What to verify in a replacement build cache
Eleven checks you can run against any build cache you are thinking of putting in front of your builds. Each has what to ask or test, and what we say for FosterStack Cache so you can compare.
| Check | What to do | FosterStack Cache |
|---|---|---|
| Are releases signed, and can you check without an account? | Download one release and run the signature check yourself. You should not need to sign up or ask anyone. | Images are keylessly signed and every binary archive is covered by a signed checksums file. See Verify a release. |
| Is there a record of how it was built? | Ask for build provenance that names the workflow and run, not only a signature. | Images and archives carry SLSA provenance naming the CI run that built them. See how we build and how it maps to NIST and SLSA. |
| Is there a parts list and a statement on known vulnerabilities? | Ask for an SBOM and for VEX statements per release, and whether anyone can read them without buying anything. | SBOMs, VEX statements and signatures are published with every release, free. |
| Can you give people read-only access? | Check that a read-only login can read and that any write is refused, not just discouraged. | An optional read-only login can read; every write is refused. See CI writes, developers read. |
| What stops a bad entry reaching your builds? | Ask who can write, and what a poisoned entry could do. A cache that only the right logins can write to is the control. | See Can someone poison our build cache? |
| Does eviction keep the disk from filling? | Set a size cap and fill past it in a test. The server should drop old entries, not stop. | Size-capped least-recently-used eviction. See size limit, eviction and a full disk. |
| Can you see what it is doing? | Look for a health check and metrics you can alert on without a vendor agent. | /healthz for liveness and Prometheus metrics at /metrics. See what to alert on. |
| Does it run with no outbound connection? | Run it on a network with no route to the internet and check that builds still work. Ask whether it sends telemetry. | No telemetry and no connection to FosterStack needed. See air-gapped install. |
| What happens when it is down? | Stop it during a build. Builds should be slower, not wrong. | See what happens when the server is down. |
| What is the licence, and is the code public? | Read the licence file and check that the security evidence is not behind the paid tier. | MIT, with the source on GitHub. The security evidence is public and free. |
| What does the security-fix promise actually say? | Ask for the patch commitment in writing, with a time and what counts as a fix. | Our aim is to ship dependency fixes within 48 hours of public disclosure. That is a stated intention, not a contractual promise today. The current release is rescanned daily. See SECURITY.md. |
Where to start
If you are moving off the free Build Cache Node, read what the end of life means and the migration guide. Questions? See the FAQ.