Verify cache reuse and download savings

First confirm that a dependency passed through Depsilo and that its second download used the cache. Then measure the difference on your network. This guide provides a reproducible method without assuming a speedup.

You need a v0.11.0 instance with first-run setup complete, plus curl, Python 3, and a POSIX shell on Linux or macOS. The default npm upstream must be available. If you enabled package rules, the test package must satisfy them.

Get the artifact URL from your instance

These steps pin [email protected]. They download files without executing package code or changing package-manager settings. Run the blocks in the same terminal, and confirm each step succeeds before continuing.

DEPSILO_URL='http://127.0.0.1:23333'
depsilo_check_dir=$(mktemp -d "${TMPDIR:-/tmp}/depsilo-cache-check.XXXXXX")

curl -fsS --max-time 30 "$DEPSILO_URL/npm/is-number" \
  -o "$depsilo_check_dir/metadata.json"

depsilo_tarball=$(python3 -c \
  'import json, sys; print(json.load(open(sys.argv[1]))["versions"]["7.0.0"]["dist"]["tarball"])' \
  "$depsilo_check_dir/metadata.json")

Replace DEPSILO_URL with an instance address your client can reach, without a trailing /. On another machine, 127.0.0.1 does not refer to your server. For an HTTPS reverse proxy, configure the forwarded protocol as described in the deployment guide.

The dist.tarball URL is generated by Depsilo from upstream metadata and bound to its source. Keep this URL intact: v0.11.0 does not accept hand-built /npm/package/-/filename.tgz download paths. The metadata request above and the artifact requests below produce different log entries.

Download twice, then compare a direct download

curl -fsSL --max-time 120 "$depsilo_tarball" \
  -o "$depsilo_check_dir/first.tgz" \
  -w 'depsilo_first status=%{http_code} seconds=%{time_total} bytes=%{size_download}\n'

curl -fsSL --max-time 120 "$depsilo_tarball" \
  -o "$depsilo_check_dir/repeat.tgz" \
  -w 'depsilo_repeat status=%{http_code} seconds=%{time_total} bytes=%{size_download}\n'

curl -fsSL --max-time 120 \
  'https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz' \
  -o "$depsilo_check_dir/direct.tgz" \
  -w 'npm_direct status=%{http_code} seconds=%{time_total} bytes=%{size_download}\n'

cmp "$depsilo_check_dir/first.tgz" "$depsilo_check_dir/repeat.tgz" && \
  cmp "$depsilo_check_dir/first.tgz" "$depsilo_check_dir/direct.tgz" && \
  printf 'OK: all three downloads contain the same bytes.\n'

Ordinary curl does not maintain an npm-style package cache, so each command makes a download request. Files are saved in a separate temporary directory. Successful cmp commands print nothing; the final line confirms that all three downloads contain identical bytes. If a request fails or the files differ, investigate before counting it as a successful performance sample.

Confirm cache hits in Access logs

Open Admin → Access logs (/admin/logs) and find the two npm artifact requests. Check the package, version, timestamps, status, and cache result. Use the artifact records, not the earlier metadata request.

Observation	What it confirms
The first artifact request succeeds and its log shows a miss	This run included a cold-cache download.
The second request for that artifact succeeds and shows a hit	Depsilo reused the cached content.
Both requests show hits	The artifact was already cached; this run did not produce a cold-cache sample.
The requests do not appear in the log	Check the instance address, returned artifact URL, and reverse proxy. A successful download alone does not prove it passed through Depsilo.
A request returns 451 or another failure	Inspect the policy or upstream problem. Exclude failed responses from successful-download timing comparisons.

For a cold-cache sample, use a separate test instance with a fresh state volume, or choose a pinned version you have confirmed is not already cached. Keep the cache of your everyday instance intact.

Interpret the measurements

• seconds is the HTTP request time observed by the client, including connection, transfer, and waiting. It is not the time for a complete project build.
• bytes counts bytes delivered to the client. A cache hit still delivers the same file, so these values will usually match. Public-network savings occur between Depsilo and its upstream; inspect server-side upstream traffic as well.
• The direct comparison uses the official npm registry. If Depsilo uses another mirror, you are also comparing different network paths. Record the actual upstream instead of attributing the entire difference to caching.
• is-number is small and useful for checking connectivity and cache hits. For a representative result, repeat the experiment with your dependency set while keeping the project version, lockfile, client-cache state, and network conditions consistent.
• Repeat warm-cache and direct measurements several times, recording the median and range. If other users share the instance during the experiment, traffic totals may include their downloads.

Use this table to record actual results. Include the commands and test conditions when sharing them:

Item	What to record
Environment	Depsilo version, client and server locations, storage, network, and upstream URL
Cold cache	First-request time, file size, and logged miss; state explicitly if you did not obtain this sample
Warm cache	Each request time, file size, and corresponding cache-hit record
Direct download	Each request time and the explicitly named registry or mirror
Conclusion	Differences observed under these conditions, and projects or networks you have not tested

Preview data and measurements are separate

Homepage product previews use example data to explain the interface. They are not measured results from this experiment. Your dependencies, network, and cache state determine the actual benefit.

After confirming cache behavior, connect your project’s package manager. If the results are unexpected, see Troubleshooting.