Download websites that use cgit

Nobody builds a business on a repository browser. cgit is a small program written in C that renders git repositories as plain pages, and when a web crawl finds one it has found something other than a company's front door: a machine that stores source code and answers to the public.

As of October 2026 we record it on 75 hosts. The category we file it under is a shrug, because a repository viewer is not a content system, not a framework and not a shop, and the honest description is infrastructure. A domain serving one is usually a project's own server, a distribution's mirror, or an engineering group that decided its history should not live on somebody else's platform.

The version spread says how those machines are run. We hold 8 distinct versions, with 1.2.3 the build recorded most often, and for a footprint this size that mix means installations are compiled or packaged one at a time and upgraded when somebody remembers. No automatic update path exists for a program that ships as a binary behind a web server, so version strings age at the pace of the administrator rather than the pace of the project. Published under GPL v2 and dating to 2006, cgit has had a long time to accumulate that kind of spread.

Two kinds of researcher want the resulting list. One is mapping self-hosted development infrastructure, because a public repository browser is a reliable marker of an organisation that runs its own tooling instead of renting it, and that correlates with procurement behaviour, engineering headcount and a preference for open source across the rest of the stack. The other is doing security work, since an exposed repository viewer publishes commit history, author names and addresses, branch names and occasionally configuration that was never meant to be indexed by anyone.

The undercount here is structural rather than incidental. Many instances sit on internal networks, on subdomains nothing links to, or behind an authenticating proxy, and a crawler that follows public links will never reach them. Even a public instance is often served on a path no page advertises. What we can honestly offer is the set of publicly linked, publicly answering installations, with the host, the version string where one is exposed and the crawl date attached.

Asking a single domain whether it runs a repository browser answers a question nobody has. Asking which hosts on the internet run one, which of them sit on corporate rather than personal domains, and which are stuck on builds that stopped being current years ago, is a question with an answer that only a list can carry.