From 935792935c6f4d3ae8dab6051c33889c12f2cfa0 Mon Sep 17 00:00:00 2001 From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com> Date: Thu, 8 Oct 2026 20:21:27 -0400 Subject: [PATCH 1/5] Page: what to check in a replacement build cache --- sitemap.xml | 4 + verify-replacement-build-cache/index.html | 125 ++++++++++++++++++++++ 2 files changed, 129 insertions(+) create mode 100644 verify-replacement-build-cache/index.html diff --git a/sitemap.xml b/sitemap.xml index 8c1e470..4ff7cda 100644 --- a/sitemap.xml +++ b/sitemap.xml @@ -16,4 +16,8 @@ weekly 1.0 + + https://fosterstack.com/verify-replacement-build-cache/ + 2026-10-08 + diff --git a/verify-replacement-build-cache/index.html b/verify-replacement-build-cache/index.html new file mode 100644 index 0000000..cd13c5d --- /dev/null +++ b/verify-replacement-build-cache/index.html @@ -0,0 +1,125 @@ + + + + + +What to check in a replacement build cache + + + + + + + + +
+ +
Infrastructure worth keeping — and kept patched.
+
+
+

What to check in a replacement build cache

+

A build cache sits inside your supply chain: what it stores ends up in your builds. Before you move to a replacement, ask these eight questions of any candidate. We answer each one for FosterStack Cache, including where the answer is not good yet.

+ +

1. Does it speak your build tool's protocol?

+

It should work with the tool's own remote cache setting, with nothing extra to install on developer machines. How to test: build twice with the local cache turned off and look for FROM-CACHE on the second run. FosterStack Cache: Gradle through its HttpBuildCache setting; Maven through Apache's Build Cache Extension, where the server side is built and its acceptance testing is still in progress.

+ +

2. Who can write to it?

+

Anything that can write to the cache can change what later builds use. Ask for authentication, and ask what permission levels exist. FosterStack Cache: Basic Auth, with one password and one permission level today. Read-only clients and per-writer identity are not built yet.

+ +

3. Can you verify what you download?

+

Look for signatures, a software bill of materials, build provenance and vulnerability statements, and check whether you need an account to see them. FosterStack Cache: signed images and checksums, an SBOM per binary archive, build provenance and a VEX file, all public. See how we build.

+ +

4. Is it kept patched?

+

Ask how often published files are rescanned and how fast fixes ship. FosterStack Cache: a release is blocked on scanner findings unless a VEX statement explains them, and published images are rescanned daily. We aim to ship dependency fixes within 48 hours of disclosure. That is a target, not a promise.

+ +

5. Does it call home?

+

A server in your build network should not need to reach out. FosterStack Cache: no telemetry, no update check, no licence check. It can run on a network with no route to the internet.

+ +

6. How do you run and watch it?

+

You want size limits, metrics and a way to see it is healthy. FosterStack Cache: size-capped eviction, Prometheus metrics, a health check and a read-only status page. There is no admin web console, on purpose.

+ +

7. What are the licence terms, and what if the project goes away?

+

You are looking at this because a free product ended. FosterStack Cache: MIT licensed, one static binary, nothing you need from us to keep running it. Paid tiers are described for the future, are not built, and security patches are never withheld from the free tier.

+ +

8. Who already runs it?

+

FosterStack Cache: nobody in a real build pipeline yet except us. If that is a dealbreaker today, it is a fair answer. The README lists what has shipped and what has not.

+ +
+ Gradle and Maven setup + Questions and answers +
+
+ + + From 78ae476a4040277601bce68a6dd4fde36bf4b9cd Mon Sep 17 00:00:00 2001 From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com> Date: Thu, 8 Oct 2026 20:23:30 -0400 Subject: [PATCH 2/5] Verify page: read-only login exists; cut reader assumption --- verify-replacement-build-cache/index.html | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/verify-replacement-build-cache/index.html b/verify-replacement-build-cache/index.html index cd13c5d..53b3768 100644 --- a/verify-replacement-build-cache/index.html +++ b/verify-replacement-build-cache/index.html @@ -85,7 +85,7 @@

1. Does it speak your build tool's protocol?

It should work with the tool's own remote cache setting, with nothing extra to install on developer machines. How to test: build twice with the local cache turned off and look for FROM-CACHE on the second run. FosterStack Cache: Gradle through its HttpBuildCache setting; Maven through Apache's Build Cache Extension, where the server side is built and its acceptance testing is still in progress.

2. Who can write to it?

-

Anything that can write to the cache can change what later builds use. Ask for authentication, and ask what permission levels exist. FosterStack Cache: Basic Auth, with one password and one permission level today. Read-only clients and per-writer identity are not built yet.

+

Anything that can write to the cache can change what later builds use. Ask for authentication, and ask what permission levels exist. FosterStack Cache: Basic Auth with a read-write login and an optional read-only login, where any write from the read-only one is refused. Per-person identity is not built yet.

3. Can you verify what you download?

Look for signatures, a software bill of materials, build provenance and vulnerability statements, and check whether you need an account to see them. FosterStack Cache: signed images and checksums, an SBOM per binary archive, build provenance and a VEX file, all public. See how we build.

@@ -100,7 +100,7 @@

6. How do you run and watch it?

You want size limits, metrics and a way to see it is healthy. FosterStack Cache: size-capped eviction, Prometheus metrics, a health check and a read-only status page. There is no admin web console, on purpose.

7. What are the licence terms, and what if the project goes away?

-

You are looking at this because a free product ended. FosterStack Cache: MIT licensed, one static binary, nothing you need from us to keep running it. Paid tiers are described for the future, are not built, and security patches are never withheld from the free tier.

+

FosterStack Cache: MIT licensed, one static binary, nothing you need from us to keep running it. Paid tiers are described for the future, are not built, and security patches are never withheld from the free tier.

8. Who already runs it?

FosterStack Cache: nobody in a real build pipeline yet except us. If that is a dealbreaker today, it is a fair answer. The README lists what has shipped and what has not.

From 0b77ad4a783d57774c3a6356b26540ae5f71a2be Mon Sep 17 00:00:00 2001 From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com> Date: Thu, 8 Oct 2026 20:35:58 -0400 Subject: [PATCH 3/5] Owner cold-read edit: Maven stated without the in-progress hedge --- verify-replacement-build-cache/index.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/verify-replacement-build-cache/index.html b/verify-replacement-build-cache/index.html index 53b3768..7ed3383 100644 --- a/verify-replacement-build-cache/index.html +++ b/verify-replacement-build-cache/index.html @@ -82,7 +82,7 @@

What to check in a replacement build cache

A build cache sits inside your supply chain: what it stores ends up in your builds. Before you move to a replacement, ask these eight questions of any candidate. We answer each one for FosterStack Cache, including where the answer is not good yet.

1. Does it speak your build tool's protocol?

-

It should work with the tool's own remote cache setting, with nothing extra to install on developer machines. How to test: build twice with the local cache turned off and look for FROM-CACHE on the second run. FosterStack Cache: Gradle through its HttpBuildCache setting; Maven through Apache's Build Cache Extension, where the server side is built and its acceptance testing is still in progress.

+

It should work with the tool's own remote cache setting, with nothing extra to install on developer machines. How to test: build twice with the local cache turned off and look for FROM-CACHE on the second run. FosterStack Cache: Gradle through its HttpBuildCache setting; Maven through Apache's Build Cache Extension.

2. Who can write to it?

Anything that can write to the cache can change what later builds use. Ask for authentication, and ask what permission levels exist. FosterStack Cache: Basic Auth with a read-write login and an optional read-only login, where any write from the read-only one is refused. Per-person identity is not built yet.

From a7cfb78732ed8bc2b50f303925d89eaeadbb2802 Mon Sep 17 00:00:00 2001 From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com> Date: Thu, 8 Oct 2026 20:50:09 -0400 Subject: [PATCH 4/5] Owner cold-read edit: cut the "nobody runs it" line --- verify-replacement-build-cache/index.html | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/verify-replacement-build-cache/index.html b/verify-replacement-build-cache/index.html index 7ed3383..8f019a7 100644 --- a/verify-replacement-build-cache/index.html +++ b/verify-replacement-build-cache/index.html @@ -4,7 +4,7 @@ What to check in a replacement build cache - + @@ -79,7 +79,7 @@

What to check in a replacement build cache

-

A build cache sits inside your supply chain: what it stores ends up in your builds. Before you move to a replacement, ask these eight questions of any candidate. We answer each one for FosterStack Cache, including where the answer is not good yet.

+

A build cache sits inside your supply chain: what it stores ends up in your builds. Before you move to a replacement, ask these seven questions of any candidate. We answer each one for FosterStack Cache, including where the answer is not good yet.

1. Does it speak your build tool's protocol?

It should work with the tool's own remote cache setting, with nothing extra to install on developer machines. How to test: build twice with the local cache turned off and look for FROM-CACHE on the second run. FosterStack Cache: Gradle through its HttpBuildCache setting; Maven through Apache's Build Cache Extension.

@@ -102,9 +102,6 @@

6. How do you run and watch it?

7. What are the licence terms, and what if the project goes away?

FosterStack Cache: MIT licensed, one static binary, nothing you need from us to keep running it. Paid tiers are described for the future, are not built, and security patches are never withheld from the free tier.

-

8. Who already runs it?

-

FosterStack Cache: nobody in a real build pipeline yet except us. If that is a dealbreaker today, it is a fair answer. The README lists what has shipped and what has not.

-
Gradle and Maven setup Questions and answers From 03ebc2cb214756f47df283c8943fd9f484b9c2dd Mon Sep 17 00:00:00 2001 From: FosterStack Admin <317177128+fosterstack-admin@users.noreply.github.com> Date: Thu, 8 Oct 2026 20:50:15 -0400 Subject: [PATCH 5/5] Checklist page: seven questions in the meta description --- verify-replacement-build-cache/index.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/verify-replacement-build-cache/index.html b/verify-replacement-build-cache/index.html index 8f019a7..b492697 100644 --- a/verify-replacement-build-cache/index.html +++ b/verify-replacement-build-cache/index.html @@ -4,7 +4,7 @@ What to check in a replacement build cache - +