mirrors/pkg-proxy
Watch
1
0
Fork
You've already forked pkg-proxy
 1
mirror of https://github.com/git-pkgs/proxy.git synced 2026-11-09 23:59:16 -05:00
Code Issues Releases Packages Wiki Activity
449 commits 25 branches 18 tags 8.2 MiB
Commit graph

449 commits

This branch
This branch
All branches
Author SHA1 Message Date
Andrew Nesbitt
4f80102529
 		Merge pull request #373 from git-pkgs/dependabot/go_modules/github.com/git-pkgs/registries-0.9.2 
build(deps): bump github.com/git-pkgs/registries from 0.9.1 to 0.9.2
 2026-09-24 16:58:40 +01:00
Andrew Nesbitt
e4682c8ec1
 		Merge pull request #372 from git-pkgs/dependabot/go_modules/golang.org/x/net-0.59.0 
build(deps): bump golang.org/x/net from 0.58.0 to 0.59.0
 2026-09-24 16:58:01 +01:00
Andrew Nesbitt
a4702d0814
 		Merge pull request #371 from git-pkgs/dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/ecr-1.66.0 
build(deps): bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.65.0 to 1.66.0
 2026-09-24 16:57:32 +01:00
Andrew Nesbitt
e26c2d13a7
 		Merge pull request #370 from git-pkgs/dependabot/github_actions/docker/build-push-action-7.4.0 
build(deps): bump docker/build-push-action from 7.3.0 to 7.4.0
 2026-09-24 16:56:43 +01:00
Andrew Nesbitt
a7cccff3bc
 		Merge pull request #369 from git-pkgs/dependabot/github_actions/docker/setup-qemu-action-4.4.0 
build(deps): bump docker/setup-qemu-action from 4.3.0 to 4.4.0
 2026-09-24 16:55:20 +01:00
Andrew Nesbitt
c3fc32b164
 		Merge pull request #368 from git-pkgs/dependabot/github_actions/docker/setup-buildx-action-4.4.1 
build(deps): bump docker/setup-buildx-action from 4.3.0 to 4.4.1
 2026-09-24 16:54:52 +01:00
dependabot[bot]
3611ff2fa2
 		build(deps): bump github.com/git-pkgs/vers from 0.7.0 to 0.7.1 
Bumps [github.com/git-pkgs/vers](https://github.com/git-pkgs/vers) from 0.7.0 to 0.7.1.
- [Commits](https://github.com/git-pkgs/vers/compare/v0.7.0...v0.7.1)

---
updated-dependencies:
- dependency-name: github.com/git-pkgs/vers
  dependency-version: 0.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-24 15:15:18 +00:00
dependabot[bot]
fbb89c9d78
 		build(deps): bump modernc.org/sqlite from 1.58.0 to 1.59.0 
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.58.0 to 1.59.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.58.0...v1.59.0)

---
updated-dependencies:
- dependency-name: modernc.org/sqlite
  dependency-version: 1.59.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-24 15:15:14 +00:00
dependabot[bot]
2a35d3df90
 		build(deps): bump github.com/git-pkgs/magic from 0.3.1 to 0.4.0 
Bumps [github.com/git-pkgs/magic](https://github.com/git-pkgs/magic) from 0.3.1 to 0.4.0.
- [Release notes](https://github.com/git-pkgs/magic/releases)
- [Commits](https://github.com/git-pkgs/magic/compare/v0.3.1...v0.4.0)

---
updated-dependencies:
- dependency-name: github.com/git-pkgs/magic
  dependency-version: 0.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-24 15:15:01 +00:00
dependabot[bot]
ceee79f123
 		build(deps): bump github.com/git-pkgs/registries from 0.9.1 to 0.9.2 
Bumps [github.com/git-pkgs/registries](https://github.com/git-pkgs/registries) from 0.9.1 to 0.9.2.
- [Release notes](https://github.com/git-pkgs/registries/releases)
- [Commits](https://github.com/git-pkgs/registries/compare/v0.9.1...v0.9.2)

---
updated-dependencies:
- dependency-name: github.com/git-pkgs/registries
  dependency-version: 0.9.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-24 15:14:57 +00:00
dependabot[bot]
468e9e564d
 		build(deps): bump golang.org/x/net from 0.58.0 to 0.59.0 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.58.0 to 0.59.0.
- [Commits](https://github.com/golang/net/compare/v0.58.0...v0.59.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.59.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-24 15:14:52 +00:00
dependabot[bot]
8bbe117e84
 		build(deps): bump github.com/aws/aws-sdk-go-v2/service/ecr 
Bumps [github.com/aws/aws-sdk-go-v2/service/ecr](https://github.com/aws/aws-sdk-go-v2) from 1.65.0 to 1.66.0.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.65.0...service/s3/v1.66.0)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ecr
  dependency-version: 1.66.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-24 15:14:48 +00:00
dependabot[bot]
d14b240654
 		build(deps): bump docker/build-push-action from 7.3.0 to 7.4.0 
Bumps [docker/build-push-action](https://github.com/docker/build-push-action) from 7.3.0 to 7.4.0.
- [Release notes](https://github.com/docker/build-push-action/releases)
- [Commits](53b7df96c9...c3c9e263c2)

---
updated-dependencies:
- dependency-name: docker/build-push-action
  dependency-version: 7.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-24 15:13:54 +00:00
dependabot[bot]
15d5ac09b8
 		build(deps): bump docker/setup-qemu-action from 4.3.0 to 4.4.0 
Bumps [docker/setup-qemu-action](https://github.com/docker/setup-qemu-action) from 4.3.0 to 4.4.0.
- [Release notes](https://github.com/docker/setup-qemu-action/releases)
- [Commits](1f40c72289...9901266195)

---
updated-dependencies:
- dependency-name: docker/setup-qemu-action
  dependency-version: 4.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-24 15:13:45 +00:00
dependabot[bot]
3724c93626
 		build(deps): bump docker/setup-buildx-action from 4.3.0 to 4.4.1 
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action) from 4.3.0 to 4.4.1.
- [Release notes](https://github.com/docker/setup-buildx-action/releases)
- [Commits](37fe631027...f87e5991a6)

---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
  dependency-version: 4.4.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-24 15:13:32 +00:00
montehurd
4ce6c37bd9 Give each fetch its own storage path 
Every fetch of an artifact wrote one path, so fetches with different URLs
or digests, which do not share a coalescing key, could overwrite each
other's bytes, serve the wrong ones, or delete them on a digest mismatch
while the other was about to open them.

storeArtifact now writes {ecosystem}/{name}/{version}/{fetch id}/{filename},
with a random id per fetch. Most ecosystems learn the digest only after
the fetch, and storage has no rename, so the id is the one rule that fits
all of them. Existing records keep their paths and stay readable. On a
file:// bucket, Delete now removes an emptied fetch directory, which
fileblob leaves behind, and no other directory, since another fetch may
be creating its own inside it.

A path a record stops pointing at is queued in pending_deletes rather
than deleted, since a request that read the record may still open it. A
loop deletes queued paths after max(1h, direct_serve_ttl), whether or not
max_size is set. UpsertArtifact and clears apply only if the record still
holds the path the caller read, so racing commits each queue the path
they replaced and a clear never orphans a newer commit. Eviction still
deletes inline, and counts space as freed only when the record still
pointed at what it deleted.
 2026-09-23 16:14:43 -07:00
Andrew Nesbitt
e635a62e2c
 		Test that GCS Delete of a missing object returns nil 2026-09-23 17:26:42 +01:00
Andrew Nesbitt
37ef25b718
 		Merge pull request #363 from montehurd/bound-eviction-pass 
End an eviction pass that cannot evict anything
 2026-09-23 17:21:06 +01:00
Andrew Nesbitt
cd7d92e83b
 		Merge pull request #366 from abhinavgautam01/fix/mirror-cache-hit-342 
fix(mirror): match cached artifacts by resolved filename
 2026-09-23 17:19:18 +01:00
Andrew Nesbitt
00a49e2c40
 		Standardize the README license footer 2026-09-23 15:33:15 +01:00
abhinavgautam01
a55f42ec80
 		fix(mirror): match cached artifacts by resolved filename 2026-09-23 17:51:49 +05:30
Andrew Nesbitt
c1f420aafe
 		Add and align CI security and dependency automation 2026-09-23 10:53:57 +01:00
montehurd
50e5cc334e
 		Merge branch 'git-pkgs:main' into bound-eviction-pass 2026-09-22 14:30:58 -06:00
Andrew Nesbitt
e94805e9b5
 		Merge pull request #365 from git-pkgs/dependabot/go_modules/go.opentelemetry.io/otel/sdk-1.45.0 
build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0
 2026-09-22 08:53:14 +01:00
Andrew Nesbitt
65f2bf52b1
 		Widen wall-clock bound in flaky probe timeout test 
Loaded CI runners exceeded the 500ms bound; 5s still proves the
probe timeout fired instead of blocking on Store.
 2026-09-22 08:46:40 +01:00
dependabot[bot]
442b591349
 		build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 
Bumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) from 1.44.0 to 1.45.0.
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.44.0...v1.45.0)

---
updated-dependencies:
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.45.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-22 07:38:12 +00:00
Andrew Nesbitt
f3445b505f
 		Merge pull request #361 from git-pkgs/helm-skip-malformed-releases 
Omit malformed Helm chart releases instead of failing the index
 2026-09-22 08:35:42 +01:00
Andrew Nesbitt
73a98636af
 		Assert omitted Helm releases are not downloadable 2026-09-22 08:35:20 +01:00
Andrew Nesbitt
e6271a8bd2
 		Merge pull request #364 from abhinavgautam01/docs/apt-denylist-pinning-358 
docs: explain APT denylist limitations and version pinning
 2026-09-22 08:31:01 +01:00
abhinavgautam01
c753a74666
 		docs: explain APT denylist limitations and version pinning 2026-09-22 12:47:37 +05:30
Andrew Nesbitt
ee60ab70c5
 		Merge pull request #362 from montehurd/fix-handler-test-build 
Fix the handler test build
 2026-09-22 07:18:31 +01:00
montehurd
8f09c1dc30 Fix the handler test build 
The denylist tests call NewDebianHandler with three arguments, but the
additional APT archives change gave it a fourth. Each passed CI on its
own branch, and together they leave internal/handler without a test
binary that compiles, so go vet and go test fail on main.
 2026-09-21 13:51:48 -07:00
montehurd
1001cd772b End an eviction pass that cannot evict anything 
A failed delete leaves the record eligible, so the same batch came back
on the next iteration while the recorded size never dropped. Against a
backend refusing deletes the pass retried forever, burning CPU and
flooding the log. A canceled context made it faster: every delete fails
at once, so the loop spun as quickly as the database could answer.

The pass now ends when a batch clears no record, and returns as soon as
the context is canceled. Progress counts records rather than bytes,
because a cached record can have no size recorded. A pass can therefore
end with the cache still above its limit, leaving the records that
failed for the next pass to retry.
 2026-09-21 13:48:09 -07:00
Andrew Nesbitt
e28745742c
 		Merge pull request #353 from andrewmrich/arich/debian-repositories 
enable multiple debian repositories
 2026-09-21 12:06:55 +01:00
Andrew Nesbitt
8b1e7cbd32
 		Omit malformed Helm chart releases instead of failing the index 
A single bad release in a third-party index made the whole
repository unusable through the proxy.
 2026-09-21 12:01:37 +01:00
Andrew Nesbitt
1da2dc0bf9
 		Merge pull request #359 from abhinavgautam01/fix/helm-oci-index-320 
fix(helm): support OCI references in HTTP repository indexes
 2026-09-21 11:59:04 +01:00
Andrew Nesbitt
54cfb30677
 		Merge pull request #360 from abhinavgautam01/feat/version-denylist-358 
feat: add exact-version package denylist
 2026-09-21 11:56:14 +01:00
Andrew Nesbitt
499033b973
 		Exit non-zero when mirror denylist is invalid 2026-09-21 11:56:03 +01:00
abhinavgautam01
548a50d56e
 		feat: add exact-version package denylist 2026-09-20 14:42:30 +05:30
abhinavgautam01
429e7458e4
 		fix(helm): support OCI references in HTTP repository indexes 2026-09-19 14:39:29 +05:30
Andrew Rich
9788aa70bc feat(debian): report a misspelled repository name 
A request to /debian/{name}/ for a name that is not configured fell through
to the main archive, so a typo surfaced as the upstream's own HTML 404 with
no mention of the repository. The reply now names the unknown repository and
lists the configured ones.

Scoped to {name}/dists/ and {name}/pool/. The main archive serves README,
indices/ and project/ at its root, so an unknown first segment stays a
main-archive path everywhere else.

apt prints only the status line, so this is visible via curl or the proxy
log rather than in apt output.
 2026-09-18 16:48:18 -07:00
dependabot[bot]
b2817dc213
 		Bump github.com/aws/aws-sdk-go-v2/config from 1.33.2 to 1.33.4 (#356) 
Bumps [github.com/aws/aws-sdk-go-v2/config](https://github.com/aws/aws-sdk-go-v2) from 1.33.2 to 1.33.4.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/config/v1.33.2...config/v1.33.4)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/config
  dependency-version: 1.33.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-17 21:08:14 +01:00
dependabot[bot]
b83bc0eed2
 		Bump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 (#354) 
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.6.3 to 0.6.4.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](70fb788f84...cc914d7f37)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.6.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-17 20:00:05 +01:00
dependabot[bot]
2aad8bfcec
 		Bump github.com/git-pkgs/spdx from 0.3.1 to 0.3.2 (#355) 
Bumps [github.com/git-pkgs/spdx](https://github.com/git-pkgs/spdx) from 0.3.1 to 0.3.2.
- [Commits](https://github.com/git-pkgs/spdx/compare/v0.3.1...v0.3.2)

---
updated-dependencies:
- dependency-name: github.com/git-pkgs/spdx
  dependency-version: 0.3.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-17 19:59:47 +01:00
dependabot[bot]
2ae6213d3b
 		Bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.64.0 to 1.65.0 (#357) 
Bumps [github.com/aws/aws-sdk-go-v2/service/ecr](https://github.com/aws/aws-sdk-go-v2) from 1.64.0 to 1.65.0.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases)
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.64.0...service/s3/v1.65.0)

---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/service/ecr
  dependency-version: 1.65.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-09-17 19:59:27 +01:00
Andrew Rich
658664a144 docs(debian): drop a stray space in a test comment 2026-09-16 10:18:56 -07:00
Andrew Rich
46faf76ae3 docs(debian): trim comments on the named-repositories change 
The motivation for separate archives was repeated across six files and the
reserved-name rationale across five. Keep each in one place -- the reference
docs -- and leave the code comments to what an informed reader cannot get
from the code: why an unknown first segment is not a 404 as it is for APK,
and why the main archive keeps its legacy cache identities.

Comments and prose only; no behaviour change.
 2026-09-16 10:15:59 -07:00
Andrew Rich
8805cd9283
 		Merge branch 'git-pkgs:main' into arich/debian-repositories 2026-09-16 10:04:56 -07:00
Andrew Nesbitt
2736fe03d3
 		Fall back to embedded build info for Version (#352) 
go install does not apply goreleaser's -ldflags -X, so binaries
installed that way reported 'dev'. Read debug.BuildInfo.Main.Version
when the ldflag is unset.
 2026-09-16 09:25:19 +01:00
Abhinav Gautam
c895e5b053
 		Fix NuGet cooldown enforcement for listings and downloads (#340) 
* fix(nuget): enforce cooldown across metadata and downloads

* fix(nuget): support legacy registration and preserve valid metadata cache

* refactor(nuget): address maintainer review cleanup
 2026-09-16 08:27:44 +01:00