Commit graph

Select branches

Hide pull requests

bump-deps

bump-deps-v0.4.0

bump-vulnerable-deps

bump-x-net

composer-unset-sentinel

cosign-signing

deps/pre-v0.7.0

enforce-max-size-eviction

extract-portable-npm-metadata

fix-197-cooldown-scoped-purls

fix-database-log-173

http-timeout-config

issue-186-container-offline-auth

issue-186-upstream-auth

issue-225-sign-container-image

julia-support

lint-cleanup

main

path-traversal-decode

perf/cache-hit-path

pin-vendored-assets

registries-v0.6.0-cooldown

ui-polish

use-database-package

validate-package-name

#1

#10

#100

#101

#102

#103

#104

#105

#106

#107

#108

#109

#11

#110

#111

#113

#114

#115

#117

#119

#120

#121

#122

#124

#125

#13

#135

#136

#137

#138

#139

#14

#140

#146

#148

#15

#150

#151

#152

#153

#154

#156

#157

#158

#159

#160

#161

#162

#163

#164

#165

#166

#167

#168

#169

#17

#170

#171

#172

#174

#175

#176

#177

#178

#179

#18

#180

#181

#185

#188

#189

#19

#190

#191

#192

#193

#194

#195

#196

#198

#199

#2

#200

#201

#202

#203

#204

#205

#206

#209

#21

#210

#211

#212

#213

#214

#215

#216

#217

#218

#219

#22

#220

#221

#222

#223

#224

#227

#229

#23

#230

#232

#233

#234

#235

#237

#238

#24

#240

#241

#243

#244

#245

#246

#25

#250

#251

#252

#253

#254

#255

#257

#258

#259

#26

#260

#267

#268

#269

#27

#270

#272

#273

#275

#277

#278

#279

#28

#280

#281

#283

#284

#285

#286

#287

#288

#289

#29

#290

#291

#293

#294

#296

#297

#298

#299

#3

#30

#301

#302

#304

#307

#308

#31

#310

#311

#314

#315

#316

#317

#318

#319

#32

#324

#328

#329

#33

#330

#331

#332

#333

#334

#335

#336

#337

#340

#346

#347

#348

#349

#35

#350

#351

#352

#353

#354

#355

#356

#357

#359

#36

#360

#361

#362

#363

#364

#365

#366

#367

#368

#369

#37

#370

#371

#372

#373

#374

#375

#376

#377

#378

#379

#38

#380

#381

#382

#383

#387

#388

#389

#39

#390

#391

#392

#393

#394

#395

#396

#397

#398

#399

#399

#4

#40

#400

#401

#402

#404

#405

#406

#407

#408

#413

#417

#418

#419

#420

#421

#422

#423

#424

#425

#426

#427

#428

#429

#430

#431

#433

#435

#436

#437

#438

#439

#44

#440

#441

#442

#443

#444

#445

#446

#447

#448

#449

#45

#450

#451

#452

#453

#454

#455

#456

#457

#458

#459

#46

#462

#463

#464

#465

#468

#469

#47

#470

#471

#472

#473

#475

#476

#477

#479

#48

#481

#482

#483

#484

#485

#487

#488

#489

#490

#491

#492

#493

#494

#495

#496

#5

#50

#502

#503

#503

#504

#505

#506

#507

#508

#509

#51

#510

#511

#512

#513

#515

#516

#518

#519

#520

#527

#528

#531

#533

#534

#537

#538

#539

#540

#541

#544

#545

#546

#547

#548

#549

#550

#551

#552

#553

#554

#555

#556

#557

#558

#559

#561

#564

#565

#566

#567

#568

#569

#57

#570

#571

#572

#573

#574

#575

#576

#577

#578

#579

#58

#580

#581

#582

#583

#584

#585

#586

#587

#588

#589

#59

#590

#591

#592

#593

#594

#595

#597

#598

#599

#6

#60

#600

#601

#602

#603

#604

#605

#606

#607

#608

#609

#610

#611

#612

#615

#616

#618

#620

#621

#622

#623

#624

#625

#626

#627

#628

#629

#63

#630

#631

#633

#634

#635

#636

#637

#638

#639

#64

#640

#641

#642

#643

#644

#645

#646

#647

#649

#650

#650

#651

#653

#654

#655

#656

#658

#659

#66

#660

#661

#662

#663

#664

#666

#667

#669

#67

#671

#671

#672

#674

#675

#675

#676

#677

#678

#679

#68

#680

#681

#682

#683

#684

#687

#687

#688

#688

#689

#689

#69

#690

#690

#691

#691

#692

#692

#693

#694

#694

#696

#697

#699

#7

#70

#71

#72

#77

#79

#8

#80

#81

#82

#83

#84

#85

#87

#88

#89

#9

#90

#91

#92

#93

#93

#94

#95

#97

#98

v0.1.0

v0.10.0

v0.11.0

v0.2.0

v0.2.1

v0.3.0

v0.3.1

v0.3.2

v0.4.0

v0.5.0

v0.5.1

v0.6.0

v0.6.1

v0.7.0

v0.8.0

v0.8.1

v0.9.0

v0.9.1

Mono Color

• e9b9edda5a Merge remote-tracking branch 'origin/main' into fix/mirror-exit-on-failure yunaremaia 2026-10-20 04:15:50 +00:00
• b87c75199e The last-access backfill now runs in the background in batches of 1000 instead of inside the migration, resuming after a restart, and until a row is backfilled eviction orders it by its write time. Christian Heim 2026-10-19 19:51:07 +02:00
• b94533dffe Evicting metadata now drops the row and queues its path in one transaction, so a crash before the blob is deleted leaves it to reclaim instead of orphaning it. Christian Heim 2026-10-19 19:41:20 +02:00
• e6c76b09e8 Show evicted metadata on the analytics page next to evicted artifacts, and cover the new counter in the metric surface test. Christian Heim 2026-10-19 19:39:59 +02:00
• 8e04713425
  Use shared registries size limits and rate-limit gate (#516) Andrew Nesbitt 2026-10-19 12:28:55 +01:00
• f600bed073
  Merge upstream main into fix/metadata-cache-metrics-416 abhinavgautam01 2026-10-19 16:10:14 +05:30
• 4de5419256
  Make response write and artifact download timeouts configurable (#531) profiling 2026-10-19 15:54:21 +08:00
• d643836649
  Add opt-in retention for generic artifacts (#513) profiling 2026-10-19 15:43:57 +08:00
• d58dd3dc3d
  Update x/net and remove unused production helpers Andrew Nesbitt 2026-10-19 08:35:46 +01:00
• 1b0bafc69d
  Use sbom v0.1.7 release Andrew Nesbitt 2026-10-19 08:20:18 +01:00
• 5fe84cd995
  Use cooldown v0.3.0 release Andrew Nesbitt 2026-10-19 08:20:05 +01:00
• ef7112c1b7
  Use registries v0.10.0 release Andrew Nesbitt 2026-10-19 08:19:55 +01:00
• 76c0de59f7 Make response write and artifact download timeouts configurable ztzhou 2026-10-19 08:17:39 +08:00
• ad7f29919b
  Refuse package mirroring from the CLI while scanning is enabled (#493) Abhinav Gautam 2026-10-19 12:32:05 +05:30
• bf0c784feb
  Add Chef Supermarket proxy support for Berkshelf and Policyfiles (#518) Abhinav Gautam 2026-10-19 12:29:39 +05:30
• cf463c1141
  Only cache real pub archives on download (#520) Christian Heim 2026-10-19 08:58:13 +02:00
• cae9c08dfe
  Stream conda repodata through the cooldown filter (#527) Andrew Nesbitt 2026-10-19 06:47:34 +01:00
• 2e0f1322a2
  Check gofmt in CI and reformat (#528) Andrew Nesbitt 2026-10-19 06:47:28 +01:00
• b33e773335
  Merge upstream main and expect exit status 1 for refused mirror downloads abhinavgautam01 2026-10-19 11:11:27 +05:30
• 558e9ea695
  Scope cached Chef cookbook archives to the upstream Supermarket abhinavgautam01 2026-10-19 11:05:11 +05:30
• 134906451b
  Check gofmt in CI and reformat Andrew Nesbitt 2026-10-18 21:11:43 +01:00
• e6eee45653
  Stream conda repodata through the cooldown filter Andrew Nesbitt 2026-10-18 21:09:47 +01:00
• d4e89b08da
  Resolve Composer downloads from the cached metadata (#494) simon chrzanowski 2026-10-18 21:32:02 +02:00
• 85b674f278
  Keep the stored metadata on an upstream 304 (#495) simon chrzanowski 2026-10-18 21:29:43 +02:00
• fa7ae81c76
  Request npm packuments in one format for downloads too (#496) simon chrzanowski 2026-10-18 21:27:18 +02:00
• bdec446b69
  Exit with status 1 when proxy mirror fails to mirror a package (#502) Cestercian 2026-10-19 00:55:13 +05:30
• 8d96791f1a
  Re-mirror container images on a schedule (#508) Christian Heim 2026-10-18 19:33:13 +02:00
• 83e2fb4bda
  Make the Gradle build cache read-only by default, so a client that can reach the proxy can no longer overwrite cache entries; CI jobs that upload now need gradle.build_cache.read_only: false (or PROXY_GRADLE_BUILD_CACHE_READ_ONLY=false). The environment variable is parsed strictly, so a value like "yes" keeps uploads off and logs a warning instead of opening them. Fixes #497. (#509) Christian Heim 2026-10-18 19:31:46 +02:00
• ac137a3289
  Extract portable npm metadata transformations extract-portable-npm-metadata Andrew Nesbitt 2026-10-18 17:59:14 +01:00
• 23ed256d7a
  Add Chef Supermarket proxy support for Berkshelf and Policyfiles abhinavgautam01 2026-10-18 20:47:44 +05:30
• 32c299c70a Pub archives that older versions cached from a path without .tar.gz are now discarded and fetched again, so versions that were already broken heal on the next download. Christian Heim 2026-10-18 16:55:58 +02:00
• f094fe9b81 Pub downloads without .tar.gz fetched the HTML version page from pub.dev and cached it as the archive, so one request broke that version for everyone after; they now get a 404, and the upstream URL is built from the escaped name and version so an encoded ? or # can't become a query or fragment. Christian Heim 2026-10-18 13:25:11 +02:00
• 21fdf772fe
  Use shared registries size limits and rate-limit gate Andrew Nesbitt 2026-10-18 14:50:53 +01:00
• f279edf35d fix(mirror): exit with status 1 when downloads fail yunaremaia 2026-10-18 12:59:16 +00:00
• 39d10b1d15 Remove constant parameter from generic retention test helper ztzhou 2026-10-18 20:11:06 +08:00
• f1ea481161 Add opt-in retention for generic artifacts ztzhou 2026-10-18 20:02:39 +08:00
• 51743c6840
  Use shared cooldown package-pattern policy Andrew Nesbitt 2026-10-18 12:39:21 +01:00
• ac000eb601
  Use shared sbom parser for mirror sources Andrew Nesbitt 2026-10-18 12:10:26 +01:00
• 1c20b60445 Make the Gradle build cache read-only by default, so a client that can reach the proxy can no longer overwrite cache entries; CI jobs that upload now need gradle.build_cache.read_only: false (or PROXY_GRADLE_BUILD_CACHE_READ_ONLY=false). The environment variable is parsed strictly, so a value like "yes" keeps uploads off and logs a warning instead of opening them. Fixes #497. Christian Heim 2026-10-18 12:48:42 +02:00
• 3e88cd027a Check cached layers during a mirror without opening them, so a refresh no longer counts as a cache hit and doesn't keep scheduled images at the top of LRU eviction. Christian Heim 2026-10-18 11:08:53 +02:00
• c561cfede9 Start the schedules with the server and let shutdown wait for a running refresh before storage and database are closed. Docs included. Christian Heim 2026-10-18 08:14:50 +02:00
• ce82a153d4 Run each schedule through the normal mirror, one run after the other. The first run starts at a random point within ten minutes and later runs get ±10 % jitter, so several instances don't hit the registry at once. Christian Heim 2026-10-18 08:14:50 +02:00
• 9f058aa36a Add mirror.schedules, a list of image tags the server re-mirrors at a fixed interval. Digests are rejected since they never move. Christian Heim 2026-10-18 08:14:50 +02:00
• 552f0496f4 Shorter comments on the metadata last-access migration. Christian Heim 2026-10-18 07:30:20 +02:00
• b87c6567a0 max_size now counts cached metadata as well as artifacts, and eviction drops whichever was used least recently, so metadata no longer piles up for good (#461). Metadata rows record when they were last served, an artifact not yet served counts from its download, and Arch stores a database blob again if eviction removed it under a refreshed row. Christian Heim 2026-10-17 23:37:29 +02:00
• c0320c7c87 Clearing a record and queueing its file for deletion now happen in one transaction, so a failed queue write keeps the record instead of leaving a file nothing points at. Eviction drops the queue entry again once it has deleted the file itself. Christian Heim 2026-10-17 23:20:45 +02:00
• 56e1c9eb4e Refetch a cached Go zip that an older version stored for the other spelling of the module. Christian Heim 2026-10-17 23:21:08 +02:00
• 3fda7fd176 Keep the capitals of a Go module path in the cached zip's filename, so github.com/Sirupsen/logrus and github.com/sirupsen/logrus no longer share one cache entry. Lowercase paths keep their filename. Christian Heim 2026-10-17 23:12:46 +02:00
• 4b23b3f5a9 Abort the response when a cached artifact fails its integrity check orshih6 2026-10-17 17:40:15 +00:00
• 15aa90aea4
  Exit with status 1 when proxy mirror fails to mirror a package Cestercian 2026-10-17 22:44:26 +05:30
• db6d1d672d Request npm packuments in one format for downloads too Simon Chrzanowski 2026-10-17 14:10:55 +02:00
• 2dde10be4c Keep the stored metadata on an upstream 304 Simon Chrzanowski 2026-10-17 14:08:17 +02:00
• 9dafb8cb36 Resolve Composer downloads from the cached metadata Simon Chrzanowski 2026-10-17 13:58:36 +02:00
• 3f862bfd9c
  Refuse package mirroring from the CLI while scanning is enabled abhinavgautam01 2026-10-16 11:12:09 +05:30
• 1950c0b6a4
  Merge pull request #487 from git-pkgs/dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/ecr-1.66.2 Andrew Nesbitt 2026-10-15 16:55:55 +01:00
• b8d5cf4f27
  Bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.66.1 to 1.66.2 dependabot[bot] 2026-10-15 15:33:50 +00:00
• 78b1913865
  Merge pull request #490 from git-pkgs/dependabot/go_modules/github.com/prometheus/client_golang-1.25.0 Andrew Nesbitt 2026-10-15 16:31:13 +01:00
• 29046e6013
  Merge pull request #489 from git-pkgs/dependabot/go_modules/github.com/aws/aws-sdk-go-v2/config-1.33.7 Andrew Nesbitt 2026-10-15 16:30:33 +01:00
• 1a4a372c4c
  Merge pull request #488 from git-pkgs/dependabot/go_modules/golang.org/x/sync-0.24.0 Andrew Nesbitt 2026-10-15 16:29:35 +01:00
• 7e35cfc4dd
  Merge pull request #483 from gilesw/feat/upstream-retry-after Andrew Nesbitt 2026-10-15 16:27:51 +01:00
• eb29011659
  Merge pull request #485 from simonchrz/perf/gzip-rewritten-metadata Andrew Nesbitt 2026-10-15 16:25:09 +01:00
• ba61c45077
  Bump github.com/prometheus/client_golang from 1.24.1 to 1.25.0 dependabot[bot] 2026-10-15 15:16:44 +00:00
• fc312a0c59
  Bump github.com/aws/aws-sdk-go-v2/config from 1.33.6 to 1.33.7 dependabot[bot] 2026-10-15 15:16:38 +00:00
• b884a5f63f
  Bump golang.org/x/sync from 0.23.0 to 0.24.0 dependabot[bot] 2026-10-15 15:15:16 +00:00
• a1fdd8037a
  Serve metadata cache stats from a shared snapshot and split Grafana cache panels by kind abhinavgautam01 2026-10-15 18:30:05 +05:30
• 201e60c78c
  Merge upstream main into fix/metadata-cache-metrics-416 abhinavgautam01 2026-10-15 18:29:59 +05:30
• b2955ef458 Keep holds through late successes and away from the circuit breaker Giles Westwood 2026-10-15 13:35:12 +01:00
• e74e5abc79
  Serve cached npm and Composer metadata gzip-compressed simon chrzanowski 2026-10-15 12:46:55 +02:00
• 8bc8b3ab75
  Merge pull request #484 from gilesw/fix/maven-checksums-as-artifacts Andrew Nesbitt 2026-10-15 09:34:54 +01:00
• 88cf5be075
  Merge pull request #482 from simonchrz/fix/sandbox-upstream-content Andrew Nesbitt 2026-10-15 09:31:23 +01:00
• adf9d3097c
  Merge pull request #481 from simonchrz/fix/registry-token-scope Andrew Nesbitt 2026-10-15 09:29:50 +01:00
• cbf457bceb
  Merge pull request #479 from simonchrz/feat/registry-checksums Andrew Nesbitt 2026-10-15 09:28:48 +01:00
• e9ecde70ed Hold requests to an upstream that rate limits the proxy Giles Westwood 2026-10-14 12:51:43 +01:00
• 6051e20adf Cache Maven checksums and signatures as artifacts Giles Westwood 2026-10-14 12:31:06 +01:00
• 3bbb5aa7a3 Give the detached fetch test time on slow runners Simon Chrzanowski 2026-10-14 18:14:06 +02:00
• ba5e6e84c5 Leave Composer dev branch archives unverified Simon Chrzanowski 2026-10-14 18:06:01 +02:00
• bf74d982d7 Verify npm and Composer archives against their SHA-1 shasum Simon Chrzanowski 2026-10-14 15:43:39 +02:00
• cbb1978026 Bump git-pkgs/integrity to v0.2.0 Simon Chrzanowski 2026-10-14 16:43:11 +02:00
• e0fb8be4d9
  Merge pull request #473 from simonchrz/fix/artifact-integrity Andrew Nesbitt 2026-10-14 16:56:28 +01:00
• 6a90fb411f Only send credentialed registry tokens to trusted registries Simon Chrzanowski 2026-10-14 17:56:18 +02:00
• cf7eafbbe8 Sandbox upstream content on package routes Simon Chrzanowski 2026-10-14 17:53:48 +02:00
• 2a8717cb77
  Merge pull request #477 from git-pkgs/fix/oci-referrers-tag-offline Andrew Nesbitt 2026-10-14 16:52:18 +01:00
• 0add4d7368
  Merge pull request #476 from git-pkgs/fix/oci-multiple-accept-headers Andrew Nesbitt 2026-10-14 16:51:38 +01:00
• 18f6587f36
  Merge pull request #475 from git-pkgs/fix/browse-encode-file-path Andrew Nesbitt 2026-10-14 16:50:51 +01:00
• 2d258ddc4b Verify npm tarballs against dist.integrity Simon Chrzanowski 2026-10-14 15:36:26 +02:00
• 544e1a5bdd
  Note that the container registry is pull-only Andrew Nesbitt 2026-10-14 13:17:37 +01:00
• 27f65297c6
  Merge pull request #464 from simonchrz/133_local-package-upload Andrew Nesbitt 2026-10-14 13:09:53 +01:00
• 513687ce10
  Answer uncached referrers tags with 404 when the upstream is down Andrew Nesbitt 2026-10-14 12:50:03 +01:00
• dc809b0762
  Join every Accept header on container manifest requests Andrew Nesbitt 2026-10-14 12:43:14 +01:00
• ba81c1db42
  Merge pull request #438 from pinguinfuss/issue-411-mirror-images Andrew Nesbitt 2026-10-14 12:25:04 +01:00
• c0ac418160
  Serve pushed artifacts when streaming upstream artifacts simon chrzanowski 2026-10-14 13:21:57 +02:00
• 8265c7d44b
  Nest the hosted commands under proxy hosted simon chrzanowski 2026-10-13 15:20:57 +02:00
• eca224bb56
  Leave denied pushed versions out of package metadata simon chrzanowski 2026-10-13 15:18:49 +02:00
• 2a957b92e9
  Prefer the root composer.json of a pushed archive simon chrzanowski 2026-10-13 15:17:48 +02:00
• e0ab227f14
  Never replace a pushed artifact with the upstream copy simon chrzanowski 2026-10-13 15:16:55 +02:00
• 3dae0fbae0
  Stop UpsertPackage from clearing packages.source simon chrzanowski 2026-10-13 15:13:02 +02:00
• 69313c26d9
  Serve hosted-only npm scopes and Composer vendors from pushed packages alone simon chrzanowski 2026-10-13 13:42:34 +02:00
• 0916eabe37
  Fix leftover /api/packages references to the hosted endpoints simon chrzanowski 2026-10-13 13:37:58 +02:00
• 96241b910b
  Serve pushed npm tarballs before the cooldown check simon chrzanowski 2026-10-13 13:34:52 +02:00
• c0b2a200c2
  Document how pushed versions appear in package metadata simon chrzanowski 2026-10-13 13:27:27 +02:00