x datastore shapes; drift and unavailable proxy secrets require manual action |
| Ansible Galaxy | hosted / proxy / group | ansible-galaxy collection publish, Nexus-compatible raw PUT, route-scoped Base64 Bearer/Ansible 2.9 Token credentials, GenericToken, and UI/API collection upload (usage guide) |
Galaxy v3 collection/version/artifact metadata, dependencies, Browse/Search, and Usage supported | Nexus 3.93.x-3.94.x repository definitions and shape-gated hosted/proxy collection data are supported; unknown datastore shapes fail closed |
| Conda | hosted / proxy / group | Nexus-compatible raw PUT plus UI/API upload for .tar.bz2 and .conda packages |
Channel/subdir metadata, JSON/BZ2/ZSTD repodata, channeldata, Browse/Search, and Usage supported | Repository definitions and shape-gated Nexus 3.92.x-3.94.x hosted package data are supported; generated metadata is rebuilt on the target |
| APT / Debian | hosted / proxy | Nexus-compatible repository-root POST and Components API/UI .deb upload; real apt update, download, install, and upgrade (usage guide) |
Signed Packages/Release metadata, by-hash, Browse/Search, and Usage supported | Repository definitions and shape-gated Nexus 3.92.x-3.94.x hosted packages are supported; signing keys require explicit import before migrated repositories are enabled |
| Conan 2 | hosted / proxy / group | conan upload, Conan bearer login, and UI/API revision-file upload (usage guide) |
RREV/PREV metadata, Nexus-aligned write-time Browse paths, Search, and Usage supported | Nexus 3.94 repository definitions and shape-gated hosted or explicitly selected proxy-cache revisions are supported; Conan 1 and unknown shapes fail closed |
| Alpine / APK | hosted / proxy / group | Canonical APK v2 PUT and UI/Components API upload; real apk update, search, policy, fetch, install, and upgrade (usage guide) |
Signed APKINDEX.tar.gz, passthrough/verified re-sign proxy, ordered group source binding, Browse/Search, and Usage supported |
Nexus 3.94 definitions and shape-gated hosted packages are supported; generated indexes are rebuilt and unavailable signing keys or proxy secrets fail closed |
| R / CRAN | hosted / proxy / group | Canonical source .tar.gz PUT and UI/Components API upload; real available.packages(), install, and update flows (usage guide) |
Deterministic PACKAGES.gz, arbitrary-file proxy, snapshot-bound group, Browse/Search, Cleanup, scanning, and Usage supported |
Nexus 3.94 definitions and shape-gated hosted source packages are supported; generated indexes and bindings are rebuilt |
| Hugging Face Models | proxy | hf download, hf_hub_download, snapshot_download, Transformers, and Diffusers through HF_ENDPOINT (usage guide) |
Commit-pinned model metadata/files, server-side LFS/Xet bridge, Browse/Search, Cleanup, and scanning supported | Nexus 3.77+ definitions are recognized; explicitly selected Nexus 3.94 proxy cache is shape-gated and unknown identities fail closed |
| Docker / OCI | hosted / proxy / group | Registry V2 login, hosted push/pull, proxy pull, group pull, OCI referrers, cleanup, and connector-port access | Manifest/tag/blob metadata supported | Hosted Docker repository data migration is supported through the Nexus Repository Data flow |
| NuGet | hosted / proxy / group | package push and admin UI upload | v3 service index / search supported | Hosted repositories are migrated by default; proxy repositories can be migrated optionally |
| RubyGems | hosted / proxy / group | gem push/yank and admin UI upload | Supported | Hosted repositories are migrated by default; proxy repositories can be migrated optionally |
| Yum | hosted / proxy / group | RPM upload and admin UI upload | repodata supported | Hosted repositories are migrated by default; proxy repositories can be migrated optionally |
| Raw | hosted / proxy / group | PUT upload and admin UI upload | Supported | Hosted repositories are migrated by default; proxy repositories can be migrated optionally |
Migrating From Sonatype Nexus Repository
Migration is available in the /admin/ console:
- Enable Script REST API script creation on the source Sonatype Nexus Repository deployment.
- On the
Nexus Metadatapage, runRun preflightfirst, then runRun migrationafter blocking issues are resolved. - On the
Nexus Repository Datapage, runSync metadatato migrate repository metadata, then runSync packagesto migrate the real blob data. - For the first reposito
Issues· 8 开放
暂无开放 Issues，或尚未同步最近议题。