What to check in a replacement build cache

A build cache sits inside your supply chain: what it stores ends up in your builds. Before you move to a replacement, ask these seven questions of any candidate. We answer each one for FosterStack Cache, including where the answer is not good yet.

1. Does it speak your build tool's protocol?

It should work with the tool's own remote cache setting, with nothing extra to install on developer machines. How to test: build twice with the local cache turned off and look for FROM-CACHE on the second run. FosterStack Cache: Gradle through its HttpBuildCache setting; Maven through Apache's Build Cache Extension.

2. Who can write to it?

Anything that can write to the cache can change what later builds use. Ask for authentication, and ask what permission levels exist. FosterStack Cache: Basic Auth with a read-write login and an optional read-only login, where any write from the read-only one is refused. Per-person identity is not built yet.

3. Can you verify what you download?

Look for signatures, a software bill of materials, build provenance and vulnerability statements, and check whether you need an account to see them. FosterStack Cache: signed images and checksums, an SBOM per binary archive, build provenance and a VEX file, all public. See how we build.

4. Is it kept patched?

Ask how often published files are rescanned and how fast fixes ship. FosterStack Cache: a release is blocked on scanner findings unless a VEX statement explains them, and published images are rescanned daily. Vulnerable dependencies fixed fast — our target is 48 hours from disclosure.

5. Does it call home?

A server in your build network should not need to reach out. FosterStack Cache: no telemetry, no update check, no licence check. It can run on a network with no route to the internet.

6. How do you run and watch it?

You want size limits, metrics and a way to see it is healthy. FosterStack Cache: size-capped eviction, Prometheus metrics, a health check and a read-only status page. There is no admin web console, on purpose.

7. What are the licence terms, and what if the project goes away?

FosterStack Cache: MIT licensed, one static binary, nothing you need from us to keep running it. Paid tiers are described for the future, are not built, and security patches are never withheld from the free tier.