Features
Kurra is open source, and you can run it yourself. Enterprise adds policy controls, hosted registries, identity features, and audit export, and needs a Kurra license.
What each version includes
The open source version mirrors every supported ecosystem and controls who can pull from it. Enterprise adds the checks that decide what is allowed in.
| Feature | Open source | Enterprise |
|---|---|---|
| Mirroring and caching | ||
| Mirrors for every supported ecosystem | Included | Included |
| Storage in a bucket you ownEach tenant connects its own S3-compatible bucket. | Included | Included |
| Cache-first and direct fetch modes | Included | Included |
| Upstream rate limits, backoff, and stale copies when an upstream fails | Included | Included |
| Rate limits and quota tracking shared across replicasUses Valkey, so every replica enforces the same limits. | Not included | Included |
| Package policy | ||
| Turn an ecosystem off for an organization | Included | Included |
| Known advisories shown on package pagesEnterprise syncs OSV data ahead of time for every ecosystem it covers. | npm only | Included |
| Block packages with known advisoriesSet a severity threshold for the organization or for each tenant. | Not included | Included |
| Allow or block a package or version by hand | Not included | Included |
| Software license allow list | Not included | Included |
| Reputation check for look-alike package names | Not included | Included |
| Minimum release ageRefuses a version until it has been published for the number of days you set. | Not included | Included |
| Verify mirrored files match the checksum the upstream publishesA file that doesn’t match is never cached or served. | Included | Included |
| Check upstream signatures, checksums, and attestations, and record the result | Included | Included |
| Refuse files that fail verification | Not included | Included |
| Software bill of materials for container imagesGenerated in CycloneDX format when an image is first cached. | Not included | Included |
| Hosted registries | ||
| Publish your own packages to a Kurra registry | Included | Included |
| Reserved package names that mirrors never serveStops a public package from shadowing one you host. | Not included | Included |
| Verify build provenance for packages you hostKurra verifies a Sigstore bundle you supply and never signs anything. | Not included | Included |
| Access and identity | ||
| Sign in with GitHub | Included | Included |
| Single sign-on with OIDC or SAML | Not included | Included |
| Tokens limited to chosen permissions and registriesA token expires after 90 days unless you set another lifetime. | Included | Included |
| Admin, Security, Publisher, Reader, and Auditor roles | Included | Included |
| Custom roles | Not included | Included |
| Auditor and Viewer roles for an organization | Not included | Included |
| IP allowlists for each registry | Not included | Included |
| Zero-trust integrations for CI systems | Not included | Included |
| Private network allowlistsAvailable when you host Kurra yourself. | Not included | Included |
| Audit and operations | ||
| Activity feed and a tamper-evident audit log | Included | Included |
| Audit log exportDownload CSV or NDJSON for an auditor. | Not included | Included |
| Ecosystem analytics and usage metrics | Included | Included |
| Self-hosted architecture | Included | Included |
| Tenants and registries per organization | Free-tier limits | Set by your license |
A policy control applies to the ecosystems that provide the data it needs, so a setting can have no effect in an ecosystem it doesn’t cover. The next table lists them.
Which ecosystems each control covers
These are the Enterprise policy controls. A setting for a control does nothing in an ecosystem it doesn’t cover.
| Ecosystem | Name reputation | Minimum release age | Advisory blocking | License policy | Registry signature | Build attestation |
|---|---|---|---|---|---|---|
| APK | Not covered | Covered | Covered | Covered | Covered | Not covered |
| APT | Not covered | Covered | Covered | Not covered | Covered | Not covered |
| Cargo | Covered | Covered | Covered | Covered | Not covered | Not covered |
| Composer | Covered | Covered | Covered | Covered | Not covered | Not covered |
| Docker | Covered | Not covered | Not covered | Not covered | Not covered | Covered |
| Go | Covered | Covered | Covered | Covered | Covered | Not covered |
| Helm | Covered | Partly | Not covered | Not covered | Partly | Partly |
| Maven | Covered | Covered | Covered | Covered | Covered | Not covered |
| npm | Covered | Covered | Covered | Covered | Covered | Covered |
| NuGet | Covered | Covered | Covered | Covered | Covered | Not covered |
| PyPI | Covered | Covered | Covered | Covered | Not covered | Covered |
| RPM | Not covered | Covered | Covered | Covered | Covered | Not covered |
| RubyGems | Covered | Covered | Covered | Covered | Not covered | Covered |
| Terraform | Covered | Covered | Not covered | Not covered | Covered | Not covered |
- Docker’s cosign signatures are checked as build attestations, so Docker has no registry signature check.
- Helm is covered in part. Classic chart repositories are checked for release age and provenance files. OCI charts are checked with cosign signatures, like Docker images.
- APT, APK, and RPM have no name reputation check, because the distribution sets package names.