# Curated mirrors

protos.rip mirrors a small, curated set of widely-used upstream Protobuf modules so you can depend on them from one registry instead of stitching together GitHub paths or maintaining a second registry in your `buf.yaml` (your project’s buf manifest — names the module and lists its deps).

Mirrored scopes match the namespace those modules use on buf.build — `s/buf.build/protos.rip/` in your `buf.yaml` is a valid migration.

## The curated set

The initial set covers the dependency graphs of the modules most users reach for first.

Mirror path	Upstream
`protos.rip/googleapis/googleapis`	The most widely-depended-on Protobuf module: `api/annotations.proto`, `rpc/status.proto`, `longrunning/operations.proto`, etc.
`protos.rip/bufbuild/protovalidate`	Buf’s modern validation rules.
`protos.rip/envoyproxy/protoc-gen-validate`	The legacy validation rules; namespace matches buf.build’s so existing `buf.yaml` deps work after a one-line edit.
`protos.rip/grpc-ecosystem/grpc-gateway`	Annotations for HTTP/gRPC transcoding.
`protos.rip/protocolbuffers/wellknowntypes`	`google.protobuf.Timestamp`, `Any`, `Empty`, `Struct`, etc. Required as an explicit dep when consumed directly from a registry.

The canonical list and current commit each mirror points at lives at [/registry](/registry).

## Depend on a mirror

Mirrored modules behave like any other module on protos.rip — add them under `deps:` in your `buf.yaml`.

```yaml
version: v2
deps:
  - protos.rip/googleapis/googleapis
  - protos.rip/protocolbuffers/wellknowntypes
```

Run `buf dep update` to resolve and write `buf.lock` (the lockfile that pins resolved commit IDs alongside `buf.yaml`) — see [Depend on a module](/docs/guides/depend-on-a-module).

Pin to a specific label or commit by appending `:label` or `:commit_id` to the dep entry, same as any module — see [Labels and commits](/docs/guides/labels-and-commits).

## How mirrors stay current

Each mirror tracks its upstream. For most modules, a new tag on the upstream repo becomes a new commit on the mirror; for `googleapis`, which doesn’t tag releases, every new commit on the upstream’s main branch becomes a new commit on the mirror.

The label name on protos.rip matches the upstream’s tag (e.g. `v0.2.1`) or, for commit-tracked mirrors, the upstream commit SHA.

protos.rip doesn’t guarantee a sync interval; new upstream releases generally appear within hours but can take longer — see [/registry](/registry) for the latest commit each mirror is at.

## Claiming a curated scope

The curated mirror scopes (`googleapis`, `bufbuild`, `envoyproxy`, `grpc-ecosystem`, `protocolbuffers`) are reserved and can’t be claimed by other accounts — they are granted to a designated org that owns the mirrored content.

The curated set expands by editorial decision, not user request — adding a mirror is a commitment to keeping it current.

## See also

← Module URLs