Public Repo.

Public Repo exists to keep the free-software supply chain fast, private, and accessible to everyone — no signup, no tracking, no paywall. We mirror the projects people actually depend on, sync them continuously, and serve them over modern transports so that updating a Linux system never has to mean handing your download history to a third party.

The mirror is operated as a public good: hardware, bandwidth, and time are donated, the configuration is boring on purpose, and the privacy guarantees are structural rather than promised. Everything on this page — including the upstream sources, the sync method, and the operational stack — is documented so anyone can reproduce, audit, or take over the setup if they need to.

We do not log individual download requests. No access data is stored, sold, or shared with third parties.

• No access logging — download requests are never written to disk.
• Encrypted storage — all data at rest is protected with ZFS native encryption.
• No shell history — operator sessions leave no command history on the server.
• Headless server — eliminating physical access vectors.
• HTTPS available — the mirror is reachable over both HTTPS and plain HTTP. HTTPS is recommended where supported.
• No analytics or trackers — this site is static HTML and sets no cookies.

Pick your distribution. Replace the matching Server or deb line in your package manager. Refresh.

Server = https://public-repo.com/archlinux/$repo/os/$arch

sudo pacman -Syyu

Server = https://public-repo.com/archlinuxarm/$arch/$repo

Server = https://public-repo.com/archlinux32/$arch/$repo

deb https://public-repo.com/ubuntu/ noble main restricted universe multiverse
              deb https://public-repo.com/ubuntu/ noble-updates main restricted universe multiverse
              deb https://public-repo.com/ubuntu/ noble-security main restricted universe multiverse

deb https://public-repo.com/ubuntu-ports/ noble main restricted universe multiverse

deb https://public-repo.com/debian/ bookworm main contrib non-free non-free-firmware
              deb https://public-repo.com/debian/ bookworm-updates main contrib non-free non-free-firmware
              deb https://public-repo.com/debian-security/ bookworm-security main contrib non-free non-free-firmware

deb https://public-repo.com/linuxmint-packages/ virginia main upstream import backport

GENTOO_MIRRORS="https://public-repo.com/gentoo"

[gentoo]
              location = /var/db/repos/gentoo
              sync-type = webrsync
              auto-sync = yes

Server = https://public-repo.com/endeavouros/$repo/$arch

deb https://public-repo.com/raspbian/ bookworm main contrib non-free rpi

deb https://public-repo.com/kali/ kali-rolling main contrib non-free non-free-firmware

Server = https://public-repo.com/cachyos/$repo/$arch

Server = https://public-repo.com/aur.chaotic.cx/$repo/$arch

https://public-repo.com/fdroid-repo/

https://public-repo.com/fdroid-archive/

https://public-repo.com/alpine/v3.20/main
              https://public-repo.com/alpine/v3.20/community

https://public-repo.com/chimera/current/main

FreeBSD: { enabled: no }
              public-repo: {
                  url: "https://public-repo.com/freebsd/ports/${ABI}/latest",
                  enabled: yes
              }

Everything is synchronized across all architectures and archives. One mirror, eighteen projects.

The Quick Start above is interactive. Each command is also reproduced below so it survives copy-paste and Reader Mode.

You can browse each project directly — directory listings are enabled. Same commands as the picker; one per distro.

A continuous loop. ~100 seconds of sleep between full passes — freshness is bounded by one pass plus that.

Sync is performed with rsync using -avhW, atomic --delay-updates --delete-delay, --safe-links, and an exclude list for upstream HTML, robots.txt and favicons so this page is never overwritten.

Upstream rsync sources

How fresh is it?

Most projects publish their own freshness file. For example: archlinux/lastsync (Unix timestamp) and archlinux/lastupdate, debian/project/trace/, ubuntu/project/trace/.

This is a mirror — bytes only. Trust does not come from us; it comes from each project's own signing infrastructure.

# refresh keyring
sudo pacman -Sy archlinux-keyring
sudo pacman-key --refresh-keys

gpg --verify SHA256SUMS.gpg SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missing

• Use a sane number of parallel connections. Package managers' defaults are fine.
• Don't scrape the entire tree just to make a private mirror — set up rsync against the upstreams instead, exactly as we do.
• Don't hardcode public-repo.com in consumer-facing products without contacting us first.
• Abusive sources may be rate-limited or blocked without notice.

Beyond the public mirror, we offer managed private caches and mirrors for organizations that need their own controlled copy of one or more upstream archives — air-gapped labs, regulated environments, CI fleets, ISPs, universities, and anyone who wants the same operational model we run here, on their own infrastructure or hosted by us.

Typical engagements include:

• Dedicated rsync/HTTPS mirrors of selected distributions, kept in sync on your schedule.
• Internal package caches for CI/CD and developer fleets, with bandwidth and freshness SLAs.
• Air-gapped / offline mirror bundles, delivered on a regular cadence.
• Hardened mirror appliances built on FreeBSD + ZFS + nginx, matching the stack described in Infrastructure.
• Bare-metal management — full lifecycle operation of customer-owned or colocated hardware: provisioning, OS hardening, monitoring, patching, capacity planning, and on-call response.
• Migration from existing mirror setups (apt-cacher-ng, Nexus, Artifactory, plain rsync) to a leaner, lower-overhead design.

For pricing and scoping, see Contact.

Public Repo is operated as a public good and runs on volunteer time, donated bandwidth, and out-of-pocket hardware. Sponsorships keep it that way — no ads, no tracking, no paywalled tiers.

What sponsors get

• Logo and link on this page, in the section below, for the duration of the sponsorship.
• No influence over editorial or operational decisions — we don't accept sponsorships that come with conditions on what we mirror, who we serve, or what we log. (We log nothing. That doesn't change.)

If you need operational support, SLAs, or a dedicated mirror, that's a separate offering — see Managed services.

Any contribution helps — there are no fixed amounts and no tiers. Sponsorships can be invoiced (EUR, SEPA / SWIFT) or paid in BTC. To set one up, see Contact.

Current sponsors

No sponsors yet — this section will list them as they come on board. Reach out if you'd like to be the first.

Trademarks

All distribution names, logos, and project marks referenced on this site — including but not limited to Arch Linux, Debian, Ubuntu, Kali Linux, Tails, LineageOS, Linux Mint, Gentoo, EndeavourOS, Raspberry Pi / Raspbian, CachyOS, Chaotic-AUR, Alpine Linux, Chimera Linux, FreeBSD, and F-Droid — are the property of their respective owners. Public Repo is an independent mirror operator and is not affiliated with, endorsed by, or sponsored by any of these projects unless explicitly stated.

Other names

The mirror also responds to the legacy hostname cdnmirror.com; it serves the same content from the same infrastructure as public-repo.com.

Content

Public Repo redistributes unmodified copies of files published by upstream projects. All redistributed content remains subject to the licenses and terms set by those upstream projects. We add nothing, remove nothing, and re-sign nothing — verification keys come from the projects themselves (see Verifying downloads).

Warranty disclaimer

This service is provided "as is" and "as available", without warranty of any kind, express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, non-infringement, or uninterrupted availability. Use of this mirror is at your own risk.

Limitation of liability

To the maximum extent permitted by applicable law, the operators of Public Repo shall not be liable for any direct, indirect, incidental, consequential, or special damages arising from the use of, or inability to use, this service — including but not limited to data loss, downtime, or content that is out of date relative to upstream.

Abuse and takedowns

To report abusive use of this service or to submit a good-faith takedown request concerning specific mirrored content, get in touch via Contact with the URL(s) and the basis for the request. We will forward upstream-licensing concerns to the relevant upstream project, since we do not modify or curate their archives.

Privacy

We do not log individual download requests, set cookies, or run analytics. See Privacy for details.

Sibling services in the public-* family. All free, all unbranded, all run on the same principles.

For questions, abuse reports, mirror requests, or operational issues —