Package Cache

Nubo stores downloaded packages in a global cache.

~/nubo/packages/

This path is created automatically.

Base Directories

Nubo uses the user’s home directory.

~/nubo/

Packages are stored under:

~/nubo/packages/

Each package is stored by domain, user, repository, and full commit hash.

~/nubo/packages/<domain>/<user>/<repo>@<commit_hash>

Example:

~/nubo/packages/github.com/nubolang/color@f5063d6fa53bf8be818f4316273ee81fb5474d21

The full commit hash makes package installs reproducible.

The same package at a different commit gets a different cache folder.

That means multiple versions can exist at the same time.

When adding a package, Nubo clones into a temporary path first.

~/nubo/packages/__tmp__/

After resolving and checking out the requested commit, Nubo moves it into the final cache path.

If the exact cache path already exists, Nubo does not clone it again.

It reuses the cached package and updates the project metadata.

Nubo computes a SHA-256 hash over the package directory contents.

It skips .git directories.

The hash is stored in lock.yaml.

hash: sha256:<hash>

During nubo download, Nubo hashes the cached/downloaded package and compares it to the lockfile hash.

If they do not match, Nubo fails validation.

This means the lockfile protects both the exact Git commit and the content hash.

You can manually remove package cache folders if needed.

rm -rf ~/nubo/packages/github.com/nubolang/color@f5063d6fa53bf8be818f4316273ee81fb5474d21

Then restore from the lockfile:

nubo download