Public Repo

Quick Start

Pick your distribution. Replace the matching Server or deb line in your package manager, then refresh.

Server = https://public-repo.com/archlinux/$repo/os/$arch

sudo pacman -Syyu

Server = https://public-repo.com/archlinuxarm/$arch/$repo

Server = https://public-repo.com/archlinux32/$arch/$repo

deb https://public-repo.com/ubuntu/ noble main restricted universe multiverse
deb https://public-repo.com/ubuntu/ noble-updates main restricted universe multiverse
deb https://public-repo.com/ubuntu/ noble-security main restricted universe multiverse

deb https://public-repo.com/ubuntu-ports/ noble main restricted universe multiverse

deb https://public-repo.com/debian/ bookworm main contrib non-free non-free-firmware
deb https://public-repo.com/debian/ bookworm-updates main contrib non-free non-free-firmware
deb https://public-repo.com/debian-security/ bookworm-security main contrib non-free non-free-firmware

deb https://public-repo.com/linuxmint-packages/ virginia main upstream import backport

GENTOO_MIRRORS="https://public-repo.com/gentoo"

[gentoo]
location = /var/db/repos/gentoo
sync-type = webrsync
auto-sync = yes

Server = https://public-repo.com/endeavouros/$repo/$arch

deb https://public-repo.com/raspbian/ bookworm main contrib non-free rpi

deb https://public-repo.com/kali/ kali-rolling main contrib non-free non-free-firmware

Server = https://public-repo.com/cachyos/$repo/$arch

Server = https://public-repo.com/aur.chaotic.cx/$repo/$arch

https://public-repo.com/fdroid-repo/

https://public-repo.com/fdroid-archive/

https://public-repo.com/alpine/v3.20/main
https://public-repo.com/alpine/v3.20/community

https://public-repo.com/chimera/current/main

FreeBSD: { enabled: no }
public-repo: {
    url: "https://public-repo.com/freebsd/ports/${ABI}/latest",
    enabled: yes
}

Mirrored Projects

Everything is synchronized across all architectures and archives served here. Directory listings are enabled — browse any path directly.

How to Use

The Quick Start section above lists configuration for each distribution. You can also browse each project directly — directory listings are enabled on every path.

Replace release codenames (noble, bookworm, virginia, v3.20, and so on) with the values for your installed release before applying any apt or apk lines.

Sync Schedule

Sync runs in a continuous loop with roughly 100 seconds of rest between full passes. Freshness is bounded by one pass plus that interval.

Sync is performed with rsync using -avhW, atomic --delay-updates --delete-delay, --safe-links, and an exclude list for upstream HTML, robots.txt, and favicons so this page is never overwritten.

Upstream rsync sources

How fresh is it?

Most projects publish their own freshness files. For example: archlinux/lastsync (Unix timestamp), archlinux/lastupdate, debian/project/trace/, and ubuntu/project/trace/.

Verifying Downloads

This is a mirror — bytes only. Trust comes from each project's own signing infrastructure, not from us.

Arch and derivatives

pacman verifies package signatures by default. Keep the keyring current:

# refresh keyring
sudo pacman -Sy archlinux-keyring
sudo pacman-key --refresh-keys

Debian family

apt verifies Release.gpg / InRelease against keys in debian-archive-keyring or ubuntu-keyring. Never use --allow-unauthenticated to work around a verification failure — it almost certainly means the mirror is mid-sync.

ISO images

Each project publishes SHA256SUMS and a detached signature next to the ISOs. Verify both:

gpg --verify SHA256SUMS.gpg SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missing

F-Droid

The F-Droid app pins each repository's index signing key on first add. All future updates are verified against that key automatically.

Mission

Public Repo exists to keep the free-software supply chain fast, private, and accessible to everyone — no signup, no tracking, no paywall. We mirror the projects people actually depend on, sync them continuously, and serve them over modern transports so that updating a Linux system never has to mean handing your download history to a third party.

The mirror is operated as a public good: hardware, bandwidth, and time are donated, the configuration is boring on purpose, and the privacy guarantees are structural rather than promised. Everything on this page — including the upstream sources, the sync method, and the operational stack — is documented so anyone can reproduce, audit, or take over the setup if they need to.

Privacy

We do not log individual download requests. No access data is stored, sold, or shared with third parties.

• No access logging — download requests are never written to disk.
• Encrypted storage — all data at rest is protected with ZFS native encryption.
• No shell history — operator sessions leave no command history on the server.
• Headless server — eliminating physical access vectors.
• HTTPS available — the mirror is reachable over both HTTPS and plain HTTP. HTTPS is recommended where supported.
• No analytics or trackers — this site is static HTML and sets no cookies.

Features

• HTTP and HTTPS with HTTP/2
• IPv4 and IPv6 on every endpoint
• Directory index enabled
• HTTP GET only — other methods denied at the web tier
• Response headers: X-Content-Type-Options: nosniff, X-Frame-Options: DENY
• No access logging, no cookies, no analytics
• No signup, no API key, no rate-tier upsell
• Cost: $0

Comparison

Public Repo is one of the stricter, no-log, fully public mirrors. Quick reference:

Infrastructure

Troubleshooting

FAQ

Acceptable Use

• Use a sane number of parallel connections. Package managers' defaults are fine.
• Do not scrape the entire tree just to make a private mirror — set up rsync against the upstreams instead, exactly as we do.
• Do not hardcode public-repo.com in consumer-facing products without contacting us first.
• Abusive sources may be rate-limited or blocked without notice.

Managed Services

Beyond the public mirror, we offer managed private caches and mirrors for organisations that need their own controlled copy of one or more upstream archives — air-gapped labs, regulated environments, CI fleets, ISPs, universities, and anyone who wants the same operational model we run here, on their own infrastructure or hosted by us.

Typical engagements include:

• Dedicated rsync/HTTPS mirrors of selected distributions, kept in sync on your schedule.
• Internal package caches for CI/CD and developer fleets, with bandwidth and freshness SLAs.
• Air-gapped / offline mirror bundles, delivered on a regular cadence.
• Hardened mirror appliances built on FreeBSD, ZFS, and nginx, matching the stack described under Infrastructure.
• Bare-metal management — full lifecycle operation of customer-owned or colocated hardware: provisioning, OS hardening, monitoring, patching, capacity planning, and on-call response.
• Migration from existing mirror setups (apt-cacher-ng, Nexus, Artifactory, plain rsync) to a leaner, lower-overhead design.

For pricing and scoping, see Contact.

Sponsors

Public Repo is operated as a public good and runs on volunteer time, donated bandwidth, and out-of-pocket hardware. Sponsorships keep it that way — no ads, no tracking, no paywalled tiers.

Sponsors receive a logo and link on this page for the duration of the sponsorship, with no influence over editorial or operational decisions. If you need operational support, SLAs, or a dedicated mirror, see Managed Services instead.

Any contribution helps — there are no fixed amounts and no tiers. Sponsorships can be invoiced (EUR, SEPA / SWIFT) or paid in BTC. To set one up, see Contact.

No sponsors yet.

Legal

Trademarks

All distribution names, logos, and project marks referenced on this site — including Arch Linux, Debian, Ubuntu, Kali Linux, Tails, LineageOS, Linux Mint, Gentoo, EndeavourOS, Raspberry Pi / Raspbian, CachyOS, Chaotic-AUR, Alpine Linux, Chimera Linux, FreeBSD, and F-Droid — are the property of their respective owners. Public Repo is an independent mirror operator and is not affiliated with, endorsed by, or sponsored by any of these projects unless explicitly stated.

Other names

The mirror also responds to the legacy hostname cdnmirror.com; it serves the same content from the same infrastructure as public-repo.com.

Content

Public Repo redistributes unmodified copies of files published by upstream projects. All redistributed content remains subject to the licenses and terms set by those upstream projects. We add nothing, remove nothing, and re-sign nothing — verification keys come from the projects themselves (see Verifying Downloads).

Warranty disclaimer

This service is provided "as is" and "as available", without warranty of any kind, express or implied, including but not limited to warranties of merchantability, fitness for a particular purpose, non-infringement, or uninterrupted availability. Use of this mirror is at your own risk.

Limitation of liability

To the maximum extent permitted by applicable law, the operators of Public Repo shall not be liable for any direct, indirect, incidental, consequential, or special damages arising from the use of, or inability to use, this service — including but not limited to data loss, downtime, or content that is out of date relative to upstream.

Abuse and takedowns

To report abusive use of this service or to submit a good-faith takedown request concerning specific mirrored content, contact us via Contact with the URL(s) and the basis for the request. We will forward upstream-licensing concerns to the relevant upstream project, since we do not modify or curate their archives.

Privacy

We do not log individual download requests, set cookies, or run analytics. See Privacy for details.

Other Projects