Skip to content

Page: what to check in a replacement build cache #26

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
fosterstack-admin wants to merge 5 commits into from
Closed

Page: what to check in a replacement build cache #26

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
9357929
Page: what to check in a replacement build cache
fosterstack-admin Oct 9, 2026
78ae476
Verify page: read-only login exists; cut reader assumption
fosterstack-admin Oct 9, 2026
0b77ad4
Owner cold-read edit: Maven stated without the in-progress hedge
fosterstack-admin Oct 9, 2026
a7cfb78
Owner cold-read edit: cut the "nobody runs it" line
fosterstack-admin Oct 9, 2026
03ebc2c
Checklist page: seven questions in the meta description
fosterstack-admin Oct 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions sitemap.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,4 +16,8 @@
<changefreq>weekly</changefreq>
<priority>1.0</priority>
</url>
<url>
<loc>https://fosterstack.com/verify-replacement-build-cache/</loc>
<lastmod>2026-10-08</lastmod>
</url>
</urlset>
122 changes: 122 additions & 0 deletions verify-replacement-build-cache/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,122 @@
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>What to check in a replacement build cache</title>
<meta name="description" content="Seven questions to ask before you move to a replacement for the Build Cache Node: protocol, who can write, signed releases, patching, phoning home, operations and licence.">
<link rel="canonical" href="https://fosterstack.com/verify-replacement-build-cache/">
<link rel="icon" href="/favicon.svg" type="image/svg+xml">
<link rel="icon" href="/favicon.ico" sizes="any">
<link rel="apple-touch-icon" href="/apple-touch-icon.png">
<style>
:root {
--bg: #ffffff; --fg: #16181d; --muted: #5b6472; --line: #e4e7ec;
--accent: #0d7a5f; --accent-fg: #ffffff; --card: #f6f8f9; --warn-bg: #fff7ed; --warn-line: #fdba74;
--mark: #0f4d66;
}
@media (prefers-color-scheme: dark) {
:root {
--bg: #101318; --fg: #e8eaf0; --muted: #98a2b3; --line: #262c36;
--accent: #2fbf95; --accent-fg: #08110e; --card: #171c23; --warn-bg: #241a10; --warn-line: #7c4a12;
--mark: #e8eaf0;
}
}
* { margin: 0; padding: 0; box-sizing: border-box; }
body {
background: var(--bg); color: var(--fg);
font: 16px/1.6 system-ui, -apple-system, "Segoe UI", Roboto, sans-serif;
-webkit-font-smoothing: antialiased;
}
main { max-width: 44rem; margin: 0 auto; padding: 0 1.25rem 4rem; }
header.site { max-width: 44rem; margin: 0 auto; padding: 1.25rem; display: flex; align-items: baseline; gap: .6rem; }
.logo { font-weight: 700; font-size: 1.05rem; letter-spacing: -.01em; }
.logo span { color: var(--accent); }
.logo .mark { width: 1.2em; height: 1.2em; vertical-align: -.24em; margin-right: .4em; }
.tag { color: var(--muted); font-size: .85rem; }
.notice {
background: var(--warn-bg); border: 1px solid var(--warn-line); border-radius: 8px;
padding: .7rem 1rem; font-size: .92rem; margin: 1.5rem 0 2.5rem;
}
h1 { font-size: 2rem; line-height: 1.2; letter-spacing: -.02em; margin-bottom: 1rem; }
.lede { font-size: 1.12rem; color: var(--muted); margin-bottom: 2rem; }
h2 { font-size: 1.25rem; margin: 3rem 0 .9rem; letter-spacing: -.01em; }
p + p { margin-top: .8rem; }
.cards { display: grid; grid-template-columns: repeat(auto-fit, minmax(15rem, 1fr)); gap: .8rem; margin-top: 1rem; }
.card { background: var(--card); border: 1px solid var(--line); border-radius: 10px; padding: 1rem 1.1rem; }
.card h3 { font-size: .98rem; margin-bottom: .35rem; }
.card p { font-size: .9rem; color: var(--muted); }
ul.trust { list-style: none; margin-top: .5rem; }
ul.trust li { padding: .45rem 0 .45rem 1.6rem; position: relative; }
ul.trust li::before { content: "✓"; position: absolute; left: .2rem; color: var(--accent); font-weight: 700; }
code, pre { font-family: ui-monospace, "SF Mono", Menlo, monospace; font-size: .88em; }
code { background: var(--card); border: 1px solid var(--line); border-radius: 5px; padding: .1em .35em; }
pre code { background: none; border: 0; padding: 0; color: inherit; font-size: 1em; }
button {
padding: .7rem 1.3rem; font-size: 1rem; font-weight: 600; cursor: pointer;
background: var(--accent); color: var(--accent-fg); border: 0; border-radius: 8px;
}
button:disabled { opacity: .6; cursor: default; }
table { width: 100%; border-collapse: collapse; font-size: .92rem; margin-top: 1rem; }
th, td { text-align: left; padding: .55rem .6rem; border-bottom: 1px solid var(--line); vertical-align: top; }
th { font-size: .8rem; text-transform: uppercase; letter-spacing: .04em; color: var(--muted); }
pre { background: #0f172a; color: #e2e8f0; padding: .9rem 1rem; border-radius: 8px;
overflow-x: auto; font-size: .9rem; line-height: 1.5; }
.cta-row { display: flex; gap: .6rem; flex-wrap: wrap; margin-top: 1.1rem; }
.btn { display: inline-block; padding: .55rem 1rem; border-radius: 8px; font-weight: 600;
text-decoration: none; background: var(--accent); color: #fff; }
.btn-secondary { background: transparent; color: inherit; border: 1px solid #cbd5e1; }
.muted-note { color: var(--muted); font-size: .93rem; margin-top: 1.1rem; }
footer { border-top: 1px solid var(--line); margin-top: 4rem; padding: 1.5rem 1.25rem 3rem; }
footer div { max-width: 44rem; margin: 0 auto; color: var(--muted); font-size: .82rem; }
a { color: var(--accent); }
</style>
</head>
<body>
<header class="site">
<div class="logo"><svg class="mark" viewBox="0 0 96 96" aria-hidden="true" focusable="false"><rect x="12" y="14" width="72" height="18" rx="5" fill="var(--mark)"/><rect x="12" y="39" width="48" height="18" rx="5" fill="var(--mark)"/><rect x="12" y="64" width="26" height="18" rx="5" fill="var(--accent)"/></svg>foster<span>stack</span></div>
<div class="tag">Infrastructure worth keeping — and kept patched.</div>
</header>
<main>
<h1>What to check in a replacement build cache</h1>
<p class="lede">A build cache sits inside your supply chain: what it stores ends up in your builds. Before you move to a replacement, ask these seven questions of any candidate. We answer each one for FosterStack Cache, including where the answer is not good yet.</p>

<h2>1. Does it speak your build tool's protocol?</h2>
<p>It should work with the tool's own remote cache setting, with nothing extra to install on developer machines. <strong>How to test:</strong> build twice with the local cache turned off and look for <code>FROM-CACHE</code> on the second run. <strong>FosterStack Cache:</strong> Gradle through its <code>HttpBuildCache</code> setting; Maven through Apache's Build Cache Extension.</p>

<h2>2. Who can write to it?</h2>
<p>Anything that can write to the cache can change what later builds use. Ask for authentication, and ask what permission levels exist. <strong>FosterStack Cache:</strong> Basic Auth with a read-write login and an optional read-only login, where any write from the read-only one is refused. Per-person identity is not built yet.</p>

<h2>3. Can you verify what you download?</h2>
<p>Look for signatures, a software bill of materials, build provenance and vulnerability statements, and check whether you need an account to see them. <strong>FosterStack Cache:</strong> signed images and checksums, an SBOM per binary archive, build provenance and a VEX file, all public. See <a href="/how-we-build/">how we build</a>.</p>

<h2>4. Is it kept patched?</h2>
<p>Ask how often published files are rescanned and how fast fixes ship. <strong>FosterStack Cache:</strong> a release is blocked on scanner findings unless a VEX statement explains them, and published images are rescanned daily. We aim to ship dependency fixes within 48 hours of disclosure. That is a target, not a promise.</p>

<h2>5. Does it call home?</h2>
<p>A server in your build network should not need to reach out. <strong>FosterStack Cache:</strong> no telemetry, no update check, no licence check. It can run on a network with no route to the internet.</p>

<h2>6. How do you run and watch it?</h2>
<p>You want size limits, metrics and a way to see it is healthy. <strong>FosterStack Cache:</strong> size-capped eviction, Prometheus metrics, a health check and a read-only status page. There is no admin web console, on purpose.</p>

<h2>7. What are the licence terms, and what if the project goes away?</h2>
<p><strong>FosterStack Cache:</strong> MIT licensed, one static binary, nothing you need from us to keep running it. Paid tiers are described for the future, are not built, and security patches are never withheld from the free tier.</p>

<div class="cta-row">
<a class="btn" href="/migrate-build-cache-node/">Gradle and Maven setup</a>
<a class="btn btn-secondary" href="/build-cache-node-faq/">Questions and answers</a>
</div>
</main>
<footer>
<div>
<p>FosterStack is not affiliated with, endorsed by, or sponsored by Gradle Inc.
"Gradle" and "Develocity" are trademarks of Gradle Inc., used here only to identify
compatibility. FosterStack contains no Gradle Inc. code; it is a clean-room implementation
of the documented remote build cache HTTP protocol. Apache Maven is a trademark of the
Apache Software Foundation; the Maven Build Cache Extension is Apache's project, not
ours.</p>
<p style="margin-top:.6rem">© 2026 FosterStack · <a href="/regulated/">For regulated markets</a> · <a href="https://github.com/fosterstack/cache">github.com/fosterstack/cache</a> · <a href="mailto:hello@fosterstack.com">hello@fosterstack.com</a></p>
</div>
</footer>
</body>
</html>
Loading