CIPD (Chrome Infrastructure Package Deployment)

CIPD is package deployment infrastructure. It consists of a package registry and a CLI client to create, upload, download, and install packages.

A CIPD package has a package name (e.g. "infra/tools/foo") and a list of content-addressed instances (e.g. "bec8e88201949be06b06174178c2f62b81e4008e"), where slashes in package names form a hierarchy of packages, and an instance is a ZIP file with the package file contents.

CIPD is different from apt-get, brew, nuget, pip, npm, etc. in that it is not tied to a specific OS or language.


A package instance can be referenced by a tuple (package name, version), for example when installing a package. A version is one of:

  • A hash of the instance file contents, e.g. "bec8e88201949be06b06174178c2f62b81e4008e"; this is also called the instance ID.
  • A a key-value tag, e.g. "git_revision:deadbeef", if it is unique among all instances of the package. Read more about tags below.
  • A ref, e.g. "latest", see below.

A package instance can be marked with tags, where a tag is a colon-separated key-value pair, e.g. "git_revision:deadbeef". If some tag points to only one instance, such tag can be used as version identifier.


A package can have git-like refs, where a ref of a package points to one of the instances of the package by id. For example, chrome-infra continuous builders always update the "latest" ref of a package to the instance that they upload.


If a package is platform-specific, the package name should have a /<os>-<arch> suffix, for example "infra/tools/cipd/linux-amd64". The os part can be linux, mac, or windows, and arch can be 386, amd64 or armv6l. See the ensure package docs for accepted os and arch values.

Some CIPD client subcommands accept a package name "directory" that ends with slash, e.g. "infra/tools/cipd/", and apply a change to all packages in that directory non-recursively.

Access control

A package directory can have an ACL that applies to packages in that directory and inherited by subdirectories. ACLs can be read/controlled by the CIPD client.


The API definition with a lot of additional details is available here.

Expand ▾ Collapse ▴


Path Synopsis
api/admin/v1 Package api contains CIPD backend API definitions.
api/cipd/v1 Package api contains CIPD backend API definitions.
api/config/v1 Package api contains CIPD backend API definitions.
appengine/backend Binary backend implements HTTP server that handles task queues and crons.
appengine/frontend Binary frontend implements HTTP server that handles requests to 'default' module.
appengine/impl Package impl instantiates the full implementation of the CIPD backend services.
appengine/impl/admin Package admin contains implementation of cipd.Admin RPC service.
appengine/impl/cas Package cas contains implementation of cipd.Storage service RPC service.
appengine/impl/cas/tasks Package tasks contains task queue tasks definitions.
appengine/impl/gs Package gs implement Google Storage API wrapper used by CIPD backend.
appengine/impl/metadata Package metadata implements handling of prefix metadata.
appengine/impl/model Package model contains core CIPD datastore entities.
appengine/impl/monitoring Package monitoring implements monitoring used by CIPD backend.
appengine/impl/repo Package repo contains implementation of cipd.Repository service RPC service.
appengine/impl/repo/processing Package processing contains code related to post-registration instance processing.
appengine/impl/repo/tasks Package tasks contains task queue tasks definitions.
appengine/impl/settings Package settings contains definition of global CIPD backend settings.
appengine/impl/testutil Package testutil contains helpers used from CIPD backend unit tests.
appengine/ui Package ui implements request handlers that serve user facing HTML pages.
client/cipd Package cipd implements client side of Chrome Infra Package Deployer.
client/cipd/builder Package builder holds functionality for building CIPD packages.
client/cipd/deployer Package deployer holds functionality for deploying CIPD packages.
client/cipd/digests Package digests holds types used by selfupdate mechanism to pin client hashes.
client/cipd/ensure Package ensure contains methods and types for interacting with the 'ensure file format'.
client/cipd/fs Package fs is file-system related utilities used internally by CIPD.
client/cipd/internal/retry Package retry contains helpers for doing tight retry loops.
client/cipd/pkg Package pkg contains interfaces and struct related to CIPD package files.
client/cipd/platform Package platform contains definition of what ${os} and ${arch} mean for the current platform.
client/cipd/reader Package reader implements reading contents of a CIPD package.
client/cipd/template Package template implements handling of package name templates.
client/cli Package cli implements command line interface for CIPD client.
client/cmd/cipd Package main contains CIPD CLI implementation that uses Chrome Infrastructure defaults.
version Package version provides a way for CIPD packaged Go binaries to discover their current package instance ID.