Advanced features

Introduction

RepoForge.io provides several advanced features in its standard and higher subscription tiers. These are explained in detail below. Free trials include all of the features of the Advanced tier.

Upstream mirroring and edge caching are configured on the Account Settings page of the dashboard:

Upstream mirroring

This feature is available in Standard and Advanced subscriptions

Upstream mirroring dictates how your RepoForge.io Python index behaves when you try to install a package that is not present in your RepoForge.io account. For example, you may have a project called myproject, stored in your RepoForge.io account, than has a dependency on the publicly-available requests package, which is explicitly called out in the metadata of mypackage.

In this case, the following command will fail because the requests package doesn't live on your RepoForge.io instance:

pip install myproject -i https://api.repoforge.io/my-hash/

Looking in indexes: https://api.repoforge.io/my-hash/
Collecting myproject
User for api.repoforge.io: chris@repoforge.io
Password: 

Downloading https://api.repoforge.io/my-hash/myproject/0.1.0/bdist_wheel/myproject-0.1.0-py3-none-any.whl (1.1 kB)

ERROR: Could not find a version that satisfies the requirement requests==2.1.6 (from myproject) (from versions: none)
ERROR: No matching distribution found for requests==2.1.6

You could work around this by using the --extra-index-url, or -e flag instead of the -i switch. This means that pip will look both in RepoForge.io and the public PyPI instance, and in the example above, would mean that I am able to install my package correctly. However, there are security risks associated with this - for example, if you use --extra-index-url instead of --index-url, then pip will look for myproject on PyPI before it tries to look it up on RepoForge.io. This leaves you open to the possibility of somebody else uploading a malicious package called myproject to PyPI, which may get installed by pip instead your your own package.

Upstream mirroring works in the opposite way - you can turn this on and use PyPI (or any other repo) as a secondary index. To enable it, switch on Enable upstream mirroring in Account Settings, enter the PyPI mirror URL to proxy unresolved packages from, and click Save changes.

Edge caching

This feature is available in Standard and Advanced subscriptions

Turning on edge caching means that assets stored on RepoForge.io will be cached in a Global CDN. This vastly improves response times in situations where your pipelines are regularly pulling large volumes of data from RepoForge.io. To enable it, switch on Edge caching in the Performance section of Account Settings and click Save changes.

Active vulnerability monitoring

This feature is available in Advanced subscriptions only

RepoForge.io automatically scans all your Python packages for known vulnerabilities when they are first uploaded to your private repository. However, the likelihood is that there may not be known vulnerabilities in any of the dependencies you are using at the point where you first write your code. With active vulnerability monitoring, your Python packages are constantly monitored and you'll be alerted whenever a new vulnerability is found in one of your projects. See Vulnerabilities.

Custom domains

This feature is available in Advanced subscriptions only

Starting in RepoForge.io 3.0, you can now serve your private repositories on your own domain name, instead of ours. To enable this, upgrade to an Advanced account and submit a new support request via the RepoForge.io dashboard to enable this

Single sign-on (SSO)

This feature is available in Standard and Advanced subscriptions

Let your team sign in to RepoForge.io with your organization's identity provider, such as Google or Auth0. See SSO configuration for how to set it up.

Two-factor authentication

This feature is available on paid plans and free trials

Require a code from an authenticator app when signing in to the dashboard. See Two-factor authentication.