DIN library catalog

A signed, per-ecosystem database of package facts (registry metadata, OSV advisories, maintenance, typosquat lists), built daily by DIN CTRL and served here. An NSI shared service.

Check /v1/health: "key" says which key signed the catalog being served. "staging" means a pre-production key: DIN installs built with the production key will not accept it.

Endpoints

GET	`/v1/health`	`ok`, `as_of`, `manifest_sha256`, `key`, `key_id`, per-ecosystem counts
GET	`/v1/manifest.json` (+ `.minisig`)	the signed manifest (minisign, Ed25519)
GET	`/v1/<eco>/<file>`	content-addressed shards the manifest names (zstd JSON lines)
POST	`/v1/check`	up to 500 packages per request, answered from the loaded catalog only

Check packages

curl -s https://catalog.dinctrl.com/v1/check \
  -H 'Content-Type: application/json' \
  -d '{"packages":[{"ecosystem":"cargo","name":"serde_json","version":"1.0.100"},
                   {"ecosystem":"maven","name":"org.apache.logging.log4j:log4j-core","version":"2.14.1"}]}'

Per package: catalog (in_catalog, not_in_registry, not_in_catalog, ...), latest and lag, maintenance, licence, the advisories affecting that exact version (with fixed-in versions), and the guard verdict (typosquat_of, never_existed, ...). Every answer carries the catalog's as_of and manifest sha256.

Ecosystems: cargo, npm, pypi, go, rubygems, packagist, nuget, maven.

Rates and keys

Without a key, /v1/check answers at a low public rate (per address). NSI brands and tenants get an API key (Authorization: Bearer KEY) with higher rates. Over the rate: HTTP 429 with Retry-After.

Privacy

The service logs counts only (per key label): never a package name, request body, key or address in its own log. The ecosystem, name and version of each package you check are sent to this server; to send nothing, download the signed shards and check locally (din-libcatalog fetch).

Sources: OSV.dev, crates.io, PyPI, RubyGems, Packagist, NuGet, Maven Central, the Go module proxy, GitHub. /v1/health