mirrors/pkg-proxy
Watch
1
0
Fork
You've already forked pkg-proxy
 1
mirror of https://github.com/git-pkgs/proxy.git synced 2026-11-09 23:59:16 -05:00
Code Issues Releases Packages Wiki Activity
pkg-proxy/go.mod

133 lines
6.1 KiB
Modula-2
Raw Permalink Normal View History

Hello world
2026-01-20 21:52:44 +00:00
module github.com/git-pkgs/proxy
Add GCS storage backend with lighter dependencies (#179) * Add GCS storage backend with Workload Identity support Register gocloud.dev/blob/gcsblob so gs:// URLs are accepted as a storage backend. Authentication uses Application Default Credentials, which makes GKE Workload Identity work out of the box; signed URLs (direct_serve) fall back to the IAM Credentials signBlob API when no private key is available. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * Replace gcsblob with lightweight GCS backend * Extract GCS client into standalone module --------- Co-authored-by: Anthony A. <github@anthony-arnaud.fr> Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-08-29 11:23:07 +01:00
go 1.26.7
Upgrade to Go 1.26.6 (#246) * Upgrade to Go 1.26.5 * Use go.mod to select Go 1.26.6
2026-08-16 18:22:26 +01:00
Build with Go 1.27.3 everywhere CI, the release binaries and swagger take their Go version from go.mod, which pinned 1.26.7 and so missed the stdlib fixes in 1.26.8 to 1.26.10. A toolchain line now sets 1.27.3 for them, and the Docker builder uses the same version. The go line stays at 1.26.7, so source builds with an older local Go still work. golangci-lint 2.13.1 can't read Go 1.27.2+ export data, so CI moves to 2.15.0. Its errcheck flags two test cleanups that dropped the server's exit error; they now check it.
2026-10-23 09:57:37 +02:00
toolchain go1.27.3
Hello world
2026-01-20 21:52:44 +00:00
require (
Add Julia Pkg server support (#117) - Implement /julia/* handler for the Pkg server protocol (registries, registry, package, artifact, meta) - Resolve package UUIDs to names by parsing Registry.toml from the General registry tarball, with a hash-guarded background refresh on registry updates - Wire into router, ecosystem list, install page, badge styles - Update README and architecture docs
2026-05-13 06:46:35 +01:00
github.com/BurntSushi/toml v1.6.0
feat: add exact-version package denylist
2026-09-20 14:42:30 +05:30
github.com/Masterminds/semver/v3 v3.5.0
Update Go dependencies (#534)
2026-10-20 12:29:22 +01:00
github.com/aws/aws-sdk-go-v2/config v1.33.9
github.com/aws/aws-sdk-go-v2/service/ecr v1.66.5
Bump github.com/git-pkgs/archives from 0.9.0 to 0.10.0 Bumps [github.com/git-pkgs/archives](https://github.com/git-pkgs/archives) from 0.9.0 to 0.10.0. - [Commits](https://github.com/git-pkgs/archives/compare/v0.9.0...v0.10.0) --- updated-dependencies: - dependency-name: github.com/git-pkgs/archives dependency-version: 0.10.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2026-10-29 15:14:22 +00:00
github.com/git-pkgs/archives v0.10.0
Bump intra-org dependencies for v0.8.0 (#314)
2026-09-04 13:13:09 +01:00
github.com/git-pkgs/artifacts v0.2.1
Use shared cooldown package-pattern policy Use cooldown.NewPolicy for package-pattern overrides and remove the duplicate local implementation.
2026-10-20 08:53:22 +01:00
github.com/git-pkgs/cooldown v0.3.0
Preserve Swift and Go compatibility when upgrading PURL (#642) * Handle Swift registry identities in cache and vulnerability APIs * Preserve Go cache and policy behavior when upgrading PURL
2026-10-31 09:49:35 +00:00
github.com/git-pkgs/enrichment v0.7.5
Add GCS storage backend with lighter dependencies (#179) * Add GCS storage backend with Workload Identity support Register gocloud.dev/blob/gcsblob so gs:// URLs are accepted as a storage backend. Authentication uses Application Default Credentials, which makes GKE Workload Identity work out of the box; signed URLs (direct_serve) fall back to the IAM Credentials signBlob API when no private key is available. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * Replace gcsblob with lightweight GCS backend * Extract GCS client into standalone module --------- Co-authored-by: Anthony A. <github@anthony-arnaud.fr> Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
2026-08-29 11:23:07 +01:00
github.com/git-pkgs/gcs v0.1.0
Bump git-pkgs/integrity to v0.2.0 v0.2.0 adds verification-only SHA-1 and MD5, algorithm-prefixed checksum parsing and exact-digest verification (git-pkgs/integrity#3).
2026-10-14 16:43:11 +02:00
github.com/git-pkgs/integrity v0.2.0
Bump github.com/git-pkgs/magic from 0.5.0 to 0.6.0 Bumps [github.com/git-pkgs/magic](https://github.com/git-pkgs/magic) from 0.5.0 to 0.6.0. - [Release notes](https://github.com/git-pkgs/magic/releases) - [Commits](https://github.com/git-pkgs/magic/compare/v0.5.0...v0.6.0) --- updated-dependencies: - dependency-name: github.com/git-pkgs/magic dependency-version: 0.6.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2026-10-29 15:13:56 +00:00
github.com/git-pkgs/magic v0.6.0
Preserve Swift and Go compatibility when upgrading PURL (#642) * Handle Swift registry identities in cache and vulnerability APIs * Preserve Go cache and policy behavior when upgrading PURL
2026-10-31 09:49:35 +00:00
github.com/git-pkgs/purl v0.2.1
github.com/git-pkgs/registries v0.13.0
Use shared sbom parser for mirror sources (#510) * Use shared sbom parser for mirror sources * Use sbom v0.1.7 release
2026-10-20 09:14:09 +01:00
github.com/git-pkgs/sbom v0.1.7
Update git-pkgs dependencies (#396)
2026-10-01 16:06:12 +01:00
github.com/git-pkgs/spdx v0.3.3
Update Go dependencies (#534)
2026-10-20 12:29:22 +01:00
github.com/go-chi/chi/v5 v5.5.0
Add sqlx with SQLite default and PostgreSQL option Replace raw database/sql with jmoiron/sqlx for cleaner query handling. Support both SQLite (default) and PostgreSQL as configurable backends. Configuration via: - CLI flags: -database-driver, -database-path, -database-url - Environment: PROXY_DATABASE_DRIVER, PROXY_DATABASE_PATH, PROXY_DATABASE_URL - Config file: database.driver, database.path, database.url Tests run against both databases when PROXY_DATABASE_URL is set.
2026-01-29 16:06:56 +00:00
github.com/jmoiron/sqlx v1.4.0
Bump github.com/klauspost/compress from 1.20.1 to 1.20.3 Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.20.1 to 1.20.3. - [Release notes](https://github.com/klauspost/compress/releases) - [Commits](https://github.com/klauspost/compress/compare/v1.20.1...v1.20.3) --- updated-dependencies: - dependency-name: github.com/klauspost/compress dependency-version: 1.20.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2026-10-29 15:14:17 +00:00
github.com/klauspost/compress v1.20.3
Bump github.com/lib/pq from 1.12.2 to 1.12.3 Bumps [github.com/lib/pq](https://github.com/lib/pq) from 1.12.2 to 1.12.3. - [Release notes](https://github.com/lib/pq/releases) - [Changelog](https://github.com/lib/pq/blob/master/CHANGELOG.md) - [Commits](https://github.com/lib/pq/compare/v1.12.2...v1.12.3) --- updated-dependencies: - dependency-name: github.com/lib/pq dependency-version: 1.12.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2026-04-16 15:16:53 +00:00
github.com/lib/pq v1.12.3
Use shared artifacts at cache boundaries (#267) * Use shared artifacts at cache boundaries * Address artifact cache review * Defer cached artifact validation to checkCache Construct artifacts.Artifact from the row without validation so a malformed content hash reaches newIntegrityChecks in checkCache, which clears the row and treats the request as a miss. Erroring at the DB boundary instead surfaced a 500 and left the bad row in place. * Build stored Artifact after digest and scan checks Construct the shared artifact struct from trusted storage output as a literal, after the hash-mismatch and scanner paths that delete failed downloads, so no path between Store and updateCacheDB can leave bytes in storage without a database row.
2026-09-04 10:58:22 +01:00
github.com/opencontainers/go-digest v1.0.0
Bump github.com/prometheus/client_golang from 1.24.1 to 1.25.0 Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.24.1 to 1.25.0. - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md) - [Commits](https://github.com/prometheus/client_golang/compare/v1.24.1...v1.25.0) --- updated-dependencies: - dependency-name: github.com/prometheus/client_golang dependency-version: 1.25.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2026-10-15 15:16:44 +00:00
github.com/prometheus/client_golang v1.25.0
Bump github.com/prometheus/client_model from 0.6.2 to 0.6.3 (#330) Bumps [github.com/prometheus/client_model](https://github.com/prometheus/client_model) from 0.6.2 to 0.6.3. - [Release notes](https://github.com/prometheus/client_model/releases) - [Commits](https://github.com/prometheus/client_model/compare/v0.6.2...v0.6.3) --- updated-dependencies: - dependency-name: github.com/prometheus/client_model dependency-version: 0.6.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-13 22:38:31 -04:00
github.com/prometheus/client_model v0.6.3
Bump modernc.org/sqlite from 1.46.1 to 1.47.0 (#47) Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.46.1 to 1.47.0. - [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.46.1...v1.47.0) --- updated-dependencies: - dependency-name: modernc.org/sqlite dependency-version: 1.47.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-26 15:58:50 +00:00
github.com/swaggo/swag v1.16.6
Serve conda sharded repodata through cooldown and the cache The shard index (repodata_shards.msgpack.zst) and the shards of CEP 16 fell through to the uncached passthrough, so clients that use them, such as pixi, got no cooldown filtering and no offline copy. Without cooldown, the index and shards are now served through the metadata cache. With cooldown, shards have to be filtered, but clients cache them by the hash in the index and never fetch a hash twice. The proxy rewrites the index instead: each hash is XORed with a mask derived from channel, subdir and the current hour, and shards_base_url points at cooldown-shards/{hour}/. That route undoes the mask, fetches the upstream shard and drops records still in cooldown. The unmasked shard paths answer 404 while cooldown is on. When the index puts packages or shards somewhere the proxy doesn't route, or has an unknown version, the proxy answers 404 and clients fall back to repodata.json, which is filtered as before. Fixes #529
2026-10-23 12:07:01 +02:00
github.com/vmihailenco/msgpack/v5 v5.4.1
Update Go dependencies (#534)
2026-10-20 12:29:22 +01:00
gocloud.dev v0.47.0
golang.org/x/mod v0.42.0
Update golang.org/x/net to v0.62.0 (#647) Fixes CVE-2026-78661 and CVE-2026-97045 in x/net/html, which parses upstream PyPI simple pages for the denylist.
2026-10-31 21:14:53 +01:00
golang.org/x/net v0.62.0
Bump golang.org/x/sync from 0.23.0 to 0.24.0 Bumps [golang.org/x/sync](https://github.com/golang/sync) from 0.23.0 to 0.24.0. - [Commits](https://github.com/golang/sync/compare/v0.23.0...v0.24.0) --- updated-dependencies: - dependency-name: golang.org/x/sync dependency-version: 0.24.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2026-10-15 15:15:16 +00:00
golang.org/x/sync v0.24.0
Bump google.golang.org/protobuf from 1.36.11 to 1.36.12 (#252)
2026-08-14 11:44:00 +01:00
google.golang.org/protobuf v1.36.12
Hello world
2026-01-20 21:52:44 +00:00
gopkg.in/yaml.v3 v3.0.1
Bump modernc.org/sqlite from 1.60.1 to 1.61.0 Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.60.1 to 1.61.0. - [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.60.1...v1.61.0) --- updated-dependencies: - dependency-name: modernc.org/sqlite dependency-version: 1.61.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2026-10-29 15:14:31 +00:00
modernc.org/sqlite v1.61.0
Hello world
2026-01-20 21:52:44 +00:00
)
require (
Update Go dependencies (#534)
2026-10-20 12:29:22 +01:00
cloud.google.com/go/auth v0.23.2 // indirect
Add direct-serve via presigned storage URLs When storage.direct_serve is enabled and the backend supports it (S3, Azure), cached artifact downloads return a 302 redirect to a presigned URL instead of streaming bytes through the proxy. Falls back to streaming when the backend can't sign (fileblob, local filesystem) or signing fails. Adds the azureblob driver so azblob:// storage URLs work. Cache-hit accounting already happened before io.Copy so redirects are counted correctly; the metrics calls are pulled into a helper so both paths share them. Closes #96
2026-04-27 12:04:38 +01:00
cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
Update all dependencies
2026-03-04 09:09:13 +00:00
cloud.google.com/go/compute/metadata v0.9.0 // indirect
Update Go dependencies (#534)
2026-10-20 12:29:22 +01:00
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.1 // indirect
github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.14.1 // indirect
github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 // indirect
github.com/Azure/azure-sdk-for-go/sdk/storage/azblob v1.8.0 // indirect
github.com/AzureAD/microsoft-authentication-library-for-go v1.9.0 // indirect
Add generated OpenAPI docs support
2026-03-11 17:18:29 +00:00
github.com/KyleBanks/depth v1.2.1 // indirect
github.com/PuerkitoBio/purell v1.1.1 // indirect
github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
Add Container, Debian, RPM handlers and enrichment API Adds proxy support for Docker/OCI container registries, Debian/APT repositories, and RPM/Yum repositories. Includes a new enrichment API for package metadata, vulnerability scanning, and outdated detection. Updates the dashboard with Tailwind CSS, dark mode support, and a security overview section showing vulnerability counts.
2026-01-29 19:35:15 +00:00
github.com/apapsch/go-jsonmerge/v2 v2.0.0 // indirect
Update Go dependencies (#534)
2026-10-20 12:29:22 +01:00
github.com/aws/aws-sdk-go-v2 v1.47.3 // indirect
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.20 // indirect
github.com/aws/aws-sdk-go-v2/credentials v1.20.9 // indirect
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.20.3 // indirect
github.com/aws/aws-sdk-go-v2/feature/s3/transfermanager v0.4.3 // indirect
github.com/aws/aws-sdk-go-v2/internal/configsources v1.5.6 // indirect
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.8.6 // indirect
github.com/aws/aws-sdk-go-v2/internal/v4a v1.5.6 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.21 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.11.2 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.14.6 // indirect
github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.20.2 // indirect
github.com/aws/aws-sdk-go-v2/service/s3 v1.111.0 // indirect
github.com/aws/aws-sdk-go-v2/service/signin v1.10.4 // indirect
github.com/aws/aws-sdk-go-v2/service/sso v1.38.4 // indirect
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.43.4 // indirect
github.com/aws/aws-sdk-go-v2/service/sts v1.51.4 // indirect
github.com/aws/smithy-go v1.28.5 // indirect
Refactoring and features
2026-02-03 22:40:23 +00:00
github.com/beorn7/perks v1.0.1 // indirect
Replace internal/upstream with registries/fetch Use the new client/ and fetch/ sub-packages from git-pkgs/registries instead of the local upstream package. The fetcher, circuit breaker, and resolver now live in registries where they can be shared across projects. Depends on git-pkgs/registries#8.
2026-02-20 08:47:14 +00:00
github.com/cenk/backoff v2.2.1+incompatible // indirect
Refactoring and features
2026-02-03 22:40:23 +00:00
github.com/cespare/xxhash/v2 v2.3.0 // indirect
Bump modernc.org/sqlite from 1.60.1 to 1.61.0 Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.60.1 to 1.61.0. - [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.60.1...v1.61.0) --- updated-dependencies: - dependency-name: modernc.org/sqlite dependency-version: 1.61.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2026-10-29 15:14:31 +00:00
github.com/dustin/go-humanize v1.1.0 // indirect
Update enrichment to v0.7.2 (#394) * Update ecosystems-go to v0.5.0 * Update enrichment to v0.7.2
2026-10-01 15:25:11 +01:00
github.com/ecosyste-ms/ecosystems-go v0.5.0 // indirect
Refactoring and features
2026-02-03 22:40:23 +00:00
github.com/facebookgo/clock v0.0.0-20150410010913-600d898af40a // indirect
Update git-pkgs dependencies (#396)
2026-10-01 16:06:12 +01:00
github.com/git-pkgs/pom v0.1.8 // indirect
Answer 404 for packages the registry doesn't have
2026-10-24 17:08:22 +02:00
github.com/git-pkgs/vers v0.7.2 // indirect
github.com/git-pkgs/vulns v0.2.4 // indirect
Bump git-pkgs deps for v0.4.0 (#146)
2026-05-22 19:51:49 +01:00
github.com/github/go-spdx/v2 v2.7.0 // indirect
build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 Bumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) from 1.44.0 to 1.45.0. - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.44.0...v1.45.0) --- updated-dependencies: - dependency-name: go.opentelemetry.io/otel/sdk dependency-version: 1.45.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
2026-09-22 07:38:12 +00:00
github.com/go-logr/logr v1.4.4 // indirect
Add gocloud.dev/blob for S3 and filesystem storage Replace custom filesystem storage with gocloud.dev/blob for unified storage backend support. Supported backends: - file:///path/to/dir - Local filesystem (default) - s3://bucket-name - Amazon S3 - s3://bucket?endpoint=http://localhost:9000 - S3-compatible (MinIO) Configuration via: - CLI flag: -storage-url - Environment: PROXY_STORAGE_URL - Config file: storage.url The old storage.path config is deprecated but still supported.
2026-01-29 16:13:16 +00:00
github.com/go-logr/stdr v1.2.2 // indirect
Add generated OpenAPI docs support
2026-03-11 17:18:29 +00:00
github.com/go-openapi/jsonpointer v0.19.5 // indirect
github.com/go-openapi/jsonreference v0.19.6 // indirect
github.com/go-openapi/spec v0.20.4 // indirect
github.com/go-openapi/swag v0.19.15 // indirect
Bump gocloud.dev from 0.45.0 to 0.46.0 (#164) Bumps [gocloud.dev](https://github.com/google/go-cloud) from 0.45.0 to 0.46.0. - [Release notes](https://github.com/google/go-cloud/releases) - [Commits](https://github.com/google/go-cloud/compare/v0.45.0...v0.46.0) --- updated-dependencies: - dependency-name: gocloud.dev dependency-version: 0.46.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-11 16:26:21 +01:00
github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
Add direct-serve via presigned storage URLs When storage.direct_serve is enabled and the backend supports it (S3, Azure), cached artifact downloads return a 302 redirect to a presigned URL instead of streaming bytes through the proxy. Falls back to streaming when the backend can't sign (fileblob, local filesystem) or signing fails. Adds the azureblob driver so azblob:// storage URLs work. Cache-hit accounting already happened before io.Copy so redirects are counted correctly; the metrics calls are pulled into a helper so both paths share them. Closes #96
2026-04-27 12:04:38 +01:00
github.com/google/s2a-go v0.1.9 // indirect
Hello world
2026-01-20 21:52:44 +00:00
github.com/google/uuid v1.6.0 // indirect
Add gocloud.dev/blob for S3 and filesystem storage Replace custom filesystem storage with gocloud.dev/blob for unified storage backend support. Supported backends: - file:///path/to/dir - Local filesystem (default) - s3://bucket-name - Amazon S3 - s3://bucket?endpoint=http://localhost:9000 - S3-compatible (MinIO) Configuration via: - CLI flag: -storage-url - Environment: PROXY_STORAGE_URL - Config file: storage.url The old storage.path config is deprecated but still supported.
2026-01-29 16:13:16 +00:00
github.com/google/wire v0.7.0 // indirect
Update Go dependencies (#534)
2026-10-20 12:29:22 +01:00
github.com/googleapis/enterprise-certificate-proxy v0.3.21 // indirect
github.com/googleapis/gax-go/v2 v2.24.1 // indirect
Add generated OpenAPI docs support
2026-03-11 17:18:29 +00:00
github.com/josharian/intern v1.0.0 // indirect
Add direct-serve via presigned storage URLs When storage.direct_serve is enabled and the backend supports it (S3, Azure), cached artifact downloads return a 302 redirect to a presigned URL instead of streaming bytes through the proxy. Falls back to streaming when the backend can't sign (fileblob, local filesystem) or signing fails. Adds the azureblob driver so azblob:// storage URLs work. Cache-hit accounting already happened before io.Copy so redirects are counted correctly; the metrics calls are pulled into a helper so both paths share them. Closes #96
2026-04-27 12:04:38 +01:00
github.com/kylelemons/godebug v1.1.0 // indirect
Add generated OpenAPI docs support
2026-03-11 17:18:29 +00:00
github.com/mailru/easyjson v0.7.7 // indirect
Bump dependencies ahead of v0.7.0 (#235) - github.com/git-pkgs/archives v0.4.0 -> v0.5.0 - github.com/git-pkgs/magic v0.1.0 -> v0.2.0 - github.com/git-pkgs/spdx v0.1.4 -> v0.3.0 - github.com/prometheus/client_golang v1.24.0 -> v1.24.1 - modernc.org/sqlite v1.55.0 -> v1.56.0 - golang.org/x/text v0.38.0 -> v0.40.0 (fixes GO-2026-5970)
2026-08-06 22:14:51 +01:00
github.com/mattn/go-isatty v0.0.24 // indirect
Refactoring and features
2026-02-03 22:40:23 +00:00
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
Bump modernc.org/sqlite from 1.60.1 to 1.61.0 Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.60.1 to 1.61.0. - [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.60.1...v1.61.0) --- updated-dependencies: - dependency-name: modernc.org/sqlite dependency-version: 1.61.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2026-10-29 15:14:31 +00:00
github.com/ncruces/go-strftime v1.1.0 // indirect
Bump git-pkgs dependencies (#253)
2026-08-14 12:17:14 +01:00
github.com/oapi-codegen/nullable v1.2.0 // indirect
Update enrichment to v0.7.2 (#394) * Update ecosystems-go to v0.5.0 * Update enrichment to v0.7.2
2026-10-01 15:25:11 +01:00
github.com/oapi-codegen/runtime v1.7.0 // indirect
Bump github.com/git-pkgs/purl to v0.1.19 (#291)
2026-08-27 18:33:02 +01:00
github.com/package-url/packageurl-go v0.1.7 // indirect
Bump intra-org dependencies for v0.8.0 (#314)
2026-09-04 13:13:09 +01:00
github.com/pandatix/go-cvss v0.6.4 // indirect
Add direct-serve via presigned storage URLs When storage.direct_serve is enabled and the backend supports it (S3, Azure), cached artifact downloads return a 302 redirect to a presigned URL instead of streaming bytes through the proxy. Falls back to streaming when the backend can't sign (fileblob, local filesystem) or signing fails. Adds the azureblob driver so azblob:// storage URLs work. Cache-hit accounting already happened before io.Copy so redirects are counted correctly; the metrics calls are pulled into a helper so both paths share them. Closes #96
2026-04-27 12:04:38 +01:00
github.com/pkg/browser v0.0.0-20240102092130-5ac0b6a4141c // indirect
Bump github.com/prometheus/client_golang from 1.24.1 to 1.25.0 Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.24.1 to 1.25.0. - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md) - [Commits](https://github.com/prometheus/client_golang/compare/v1.24.1...v1.25.0) --- updated-dependencies: - dependency-name: github.com/prometheus/client_golang dependency-version: 1.25.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2026-10-15 15:16:44 +00:00
github.com/prometheus/common v0.72.0 // indirect
github.com/prometheus/procfs v0.22.0 // indirect
Hello world
2026-01-20 21:52:44 +00:00
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
Lint and dead-code cleanup (#279) * Bump go tool golangci-lint to v2.13.1 The .golangci.yml goconst.ignore-tests setting was added in v2.12.0 (golangci/golangci-lint#6480). On the previously pinned v2.10.1, config verify fails with "additional properties 'ignore-tests' not allowed" and the setting is silently ignored at run time, so goconst counts test-file literals toward min-occurrences. * Apply gofmt and CutSuffix simplification - gofmt -w internal/server/health_test.go - Replace HasSuffix+TrimSuffix with CutSuffix in ParseSize * Remove dead code and migrate tests off legacy Filesystem storage Migrate the three test call sites of storage.NewFilesystem to storage.OpenBucket("file://...") and drop the deprecated StorageConfig.Path field from test configs, then delete code that deadcode reports as unreachable from cmd/proxy: - internal/storage/filesystem.go and its tests - storage.HashingReader - enrichment.Service.BulkCheckVulnerabilities and NormalizeLicense - server.ActiveRequestsMiddleware (no-op body; the real tracking is the inline r.Use at server.go:226) - mirror.RegistrySource (unimplemented stub) metrics.UpdateCircuitBreakerState and RecordCircuitBreakerTrip are kept because #275 wires them. Update the CONTRIBUTING.md storage section to reflect blob.go.
2026-08-21 09:26:27 +01:00
github.com/rogpeppe/go-internal v1.16.0 // indirect
Replace internal/upstream with registries/fetch Use the new client/ and fetch/ sub-packages from git-pkgs/registries instead of the local upstream package. The fetcher, circuit breaker, and resolver now live in registries where they can be shared across projects. Depends on git-pkgs/registries#8.
2026-02-20 08:47:14 +00:00
github.com/rs/dnscache v0.0.0-20230804202142-fc85eb664529 // indirect
github.com/rubyist/circuitbreaker v2.2.1+incompatible // indirect
Use shared archives browser for cached artifacts (#512) * Use shared archives browser for cached artifacts * Pin archives to combined browser and Hex changes * Use archives v0.9.0 release * Return 404 when browsing archive directories as files
2026-10-20 11:41:18 +01:00
github.com/ulikunitz/xz v0.5.17 // indirect
Serve conda sharded repodata through cooldown and the cache The shard index (repodata_shards.msgpack.zst) and the shards of CEP 16 fell through to the uncached passthrough, so clients that use them, such as pixi, got no cooldown filtering and no offline copy. Without cooldown, the index and shards are now served through the metadata cache. With cooldown, shards have to be filtered, but clients cache them by the hash in the index and never fetch a hash twice. The proxy rewrites the index instead: each hash is XORed with a mask derived from channel, subdir and the current hour, and shards_base_url points at cooldown-shards/{hour}/. That route undoes the mask, fetches the upstream shard and drops records still in cooldown. The unmasked shard paths answer 404 while cooldown is on. When the index puts packages or shards somewhere the proxy doesn't route, or has an unknown version, the proxy answers 404 and clients fall back to repodata.json, which is filtered as before. Fixes #529
2026-10-23 12:07:01 +02:00
github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
Update dependencies
2026-02-03 22:53:40 +00:00
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
Update Go dependencies (#534)
2026-10-20 12:29:22 +01:00
go.opentelemetry.io/otel v1.46.0 // indirect
go.opentelemetry.io/otel/metric v1.46.0 // indirect
go.opentelemetry.io/otel/sdk v1.46.0 // indirect
go.opentelemetry.io/otel/sdk/metric v1.46.0 // indirect
go.opentelemetry.io/otel/trace v1.46.0 // indirect
Lint and dead-code cleanup (#279) * Bump go tool golangci-lint to v2.13.1 The .golangci.yml goconst.ignore-tests setting was added in v2.12.0 (golangci/golangci-lint#6480). On the previously pinned v2.10.1, config verify fails with "additional properties 'ignore-tests' not allowed" and the setting is silently ignored at run time, so goconst counts test-file literals toward min-occurrences. * Apply gofmt and CutSuffix simplification - gofmt -w internal/server/health_test.go - Replace HasSuffix+TrimSuffix with CutSuffix in ParseSize * Remove dead code and migrate tests off legacy Filesystem storage Migrate the three test call sites of storage.NewFilesystem to storage.OpenBucket("file://...") and drop the deprecated StorageConfig.Path field from test configs, then delete code that deadcode reports as unreachable from cmd/proxy: - internal/storage/filesystem.go and its tests - storage.HashingReader - enrichment.Service.BulkCheckVulnerabilities and NormalizeLicense - server.ActiveRequestsMiddleware (no-op body; the real tracking is the inline r.Use at server.go:226) - mirror.RegistrySource (unimplemented stub) metrics.UpdateCircuitBreakerState and RecordCircuitBreakerTrip are kept because #275 wires them. Update the CONTRIBUTING.md storage section to reflect blob.go.
2026-08-21 09:26:27 +01:00
go.yaml.in/yaml/v3 v3.0.5 // indirect
Update Go dependencies (#534)
2026-10-20 12:29:22 +01:00
golang.org/x/crypto v0.58.0 // indirect
Bump github.com/prometheus/client_golang from 1.24.1 to 1.25.0 Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.24.1 to 1.25.0. - [Release notes](https://github.com/prometheus/client_golang/releases) - [Changelog](https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md) - [Commits](https://github.com/prometheus/client_golang/compare/v1.24.1...v1.25.0) --- updated-dependencies: - dependency-name: github.com/prometheus/client_golang dependency-version: 1.25.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2026-10-15 15:16:44 +00:00
golang.org/x/oauth2 v0.37.0 // indirect
Update Go dependencies (#534)
2026-10-20 12:29:22 +01:00
golang.org/x/sys v0.49.0 // indirect
golang.org/x/text v0.43.0 // indirect
Bump modernc.org/sqlite from 1.60.1 to 1.61.0 Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.60.1 to 1.61.0. - [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.60.1...v1.61.0) --- updated-dependencies: - dependency-name: modernc.org/sqlite dependency-version: 1.61.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2026-10-29 15:14:31 +00:00
golang.org/x/tools v0.52.0 // indirect
Add gocloud.dev/blob for S3 and filesystem storage Replace custom filesystem storage with gocloud.dev/blob for unified storage backend support. Supported backends: - file:///path/to/dir - Local filesystem (default) - s3://bucket-name - Amazon S3 - s3://bucket?endpoint=http://localhost:9000 - S3-compatible (MinIO) Configuration via: - CLI flag: -storage-url - Environment: PROXY_STORAGE_URL - Config file: storage.url The old storage.path config is deprecated but still supported.
2026-01-29 16:13:16 +00:00
golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
Update Go dependencies (#534)
2026-10-20 12:29:22 +01:00
google.golang.org/api v0.297.0 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260904194346-d0f1323225a4 // indirect
Bump google.golang.org/grpc from 1.83.1 to 1.83.2 (#346) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.83.1 to 1.83.2. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.83.1...v1.83.2) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.83.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-15 20:05:41 +01:00
google.golang.org/grpc v1.83.2 // indirect
Use go tool directive for golangci-lint instead of GitHub Action
2026-02-20 07:59:32 +00:00
gopkg.in/yaml.v2 v2.4.0 // indirect
Bump modernc.org/sqlite from 1.60.1 to 1.61.0 Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.60.1 to 1.61.0. - [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.60.1...v1.61.0) --- updated-dependencies: - dependency-name: modernc.org/sqlite dependency-version: 1.61.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2026-10-29 15:14:31 +00:00
modernc.org/libc v1.79.0 // indirect
Update dependencies
2026-01-21 20:04:41 +00:00
modernc.org/mathutil v1.7.1 // indirect
Bump modernc.org/sqlite from 1.57.0 to 1.58.0 (#337) Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.57.0 to 1.58.0. - [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md) - [Commits](https://gitlab.com/cznic/sqlite/compare/v1.57.0...v1.58.0) --- updated-dependencies: - dependency-name: modernc.org/sqlite dependency-version: 1.58.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-13 22:36:45 -04:00
modernc.org/memory v1.12.1 // indirect
Hello world
2026-01-20 21:52:44 +00:00
)
Reference in a new issue Copy permalink