fetchurl protocol
Content-addressable URL caching for CI and package managers
Clients ask a cache server for algo/hash and pass source URLs. The server fetches, stores, and serves — but remains untrusted. Clients always verify hashes. No MITM proxies. No fragile workflow-cache keys tied to lockfile hashes alone.
How it fits together
Client
Package manager or tool that knows the hash and source URLs. Sets FETCHURL_SERVER, requests by content address, verifies the stream.
Server
Intermediate cache: stores confirmed blobs until eviction. Serves GET /:algo/:hash with X-Source-Urls.
Source
Origin that would serve the file directly. Must provide content length; mirrors can be listed and chosen randomly.
GET /api/fetchurl/sha256/e3b0… HTTP/1.1
X-Source-Urls: "https://cdn.example/file.tgz", "https://backup.example/file.tgz"Repositories
github.com/fetchurl- ProtocolspecNormative SPEC.md — versioned independently of implementations.
- ServerfetchurlReference Go server & CLI. Image: ghcr.io/fetchurl/fetchurl
- JavaScriptsdk-jsWeb Crypto client for Node, Deno, Bun, and browsers.
- Pythonsdk-pythonStdlib-friendly client with injectable HTTP fetcher.
- Rustsdk-rustProtocol state machine; bring your own HTTP stack.
- Javasdk-javaJVM client SDK for fetchurl cache servers.
Documentation
Site docs orient you across the org. Wire-level behavior is defined only in the normative spec repository.