getnora-io/nora v1.2.0

on GitHub

NORA 1.2.0

Reliability release: resumable downloads on every format, Docker cross-repo blob mount, and a dozen fixes hardening proxy and storage paths.

Highlights

• Resumable downloads everywhere — curl -C -, pip, apt resume interrupted transfers on every artifact type instead of re-downloading from scratch. Mutable content (indexes, packuments, repodata) is excluded — a resumed range across a rewrite would splice two generations. (#893)
• Docker cross-repo blob mount — POST /v2/{name}/blobs/uploads/?mount={digest}&from={repo} copies a blob from another repo on the same registry without re-uploading. (#917)
• PyPI namespace guard — ensure_pypi_dates_cached no longer leaks internal package names upstream (dependency confusion surface). (#905)

Added

• Docker cross-repo blob mount (?mount=&from=) (#917)
• Resumable downloads (Range / 206 Partial Content) for every format (#893)
• CI builds a per-PR test image ghcr.io/getnora-io/nora:pr-<N> (#908)
• Per-PR test images are garbage-collected on close + daily sweep (#910)

Fixed

• Maven metadata: server-generated artifact metadata stays authoritative after client re-upload (#887)
• Docker returns OCI-conformant 429 with Retry-After on upload limit (#895)
• Object-store timeouts sized for client-paced streaming (#894)
• Cancelled blob upload frees the session instead of leaking it (#897)
• npm self-prime metadata on tarball download with is_internal_namespace guard (#903)
• PyPI dates.json excluded from simple index and downloads (#891)
• PyPI ensure_pypi_dates_cached namespace guard (#905)
• Conan v1/ping route for Conan 2.x client compatibility (#901)
• Docker fails closed on transient storage errors in manifest reads (#911)
• Atomic token-file writes; store errors → 503, not 401 (#912)
• Retention and GC unified into one scheduler — retention no longer starved by GC (#914)

Performance

• rpm/deb index-rebuild sidecars read concurrently (#913)

Security

• h2 updated 0.4.13 → 0.4.17 (RUSTSEC-2026-0258) (#916)

Docs

• README: expanded supported registries table and fixed legend link (#900)
• Documented docker_anon_pull in env example and llms.txt (#899)

Thanks 🤝

• Joe Grund (@jgrund) — resumable downloads across every format, OCI-conformant 429, upload cancel fix, PyPI dates.json and namespace guard, Conan v1/ping, Docker fail-closed on storage errors, atomic token writes, unified retention+GC scheduler, concurrent rpm/deb sidecar reads.
• Anton Patsev (@patsevanton) — npm self-prime metadata fix (#903), README registries table (#900).

Install

# x86_64
curl -LO https://github.com/getnora-io/nora/releases/download/v1.2.0/nora-linux-amd64
chmod +x nora-linux-amd64 && sudo mv nora-linux-amd64 /usr/local/bin/nora

# ARM64 (Apple Silicon, Graviton, Ampere)
curl -LO https://github.com/getnora-io/nora/releases/download/v1.2.0/nora-linux-arm64
chmod +x nora-linux-arm64 && sudo mv nora-linux-arm64 /usr/local/bin/nora

Docker

docker pull getnora/nora:1.2.0

DEB / RPM

# Debian / Ubuntu / Astra Linux (amd64)
curl -LO https://github.com/getnora-io/nora/releases/download/v1.2.0/nora-amd64.deb
sudo dpkg -i nora-amd64.deb

# RHEL / Fedora / RED OS (amd64)
curl -LO https://github.com/getnora-io/nora/releases/download/v1.2.0/nora-amd64.rpm
sudo rpm -i nora-amd64.rpm

Changelog

See CHANGELOG.md