bitsdepends

bitsdepends is an open-source binary dependency management system designed to track, resolve, and fetch binary artifacts and their dependencies across build and deployment environments. It emphasizes binaries rather than source code to enable deterministic, replayable builds by recording artifact coordinates, digests, provenance, and platform information.

The project provides a declarative manifest format, a resolution engine, and a command-line client that can fetch artifacts from multiple repositories, verify integrity via cryptographic checksums, and populate a local cache. It supports transitive dependencies, version constraints, and platform- or architecture-specific selection to ensure reproducible results.

Architecturally, bitsdepends consists of a manifest schema, a resolver, an artifact store interface, a local cache, and optional server components for indexing and sharing artifacts. Backends include OCI-compatible registries, HTTP(S) file stores, and specialized binary repositories. The design prioritizes hermetic builds and offline operation when caches are available.

Bitsdepends is maintained by an open community and released under a permissive license. Development follows a transparent process with issue tracking, code reviews, and regular releases. It integrates with common continuous integration and build systems to streamline binary procurement in multi-language environments.

In practice, bitsdepends complements source-based package managers by handling compiled artifacts across platforms, architectures, and environments. It is used to assemble container images, test artifacts in CI pipelines, and reproduce builds in air-gapped or audited contexts. Challenges include keeping digests current, managing licensing constraints, and ensuring compatibility with diverse repository backends.

Related topics include dependency management, artifact repositories, and build automation.