mirrors/pkg-proxy
Watch
1
0
Fork
You've already forked pkg-proxy
 1
mirror of https://github.com/git-pkgs/proxy.git synced 2026-11-09 15:49:16 -05:00
Code Issues Releases Packages Wiki Activity
899 commits 25 branches 18 tags 8 MiB
Commit graph pkg-proxy/go.mod
Author SHA1 Message Date
simon chrzanowski
15789d40bb
 		Update golang.org/x/net to v0.62.0 (#647) 
Fixes CVE-2026-78661 and CVE-2026-97045 in x/net/html, which parses
upstream PyPI simple pages for the denylist.
 2026-10-31 20:14:53 +00:00
Andrew Nesbitt
3eadb3eb46
 		Preserve Swift and Go compatibility when upgrading PURL (#642) 
* Handle Swift registry identities in cache and vulnerability APIs

* Preserve Go cache and policy behavior when upgrading PURL
 2026-10-31 09:49:35 +00:00
simon chrzanowski
efe682327c
 		Merge pull request #635 from git-pkgs/dependabot/go_modules/github.com/klauspost/compress-1.20.3 
Bump github.com/klauspost/compress from 1.20.1 to 1.20.3
 2026-10-29 19:05:07 +01:00
simon chrzanowski
5288f6ae13
 		Merge pull request #637 from git-pkgs/dependabot/go_modules/modernc.org/sqlite-1.61.0 
Bump modernc.org/sqlite from 1.60.1 to 1.61.0
 2026-10-29 19:04:42 +01:00
simon chrzanowski
c9a3a6496d
 		Merge pull request #636 from git-pkgs/dependabot/go_modules/github.com/git-pkgs/archives-0.10.0 
Bump github.com/git-pkgs/archives from 0.9.0 to 0.10.0
 2026-10-29 19:04:36 +01:00
dependabot[bot]
b31ee702a5
 		Bump modernc.org/sqlite from 1.60.1 to 1.61.0 
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.60.1 to 1.61.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.60.1...v1.61.0)

---
updated-dependencies:
- dependency-name: modernc.org/sqlite
  dependency-version: 1.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-29 15:14:31 +00:00
dependabot[bot]
359ba32866
 		Bump github.com/git-pkgs/archives from 0.9.0 to 0.10.0 
Bumps [github.com/git-pkgs/archives](https://github.com/git-pkgs/archives) from 0.9.0 to 0.10.0.
- [Commits](https://github.com/git-pkgs/archives/compare/v0.9.0...v0.10.0)

---
updated-dependencies:
- dependency-name: github.com/git-pkgs/archives
  dependency-version: 0.10.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-29 15:14:22 +00:00
dependabot[bot]
ce60611391
 		Bump github.com/klauspost/compress from 1.20.1 to 1.20.3 
Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.20.1 to 1.20.3.
- [Release notes](https://github.com/klauspost/compress/releases)
- [Commits](https://github.com/klauspost/compress/compare/v1.20.1...v1.20.3)

---
updated-dependencies:
- dependency-name: github.com/klauspost/compress
  dependency-version: 1.20.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-29 15:14:17 +00:00
dependabot[bot]
96bd0f4a59
 		Bump github.com/git-pkgs/magic from 0.5.0 to 0.6.0 
Bumps [github.com/git-pkgs/magic](https://github.com/git-pkgs/magic) from 0.5.0 to 0.6.0.
- [Release notes](https://github.com/git-pkgs/magic/releases)
- [Commits](https://github.com/git-pkgs/magic/compare/v0.5.0...v0.6.0)

---
updated-dependencies:
- dependency-name: github.com/git-pkgs/magic
  dependency-version: 0.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-29 15:13:56 +00:00
Andrew Nesbitt
9374437960
 		Bump git-pkgs/registries to v0.12.0 2026-10-28 13:45:11 +00:00
Andrew Nesbitt
847f4f351c
 		Merge main into fix/ssrf-forward-proxy 
# Conflicts:
#	go.mod
#	go.sum
 2026-10-25 10:36:38 +00:00
Andrew Nesbitt
c6ccbcb974
 		Merge pull request #588 from simonchrz/refactor/shared-enrichment 
Use git-pkgs/enrichment for the enrichment API
 2026-10-25 10:30:22 +00:00
Andrew Nesbitt
910dadc220
 		Bump registries to v0.11.1 2026-10-25 10:17:37 +00:00
Andrew Nesbitt
1b641b6e90
 		Bump enrichment to v0.7.4 2026-10-25 10:15:58 +00:00
Andrew Nesbitt
2a4ce12248
 		Bump purl to v0.1.24 and drop redundant Swift lowercasing 2026-10-25 10:14:03 +00:00
Simon Chrzanowski
0b2fa83590 Use registries' forward proxy check 
registries' safehttp now checks the destination of requests sent through
a forward proxy (git-pkgs/registries#116), so the proxy's own guard is
removed and newUpstreamClient is back to its earlier form.

go.mod points at a pseudo-version of registries main until #116 is
released.
 2026-10-24 19:00:57 +02:00
Simon Chrzanowski
de308e48e0 Use purl's ComparisonForm for denylist and NuGet retention keys 
The per-ecosystem rules for when two spellings name the same package
(PEP 503, NuGet case, Composer's leading v, conda channel, OCI paths,
Swift registry case) now live in purl. The denylist keeps only the
proxy's own pkg:generic/swift-registry spelling and the gem platform
match. Keys, cache paths and stored PURLs are unchanged.
 2026-10-24 18:58:23 +02:00
Simon Chrzanowski
fc299593ac Answer 404 for packages the registry doesn't have 2026-10-24 18:56:19 +02:00
Simon Chrzanowski
96cc1ee87f Serve conda sharded repodata through cooldown and the cache 
The shard index (repodata_shards.msgpack.zst) and the shards of CEP 16
fell through to the uncached passthrough, so clients that use them, such
as pixi, got no cooldown filtering and no offline copy.

Without cooldown, the index and shards are now served through the
metadata cache. With cooldown, shards have to be filtered, but clients
cache them by the hash in the index and never fetch a hash twice. The
proxy rewrites the index instead: each hash is XORed with a mask derived
from channel, subdir and the current hour, and shards_base_url points at
cooldown-shards/{hour}/. That route undoes the mask, fetches the
upstream shard and drops records still in cooldown. The unmasked shard
paths answer 404 while cooldown is on.

When the index puts packages or shards somewhere the proxy doesn't
route, or has an unknown version, the proxy answers 404 and clients fall
back to repodata.json, which is filtered as before.

Fixes #529
 2026-10-23 12:07:01 +02:00
Andrew Nesbitt
7c6f97c89f
 		Merge pull request #545 from simonchrz/feat/freebsd 
Proxy FreeBSD pkg repositories
 2026-10-23 10:09:11 +01:00
Simon Chrzanowski
d28c0befbf Build with Go 1.27.3 everywhere 
CI, the release binaries and swagger take their Go version from go.mod,
which pinned 1.26.7 and so missed the stdlib fixes in 1.26.8 to 1.26.10.
A toolchain line now sets 1.27.3 for them, and the Docker builder uses
the same version. The go line stays at 1.26.7, so source builds with an
older local Go still work.

golangci-lint 2.13.1 can't read Go 1.27.2+ export data, so CI moves to
2.15.0. Its errcheck flags two test cleanups that dropped the server's
exit error; they now check it.
 2026-10-23 09:57:37 +02:00
Simon Chrzanowski
91b37ec1f8 Proxy FreeBSD pkg repositories at /freebsd/{name}/ 
Catalogues (meta.conf, packagesite and data) carry their signature
inside the archive and go through the metadata cache byte for byte.
Packages under Hashed/ have the content hash in their name, so they go
to the artifact cache as pkg:bsd/freebsd/{name}@{version}. Other files,
including the bootstrap files under Latest/, are passed through.
pkg.freebsd.org is the built-in freebsd repository; more mirrors go
under upstream.freebsd.

Closes #536
 2026-10-22 12:36:27 +02:00
Andrew Nesbitt
5b5a848c65
 		Update Go dependencies (#534) 2026-10-20 12:29:22 +01:00
Andrew Nesbitt
03f0ebdd55
 		Use shared archives browser for cached artifacts (#512) 
* Use shared archives browser for cached artifacts

* Pin archives to combined browser and Hex changes

* Use archives v0.9.0 release

* Return 404 when browsing archive directories as files
 2026-10-20 11:41:18 +01:00
Andrew Nesbitt
5dfd01ea74
 		Use shared sbom parser for mirror sources (#510) 
* Use shared sbom parser for mirror sources

* Use sbom v0.1.7 release
 2026-10-20 09:14:09 +01:00
Andrew Nesbitt
6d771a8d3a
 		Use shared cooldown package-pattern policy 
Use cooldown.NewPolicy for package-pattern overrides and remove the duplicate local implementation.
 2026-10-20 08:53:22 +01:00
Andrew Nesbitt
8e04713425
 		Use shared registries size limits and rate-limit gate (#516) 
* Use shared registries size limits and rate-limit gate

* Use registries v0.10.0 release
 2026-10-19 13:28:55 +02:00
Andrew Nesbitt
d58dd3dc3d
 		Update x/net and remove unused production helpers 2026-10-19 08:35:46 +01:00
dependabot[bot]
b8d5cf4f27
 		Bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.66.1 to 1.66.2 
Bumps [github.com/aws/aws-sdk-go-v2/service/ecr](https://github.com/aws/aws-sdk-go-v2) from 1.66.1 to 1.66.2.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.66.1...service/s3/v1.66.2)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ecr
  dependency-version: 1.66.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-15 15:33:50 +00:00
Andrew Nesbitt
78b1913865
 		Merge pull request #490 from git-pkgs/dependabot/go_modules/github.com/prometheus/client_golang-1.25.0 
Bump github.com/prometheus/client_golang from 1.24.1 to 1.25.0
 2026-10-15 16:31:13 +01:00
Andrew Nesbitt
29046e6013
 		Merge pull request #489 from git-pkgs/dependabot/go_modules/github.com/aws/aws-sdk-go-v2/config-1.33.7 
Bump github.com/aws/aws-sdk-go-v2/config from 1.33.6 to 1.33.7
 2026-10-15 16:30:33 +01:00
dependabot[bot]
ba61c45077
 		Bump github.com/prometheus/client_golang from 1.24.1 to 1.25.0 
Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.24.1 to 1.25.0.
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md)
- [Commits](https://github.com/prometheus/client_golang/compare/v1.24.1...v1.25.0)

---
updated-dependencies:
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-15 15:16:44 +00:00
dependabot[bot]
fc312a0c59
 		Bump github.com/aws/aws-sdk-go-v2/config from 1.33.6 to 1.33.7 
Bumps [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) from 1.33.6 to 1.33.7.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/config/v1.33.6...config/v1.33.7)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-version: 1.33.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-15 15:16:38 +00:00
dependabot[bot]
b884a5f63f
 		Bump golang.org/x/sync from 0.23.0 to 0.24.0 
Bumps [golang.org/x/sync](https://github.com/golang/sync) from 0.23.0 to 0.24.0.
- [Commits](https://github.com/golang/sync/compare/v0.23.0...v0.24.0)

---
updated-dependencies:
- dependency-name: golang.org/x/sync
  dependency-version: 0.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-10-15 15:15:16 +00:00
Simon Chrzanowski
cbb1978026 Bump git-pkgs/integrity to v0.2.0 
v0.2.0 adds verification-only SHA-1 and MD5, algorithm-prefixed checksum
parsing and exact-digest verification (git-pkgs/integrity#3).
 2026-10-14 18:04:31 +02:00
Christian Heim
1c6cfae813 Serve the Go checksum database from its own URL 
Everything under /go/sumdb/ was passed on to the module upstream. But
proxy.golang.org doesn't serve the checksum database, so those requests
always came back 404 and every client had to talk to sum.golang.org itself.

The Go handler now serves /sumdb/{name}/ for the databases in
upstream.go_sumdbs, which defaults to sum.golang.org. Lookups, latest and
tiles come from the database through the metadata cache. Complete tiles
never change, so once they're cached we don't ask again. Unknown names and
paths that aren't part of the protocol get a 404 without going upstream.

If the database answers 404 we pass on up to 4 KiB of its text, because the
go command prints it and it tells you why a version is missing. For that the
not-found error from the metadata fetch now carries the start of the body.
Other handlers still just see ErrUpstreamNotFound.
 2026-10-13 16:41:53 +02:00
dependabot[bot]
73ed6bf5c6
 		build(deps): bump github.com/aws/aws-sdk-go-v2/config (#422) 
Bumps [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) from 1.33.5 to 1.33.6.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/config/v1.33.5...config/v1.33.6)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-version: 1.33.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-10 07:20:45 +01:00
dependabot[bot]
a691e992cc
 		build(deps): bump github.com/aws/aws-sdk-go-v2/service/ecr (#423) 
Bumps [github.com/aws/aws-sdk-go-v2/service/ecr](https://github.com/aws/aws-sdk-go-v2) from 1.66.0 to 1.66.1.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.66.0...service/s3/v1.66.1)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ecr
  dependency-version: 1.66.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-09 08:11:55 +02:00
dependabot[bot]
52e8b5c2a4
 		build(deps): bump modernc.org/sqlite from 1.59.0 to 1.60.1 (#421) 
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.59.0 to 1.60.1.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.59.0...v1.60.1)

---
updated-dependencies:
- dependency-name: modernc.org/sqlite
  dependency-version: 1.60.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-10-09 08:11:12 +02:00
Andrew Nesbitt
76db94552f
 		Install development tools directly in CI (#398) 2026-10-01 19:48:27 +01:00
Andrew Nesbitt
51caa17d5e
 		Update git-pkgs dependencies (#396) 2026-10-01 16:06:12 +01:00
Andrew Nesbitt
5f0f3b034a
 		Update enrichment to v0.7.2 (#394) 
* Update ecosystems-go to v0.5.0

* Update enrichment to v0.7.2
 2026-10-01 15:25:11 +01:00
dependabot[bot]
eedc2908df
 		build(deps): bump github.com/git-pkgs/archives from 0.7.0 to 0.7.1 
Bumps [github.com/git-pkgs/archives](https://github.com/git-pkgs/archives) from 0.7.0 to 0.7.1.
- [Commits](https://github.com/git-pkgs/archives/compare/v0.7.0...v0.7.1)

---
updated-dependencies:
- dependency-name: github.com/git-pkgs/archives
  dependency-version: 0.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-24 16:22:59 +00:00
Andrew Nesbitt
36556945ed
 		Merge pull request #378 from git-pkgs/dependabot/go_modules/github.com/aws/aws-sdk-go-v2/config-1.33.5 
build(deps): bump github.com/aws/aws-sdk-go-v2/config from 1.33.4 to 1.33.5
 2026-09-24 17:20:57 +01:00
dependabot[bot]
ccc80f8449
 		build(deps): bump github.com/aws/aws-sdk-go-v2/config 
Bumps [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) from 1.33.4 to 1.33.5.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/config/v1.33.4...config/v1.33.5)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-version: 1.33.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-24 16:01:35 +00:00
Andrew Nesbitt
7379f4721e
 		Merge pull request #376 from git-pkgs/dependabot/go_modules/modernc.org/sqlite-1.59.0 
build(deps): bump modernc.org/sqlite from 1.58.0 to 1.59.0
 2026-09-24 16:59:53 +01:00
Andrew Nesbitt
43a91ec20d
 		Merge pull request #374 from git-pkgs/dependabot/go_modules/github.com/git-pkgs/magic-0.4.0 
build(deps): bump github.com/git-pkgs/magic from 0.3.1 to 0.4.0
 2026-09-24 16:59:08 +01:00
Andrew Nesbitt
4f80102529
 		Merge pull request #373 from git-pkgs/dependabot/go_modules/github.com/git-pkgs/registries-0.9.2 
build(deps): bump github.com/git-pkgs/registries from 0.9.1 to 0.9.2
 2026-09-24 16:58:40 +01:00
Andrew Nesbitt
e4682c8ec1
 		Merge pull request #372 from git-pkgs/dependabot/go_modules/golang.org/x/net-0.59.0 
build(deps): bump golang.org/x/net from 0.58.0 to 0.59.0
 2026-09-24 16:58:01 +01:00
dependabot[bot]
fbb89c9d78
 		build(deps): bump modernc.org/sqlite from 1.58.0 to 1.59.0 
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.58.0 to 1.59.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.58.0...v1.59.0)

---
updated-dependencies:
- dependency-name: modernc.org/sqlite
  dependency-version: 1.59.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-24 15:15:14 +00:00