Commit graph

Select branches

Hide pull requests

bump-deps

bump-deps-v0.4.0

bump-vulnerable-deps

bump-x-net

composer-unset-sentinel

cosign-signing

deps/pre-v0.7.0

enforce-max-size-eviction

extract-portable-npm-metadata

fix-197-cooldown-scoped-purls

fix-database-log-173

http-timeout-config

issue-186-container-offline-auth

issue-186-upstream-auth

issue-225-sign-container-image

julia-support

lint-cleanup

main

path-traversal-decode

perf/cache-hit-path

pin-vendored-assets

registries-v0.6.0-cooldown

ui-polish

use-database-package

validate-package-name

#1

#10

#100

#101

#102

#103

#104

#105

#106

#107

#108

#109

#11

#110

#111

#113

#114

#115

#117

#119

#120

#121

#122

#124

#125

#13

#135

#136

#137

#138

#139

#14

#140

#146

#148

#15

#150

#151

#152

#153

#154

#156

#157

#158

#159

#160

#161

#162

#163

#164

#165

#166

#167

#168

#169

#17

#170

#171

#172

#174

#175

#176

#177

#178

#179

#18

#180

#181

#185

#188

#189

#19

#190

#191

#192

#193

#194

#195

#196

#198

#199

#2

#200

#201

#202

#203

#204

#205

#206

#209

#21

#210

#211

#212

#213

#214

#215

#216

#217

#218

#219

#22

#220

#221

#222

#223

#224

#227

#229

#23

#230

#232

#233

#234

#235

#237

#238

#24

#240

#241

#243

#244

#245

#246

#25

#250

#251

#252

#253

#254

#255

#257

#258

#259

#26

#260

#267

#268

#269

#27

#270

#272

#273

#275

#277

#278

#279

#28

#280

#281

#283

#284

#285

#286

#287

#288

#289

#29

#290

#291

#293

#294

#296

#297

#298

#299

#3

#30

#301

#302

#304

#307

#308

#31

#310

#311

#314

#315

#316

#317

#318

#319

#32

#324

#328

#329

#33

#330

#331

#332

#333

#334

#335

#336

#337

#340

#346

#347

#348

#349

#35

#350

#351

#352

#353

#354

#355

#356

#357

#359

#36

#360

#361

#362

#363

#364

#365

#366

#367

#368

#369

#37

#370

#371

#372

#373

#374

#375

#376

#377

#378

#379

#38

#380

#381

#382

#383

#387

#388

#389

#39

#390

#391

#392

#393

#394

#395

#396

#397

#398

#399

#399

#4

#40

#400

#401

#402

#404

#405

#406

#407

#408

#413

#417

#418

#419

#420

#421

#422

#423

#424

#425

#426

#427

#428

#429

#430

#431

#433

#435

#436

#437

#438

#439

#44

#440

#441

#442

#443

#444

#445

#446

#447

#448

#449

#45

#450

#451

#452

#453

#454

#455

#456

#457

#458

#459

#46

#462

#463

#464

#465

#468

#469

#47

#470

#471

#472

#473

#475

#476

#477

#479

#48

#481

#482

#483

#484

#485

#487

#488

#489

#490

#491

#492

#493

#494

#495

#496

#5

#50

#502

#503

#503

#504

#505

#506

#507

#508

#509

#51

#510

#511

#512

#513

#515

#516

#518

#519

#520

#527

#528

#531

#533

#534

#537

#538

#539

#540

#541

#544

#545

#546

#547

#548

#549

#550

#551

#552

#553

#554

#555

#556

#557

#558

#559

#561

#564

#565

#566

#567

#568

#569

#57

#570

#571

#572

#573

#574

#575

#576

#577

#578

#579

#58

#580

#581

#582

#583

#584

#585

#586

#587

#588

#589

#59

#590

#591

#592

#593

#594

#595

#597

#598

#599

#6

#60

#600

#601

#602

#603

#604

#605

#606

#607

#608

#609

#610

#611

#612

#615

#616

#618

#620

#621

#622

#623

#624

#625

#626

#627

#628

#629

#63

#630

#631

#633

#634

#635

#636

#637

#638

#639

#64

#640

#641

#642

#643

#644

#645

#645

#646

#647

#649

#650

#650

#651

#653

#654

#655

#656

#658

#659

#66

#660

#661

#662

#663

#664

#666

#667

#669

#67

#671

#671

#672

#674

#675

#675

#676

#677

#678

#679

#68

#680

#681

#682

#682

#683

#683

#684

#687

#687

#688

#688

#689

#689

#69

#690

#690

#691

#691

#692

#692

#693

#693

#694

#694

#696

#696

#697

#697

#7

#70

#71

#72

#77

#79

#8

#80

#81

#82

#83

#84

#85

#87

#88

#89

#9

#90

#91

#92

#93

#93

#94

#95

#97

#98

v0.1.0

v0.10.0

v0.11.0

v0.2.0

v0.2.1

v0.3.0

v0.3.1

v0.3.2

v0.4.0

v0.5.0

v0.5.1

v0.6.0

v0.6.1

v0.7.0

v0.8.0

v0.8.1

v0.9.0

v0.9.1

Mono Color

• 167e6b8ce7
  Merge pull request #462 from pinguinfuss/issue-409-go-sumdb Andrew Nesbitt 2026-10-14 12:10:03 +01:00
• 53c03c9694
  Merge pull request #465 from pinguinfuss/issue-306-retention-deb Andrew Nesbitt 2026-10-14 12:05:48 +01:00
• f3f35df900
  Note that streamed artifacts over the size limit are cut off Andrew Nesbitt 2026-10-14 12:02:54 +01:00
• 65ffb7c6bd
  Merge pull request #471 from simonchrz/fix/diff2html-pin Andrew Nesbitt 2026-10-14 11:59:30 +01:00
• ea4c1ba125
  Encode file paths when loading files in the source browser Andrew Nesbitt 2026-10-14 11:58:16 +01:00
• 320149399d
  Merge pull request #470 from simonchrz/fix/browse-xss Andrew Nesbitt 2026-10-14 11:51:27 +01:00
• ab413e8966
  Merge pull request #469 from simonchrz/fix/composer-download-cooldown Andrew Nesbitt 2026-10-14 11:50:48 +01:00
• f73f6a796f
  Merge pull request #468 from simonchrz/fix/redirect-auth-header-leak Andrew Nesbitt 2026-10-14 11:49:50 +01:00
• a9cff7fa60
  Limit how many version diffs run at once simon chrzanowski 2026-10-14 08:41:10 +02:00
• b7b7a64239
  Add a size limit for upstream artifacts simon chrzanowski 2026-10-14 08:39:12 +02:00
• aa0b543ae8
  Stop forwarding custom auth headers across redirects simon chrzanowski 2026-10-14 08:38:51 +02:00
• 832c800ea5
  Serve diff2html from the proxy instead of jsDelivr simon chrzanowski 2026-10-14 08:37:43 +02:00
• f5e7599749
  Stop interpolating archive paths into inline handlers simon chrzanowski 2026-10-14 08:37:40 +02:00
• 03c8e680cc
  Withhold Composer archives still in cooldown simon chrzanowski 2026-10-14 08:37:39 +02:00
• d7a6a891e3
  Abort blob writes when the download fails simon chrzanowski 2026-10-14 08:36:21 +02:00
• 329780050f Enable storage retention for deb Christian Heim 2026-10-11 01:12:41 +02:00
• b0570bdf9d Mirroring a tag now checks it with a HEAD first and reuses the cached manifest when the digest is unchanged, falls back to the cached tag when the upstream body is cut off, and keeps a tag that a client pull moved while the walk ran. The platform filter is checked across the whole image, so a nested index without the wanted platform no longer fails it, and a 304 for a per-Accept fallback entry only refreshes that client's own keys instead of overwriting the shared entry. Christian Heim 2026-10-13 17:02:32 +02:00
• 42df87e035 Forward data tiles without storing them. The go command never fetches them, and kept for good they would add up to the whole log; the record count check from before is no longer needed. Christian Heim 2026-10-13 16:23:12 +02:00
• e3cdf73a89 Wait for the clock to move on in the fresh-tree test, since on Windows the first probe's success and the start of the lookup can get the same time. Christian Heim 2026-10-12 23:08:08 +02:00
• c2ab81031e Move upstream.go_sumdbs_offline next to upstream.go in the configuration table. Christian Heim 2026-10-12 22:35:23 +02:00
• 5332f1f5e0 Don't count a tree fresh in the cache as the database answering. The probe never asked it, and during an outage that kept lookups from remembering the failure, so offline mode waited for the upstream timeout on every request until the tree expired. Christian Heim 2026-10-12 22:35:23 +02:00
• 943009c669 Check that a data tile holds W records before caching it. Complete tiles are never fetched again, so a block page cached as one stayed for good. Christian Heim 2026-10-12 22:35:20 +02:00
• 9532c6a94e Add upstream.go_sumdbs_offline for networks where only the proxy has egress Christian Heim 2026-10-10 17:55:04 +02:00
• c7f8e2fc64 README: say when the go command still goes to the database itself Christian Heim 2026-10-10 11:31:01 +02:00
• 1b20307e81 Test the probe timeout, the block pages and a damaged cached tile Christian Heim 2026-10-10 11:31:01 +02:00
• c1a597d2d8 Don't let the supported check hang, and don't take a block page for an answer Christian Heim 2026-10-10 11:31:01 +02:00
• f47dd2f91c Say that the 4 KiB limit on 404 text only applies with the metadata cache Christian Heim 2026-10-10 10:19:46 +02:00
• 9a93ce05b4 Check tile sizes before caching them Christian Heim 2026-10-10 10:19:39 +02:00
• e6aadb297c Only claim checksum database support when the database is reachable Christian Heim 2026-10-10 10:18:40 +02:00
• 9eb88e499f Document upstream.go_sumdbs Christian Heim 2026-10-10 09:57:43 +02:00
• 1c6cfae813 Serve the Go checksum database from its own URL Christian Heim 2026-10-10 09:57:43 +02:00
• 0ce007fdea
  Merge pull request #436 from pinguinfuss/issue-263-arch-pacman Andrew Nesbitt 2026-10-13 13:30:55 +01:00
• 00e812421b
  Merge pull request #439 from simonchrz/feature/failure-details Andrew Nesbitt 2026-10-13 13:28:41 +01:00
• 9a6b467412
  Merge pull request #446 from pinguinfuss/issue-306-retention-nuget Andrew Nesbitt 2026-10-13 13:22:28 +01:00
• ff2c9cf37f
  Merge pull request #450 from pinguinfuss/issue-306-retention-gem Andrew Nesbitt 2026-10-13 13:21:32 +01:00
• c96b4a955b
  Merge pull request #452 from pinguinfuss/issue-306-retention-hex Andrew Nesbitt 2026-10-13 13:19:53 +01:00
• 131ebc4b68
  Merge pull request #454 from pinguinfuss/issue-306-retention-conda Andrew Nesbitt 2026-10-13 13:19:19 +01:00
• a23ced2ef0
  Merge pull request #459 from gilesw/feat/generic-builtin-artifacts Andrew Nesbitt 2026-10-13 13:18:27 +01:00
• 73d82bd78a
  Separate artifact and metadata cache metrics on /metrics and the analytics page abhinavgautam01 2026-10-13 14:33:12 +05:30
• 9d0175b1e2 Try configured generic_artifacts before built-in patterns Giles Westwood 2026-10-12 19:22:42 +01:00
• 854182fa28 Concurrent clients could still end up with a database and a signature that don't belong together. Databases are now stored under their digest like signatures, so a cache row and its bytes always agree, also with several replicas on shared storage. Writes for one database are serialized, and the signature recovery shares the refresh with database requests, so a slow fetch can no longer store an older database over a newer one. When the cache write fails, the proxy serves the database the cache still describes. Unchanged databases are no longer rewritten, and a remembered missing signature is asked for again after the metadata TTL. The new tests force these interleavings with storage and upstream hooks. Christian Heim 2026-10-12 20:06:59 +02:00
• c58cdaece9 Refuse conda rules with more than a channel and a name Christian Heim 2026-10-12 19:59:35 +02:00
• c3c120401c Fix hex tarballs whose version contains a hyphen Christian Heim 2026-10-12 19:57:57 +02:00
• bffba28262 Enable storage retention for conda Christian Heim 2026-10-10 23:37:32 +02:00
• 743fbe5026 Enable storage retention for hex Christian Heim 2026-10-10 23:28:13 +02:00
• 5d7855ffc8 Store mirrored NuGet ids lowercased Christian Heim 2026-10-12 19:56:38 +02:00
• 680a2daba1 Fix gem filenames whose platform ends in a number Christian Heim 2026-10-12 19:55:10 +02:00
• 093ae8295e
  Merge pull request #445 from pinguinfuss/issue-306-retention-swift Andrew Nesbitt 2026-10-12 17:44:37 +01:00
• b131db394d Isolate the recent failure history in tests Simon Chrzanowski 2026-10-12 18:44:12 +02:00
• 7cb05b4cf6
  Merge pull request #455 from pinguinfuss/issue-306-retention-conan Andrew Nesbitt 2026-10-12 16:37:08 +01:00
• 4273a308f7
  Merge pull request #420 from simonchrz/metadata-validators Andrew Nesbitt 2026-10-12 16:36:57 +01:00
• f8ca190274
  Enable storage retention for swift Christian Heim 2026-10-11 01:34:46 +02:00
• 9f75e05e8c
  Merge pull request #447 from pinguinfuss/issue-306-retention-julia Andrew Nesbitt 2026-10-12 16:32:53 +01:00
• 4958f22e46
  Merge pull request #448 from pinguinfuss/issue-306-retention-rpm Andrew Nesbitt 2026-10-12 16:31:35 +01:00
• ff4d5ca10d
  Enable storage retention for conan Christian Heim 2026-10-11 18:01:15 +02:00
• 4256aac92c
  Merge pull request #449 from pinguinfuss/issue-306-retention-helm Andrew Nesbitt 2026-10-12 16:29:24 +01:00
• f8c234fe1a
  Merge pull request #451 from pinguinfuss/issue-306-retention-pub Andrew Nesbitt 2026-10-12 16:29:18 +01:00
• 3c1c118fd9
  Merge pull request #453 from pinguinfuss/issue-306-retention-cran Andrew Nesbitt 2026-10-12 16:29:11 +01:00
• e20aff6649
  Merge pull request #456 from pinguinfuss/issue-306-retention-composer Andrew Nesbitt 2026-10-12 16:28:42 +01:00
• 9c75e59ef4
  Enable storage retention for composer Christian Heim 2026-10-11 00:25:33 +02:00
• c0f710f267
  Merge pull request #457 from pinguinfuss/issue-306-retention-cargo Andrew Nesbitt 2026-10-12 16:22:40 +01:00
• 70ea9215c6
  Enable storage retention for cargo Christian Heim 2026-10-10 22:10:31 +02:00
• adf844cb26
  Merge pull request #458 from pinguinfuss/issue-306-retention-alpine Andrew Nesbitt 2026-10-12 16:14:14 +01:00
• 59f0203b00 When a signature has to be fetched on request because its fetch failed during the database refresh, it is now only served if it belongs to the database the proxy had cached at that point. If the upstream has published a new database in the meantime, the request fails with 502 instead of handing out a signature that cannot verify the database the client already has. The next sync gets the new pair. Christian Heim 2026-10-12 17:08:17 +02:00
• fdd0c814eb Build in version-pinned paths for well-known download hosts Giles Westwood 2026-10-12 15:39:23 +01:00
• 9f42425646
  Test upgrading cached metadata through the metadata_dates migration simon chrzanowski 2026-10-12 16:11:49 +02:00
• dcfb9a820d Enable storage retention for nuget Christian Heim 2026-10-10 22:55:09 +02:00
• 42f459e961 Enable storage retention for rpm Christian Heim 2026-10-11 01:21:03 +02:00
• 48edbb8ba0 Enable storage retention for pub Christian Heim 2026-10-10 23:15:44 +02:00
• 20855cae21 Enable storage retention for gem Christian Heim 2026-10-10 23:51:55 +02:00
• 8f30c6d478 Enable storage retention for julia Christian Heim 2026-10-11 01:38:14 +02:00
• f3505ad557 Enable storage retention for helm Christian Heim 2026-10-11 01:55:16 +02:00
• 054c45c5a7
  Share the dates of rewritten metadata across replicas Simon Chrzanowski 2026-10-12 12:52:02 +02:00
• 599b2e1473
  Add a metadata_dates table for rewritten metadata dates Simon Chrzanowski 2026-10-12 12:52:02 +02:00
• cff4b5188d
  Date rewritten metadata by when its package started serving it Simon Chrzanowski 2026-10-12 07:07:03 +02:00
• 8903a8c9c9
  Date rewritten metadata by when the rewrite was made Simon Chrzanowski 2026-10-10 13:47:39 +02:00
• bf7d17d39a
  Derive cooldown metadata ETags from the rewrite's inputs simon chrzanowski 2026-10-09 08:10:41 +02:00
• 4f680ddbd0
  Send ETag and Last-Modified with rewritten npm and Composer metadata simon chrzanowski 2026-10-08 13:26:55 +02:00
• 6e334b4c42
  npm: version lookup returns 502 (#419) Ondrej Kokes 2026-10-12 14:45:34 +02:00
• 1a70c962be gocognit Ondrej Kokes 2026-10-12 14:40:08 +02:00
• ca0a442497 package not found -> version not found Ondrej Kokes 2026-10-12 14:24:10 +02:00
• 4b8678c2c5
  Enable storage retention for npm (#440) Christian Heim 2026-10-12 14:21:38 +02:00
• 4f86688fa7
  Merge main and resolve retention documentation conflict Andrew Nesbitt 2026-10-12 13:14:16 +01:00
• 9357abf9f4 Merge branch 'main' into kokes/npm-version-lookup-502 Ondrej Kokes 2026-10-12 14:11:01 +02:00
• 35a720e470 honor cooldown in version lookups Ondrej Kokes 2026-10-12 14:08:26 +02:00
• 18f410d021
  Enable storage retention for pypi (#441) Christian Heim 2026-10-12 14:06:37 +02:00
• c61cb51a0e
  Enable storage retention for golang (#442) Christian Heim 2026-10-12 14:04:16 +02:00
• b40a3f067a
  Enable storage retention for oci (#443) Christian Heim 2026-10-12 14:00:57 +02:00
• 90989eb030
  Enable storage retention for maven (#444) Christian Heim 2026-10-12 13:58:09 +02:00
• 496f272fed
  List recent failures under each failure count on /ui/analytics Simon Chrzanowski 2026-10-12 09:41:42 +02:00
• 3b262f101b
  Record the detail behind each failure counter Simon Chrzanowski 2026-10-12 09:41:42 +02:00
• 086abebe6e A database refresh now fetches the signature as well and stores it for that exact database content, keyed by its digest. A signature requested later, after the upstream has moved on, is still the one for the database the client got, and a refresh that returns the same bytes keeps the cached signature, so it is served offline too. The database is fetched once more after its signature to catch a mirror that swapped both in between. A missing signature is remembered per database, so official repos answer 404 without going upstream. Christian Heim 2026-10-12 10:59:22 +02:00
• 67fd1ad6c1 The mirror now resolves a tag without caching it, mirrors the image it points to, and stores the tag only once that image is complete, so a failed or interrupted mirror keeps the previously cached tag instead of pointing it at an image with missing layers. Christian Heim 2026-10-12 10:36:51 +02:00
• 5b9a5fca6b When the shared tag entry holds a representation the client does not accept, the lookup now goes on to the client's own per-Accept entry instead of giving up, so a Docker-only client still gets its cached manifest list after an OCI index was cached for the same tag. Christian Heim 2026-10-12 10:29:12 +02:00
• 546550587b Mention repeated separators in the pypi rule note Christian Heim 2026-10-10 18:00:14 +02:00
• 7694e023a5 Enable storage retention for golang Christian Heim 2026-10-10 21:03:23 +02:00
• ccb0935f9a Enable storage retention for oci Christian Heim 2026-10-11 00:45:58 +02:00
• 72e986d912 Enable storage retention for maven Christian Heim 2026-10-10 18:02:49 +02:00
• 42b4303b71 Enable storage retention for cran Christian Heim 2026-10-11 01:50:16 +02:00
• 1d88be53ab Enable storage retention for alpine Christian Heim 2026-10-11 01:07:07 +02:00