Hort is a secure, self-hostable, multi-format artifact repository and supply-chain registry — one server that proxies, stores, scans, and governs packages across your package ecosystems, so you don't have to trust an upstream registry with your build pipeline's integrity.

If you're evaluating it alongside Artifactory, Nexus, or Harbor, here's what's structurally different, not just configurable:

• Enforced content-addressed storage. Every artifact's identity is the SHA-256 of its raw bytes, computed while streaming. Storage keys are never caller-supplied — there is no code path that lets a client dictate where its own upload lands.
• Mandatory upstream verification. Every pull-through fetch verifies a checksum against the upstream registry — the protocol-native digest for OCI, parsed upstream metadata for Cargo / npm / PyPI / Maven. A format that cannot verify its upstream cannot proxy through Hort at all; there is no opt-out.
• Quarantine + fail-closed scan gate. Pulled and pushed artifacts can be held until a vulnerability scan, upstream verification, and policy evaluation all clear. The release predicate fails closed — an indeterminate scan blocks release, it never defaults to "let it through."
• Event-sourced, tamper-evident audit trail. Every artifact state transition (ingest, quarantine, scan result, release, promotion) is an immutable domain event in a per-stream cryptographic chain — not a mutable row a privileged operator could quietly edit.
• Self-hostable, sovereign by design. Run the whole stack — server, worker, and its own cold-start dependencies — without a single image pulled from a third-party registry. See the self-contained install path.
• Open source. MIT or Apache-2.0, your choice.

The name captures the first four of these as a mnemonic:

HORT = Hashed · Origin · Repository · Trail