mirrors/pkg-proxy
Watch
1
0
Fork
You've already forked pkg-proxy
 1
mirror of https://github.com/git-pkgs/proxy.git synced 2026-11-09 23:59:16 -05:00
Code Issues Releases Packages Wiki Activity
pkg-proxy/internal/server
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
simon chrzanowski 1979fb098e
 Accept Swift source repository PURLs in the denylist and retention rules (#641) 
* Accept Swift source repository PURLs in the denylist and retention rules

Closes #613. pkg:swift/github.com/apple/swift-nio, as SBOM tools and GHSA
write Swift packages, is resolved to its registry identity through the
upstream's /identifiers:

- Denylist entries are resolved at startup, and the proxy refuses to start
  when one can't be, since a skipped entry would let the version through.
- Retention keys are accepted at validation and kept pending. The
  retention loop resolves them before each sweep, and Swift isn't swept
  while any is pending, so a rule that keeps a package is never skipped.

The mirror's source URL helper moves to the handler as SwiftSourceURL.

* Resolve Swift source denylist entries in proxy mirror too

serve resolved source-form Swift denylist entries through the upstream,
but proxy mirror built its denylist directly, so such an entry never
matched a mirror download. Both now use server.ConfigureDenylist, and
neither runs when an entry can't be resolved.

* Apply Swift source policies to every listed identity

A Swift registry may list several identities for one source repository,
but a denylist entry or retention rule naming the repository only
covered the first. Denying pkg:swift/github.com/acme/widget@1.0.0 let
acme.widget through when the registry listed other.widget first, and a
never-evict rule cleared the cached apple.swift-nio archive when
other.swift-nio came first.

Both now cover every identity the registry lists. A retention rule that
conflicts with another rule for any of them stays pending, with none
applied. Mirroring a source PURL still downloads the first identity.
2026-10-31 11:34:05 +00:00
..
static Delete cached artifacts through the API and the UI (#491) 2026-10-20 11:35:08 +01:00
templates Show cooldown only for ecosystems that apply it 2026-10-28 16:25:08 +01:00
analytics.go Separate artifact and metadata cache metrics on /metrics and the analytics page (#463) 2026-10-20 11:25:33 +01:00
analytics_coverage_test.go Separate artifact and metadata cache metrics on /metrics and the analytics page (#463) 2026-10-20 11:25:33 +01:00
analytics_donut.go Add the /ui/analytics page 2026-10-01 16:15:03 +02:00
analytics_donut_test.go Add the /ui/analytics page 2026-10-01 16:15:03 +02:00
analytics_failures_test.go Update x/net and remove unused production helpers 2026-10-19 08:35:46 +01:00
analytics_runtime.go Separate artifact and metadata cache metrics on /metrics and the analytics page (#463) 2026-10-20 11:25:33 +01:00
analytics_runtime_test.go Separate artifact and metadata cache metrics on /metrics and the analytics page (#463) 2026-10-20 11:25:33 +01:00
analytics_test.go Separate artifact and metadata cache metrics on /metrics and the analytics page (#463) 2026-10-20 11:25:33 +01:00
api.go Preserve Swift and Go compatibility when upgrading PURL (#642) 2026-10-31 09:49:35 +00:00
api_test.go Validate package paths before database lookups (#109) 2026-05-03 09:14:18 +01:00
breakers.go Report upstream circuit breaker state in /health and /metrics (#275) 2026-09-02 12:52:32 +01:00
breakers_test.go Share upstream rate-limit holds across instances 2026-10-25 17:34:08 +01:00
browse.go Refuse framing of the web UI 2026-10-24 07:48:08 +02:00
browse_archive.go Use shared archives browser for cached artifacts (#512) 2026-10-20 11:41:18 +01:00
browse_archive_test.go Use shared archives browser for cached artifacts (#512) 2026-10-20 11:41:18 +01:00
browse_bench_test.go Avoid repeated content type path lookup 2026-08-01 11:22:13 +01:00
browse_test.go Refuse framing of the web UI 2026-10-24 07:48:08 +02:00
cache_api.go Delete cached artifacts through the API and the UI (#491) 2026-10-20 11:35:08 +01:00
cache_api_test.go Delete cached artifacts through the API and the UI (#491) 2026-10-20 11:35:08 +01:00
cooldown_patterns_test.go Add cooldown package pattern overrides (#407) 2026-10-04 20:48:41 +01:00
cooldown_view.go Show cooldown only for ecosystems that apply it 2026-10-28 16:25:08 +01:00
cooldown_view_test.go Detect Helm's cooldown check in the handler coverage test 2026-10-30 08:36:39 +00:00
dashboard.go Show the cooldown configuration in the web UI 2026-10-27 13:03:42 +01:00
detached_fetch_test.go Give the detached fetch test time on slow runners 2026-10-14 18:14:06 +02:00
dot_segments_test.go Ignore path parameters when checking for dot segments 2026-10-23 09:47:07 +02:00
ecosystem_cache.go Separate artifact and metadata cache metrics on /metrics and the analytics page (#463) 2026-10-20 11:25:33 +01:00
ecosystem_cache_test.go Separate artifact and metadata cache metrics on /metrics and the analytics page (#463) 2026-10-20 11:25:33 +01:00
ecr_auth.go Add ECR auto-refreshing upstream authentication (#278) 2026-09-02 12:43:43 +01:00
ecr_auth_test.go Add ECR auto-refreshing upstream authentication (#278) 2026-09-02 12:43:43 +01:00
errors.go Require a JSON content type to start mirror jobs 2026-10-24 07:48:08 +02:00
errors_test.go Structured JSON error responses for API endpoints (#110) 2026-05-03 09:42:03 +01:00
eviction.go Merge main. Main now records UpsertArtifact and its queue entry in one transaction itself, so that part of this branch is gone; ClearArtifactCache, eviction and the unrecorded refetch remain, and an unrecorded refetch counts as failed for instances waiting on its lease. 2026-10-26 08:57:26 +01:00
eviction_metadata_test.go Count cached metadata against max_size and evict it LRU (#507) 2026-10-20 10:22:55 +01:00
eviction_test.go Merge main. Main now records UpsertArtifact and its queue entry in one transaction itself, so that part of this branch is gone; ClearArtifactCache, eviction and the unrecorded refetch remain, and an unrecorded refetch counts as failed for instances waiting on its lease. 2026-10-26 08:57:26 +01:00
exclusive.go Coordinate instances sharing a Postgres database 2026-10-23 16:15:24 +02:00
exclusive_test.go Coordinate instances sharing a Postgres database 2026-10-23 16:15:24 +02:00
git_test.go Serve Git repositories from a local cache (#492) 2026-10-21 11:47:16 +01:00
go_sumdbs_test.go Serve the Go checksum database from its own URL 2026-10-13 16:41:53 +02:00
go_vulndb_test.go Serve the Go vulnerability database at /go/vulndb 2026-10-27 16:16:04 +01:00
gradle_cache_eviction.go Merge pull request #572 from simonchrz/fix/flaky-tests 2026-10-24 11:33:34 +01:00
gradle_cache_eviction_test.go add Gradle Build Cache support with handler and tests (#87) 2026-05-04 11:15:16 +01:00
gradle_read_only_test.go Build with Go 1.27.3 everywhere 2026-10-23 09:57:37 +02:00
head_request_test.go Answer HEAD on a cached artifact without opening it 2026-10-25 17:27:05 +01:00
health.go Hold requests to an upstream that rate limits the proxy 2026-10-14 21:35:17 +01:00
health_test.go Widen wall-clock bound in flaky probe timeout test 2026-09-22 08:46:40 +01:00
helm_test.go fix(helm): support OCI references in HTTP repository indexes 2026-09-19 14:39:29 +05:30
hosted_api.go Never let a cache fill replace a pushed artifact 2026-10-21 12:24:04 +02:00
hosted_api_test.go Build with Go 1.27.3 everywhere 2026-10-23 09:57:37 +02:00
hosted_archives_test.go Read the package manifest of pushed archives 2026-10-14 13:23:19 +02:00
hosted_auth.go Add a hosted config block and a bearer token check for writes 2026-10-14 13:23:19 +02:00
hosted_auth_test.go Fix leftover /api/packages references to the hosted endpoints 2026-10-14 13:23:19 +02:00
layout.go Delete cached artifacts through the API and the UI (#491) 2026-10-20 11:35:08 +01:00
metadata_backfill.go Count cached metadata against max_size and evict it LRU (#507) 2026-10-20 10:22:55 +01:00
middleware.go Send artifacts to the client while a cache miss is stored 2026-10-25 20:31:06 +01:00
middleware_test.go Proxy FreeBSD pkg repositories at /freebsd/{name}/ 2026-10-22 12:36:27 +02:00
mirror_api.go Require a JSON content type to start mirror jobs 2026-10-24 07:48:08 +02:00
mirror_api_test.go Merge pull request #574 from simonchrz/fix/mirror-csrf-ui-framing 2026-10-24 11:35:18 +01:00
mirror_composer_test.go Mirror Composer releases 2026-10-25 14:36:43 +01:00
mirror_conda_test.go Mirror conda packages 2026-10-25 14:27:47 +01:00
mirror_cran_test.go Fetch archived CRAN versions unchecked and drop the version dedup 2026-10-28 15:17:49 +00:00
mirror_fetch_test.go Merge main into feat/mirror-julia 2026-10-26 10:33:01 +00:00
mirror_helm_test.go Mirror Helm charts 2026-10-25 19:37:22 +01:00
mirror_julia_test.go Mirror Julia packages 2026-10-25 19:37:46 +01:00
mirror_proxy_test.go proxy mirror and the mirror API now pre-fetch container images from pkg:docker and pkg:oci PURLs: the mirror walks index, platform manifests (with their attestations) and blobs through the container handler, so a later pull is served from cache even when the upstream is down. A --platform filter (platforms in the API) limits multi-arch images, repository_url only resolves to configured registries, and names, tags and digests are validated before anything is fetched. 2026-10-12 00:20:10 +02:00
mirror_pypi_test.go Check mirrored files against their own SHA-256 2026-10-25 14:25:35 +01:00
mirror_resolver.go Mirror packages from the configured upstreams 2026-10-22 16:06:56 +02:00
mirror_schedule.go Merge remote-tracking branch 'origin/main' into fix/mirror-upstream-versions 2026-10-24 19:18:21 +02:00
mirror_schedule_test.go Re-mirror container images on a schedule (#508) 2026-10-18 18:33:13 +01:00
mirror_swift_test.go Check cached Swift documents against their digest and resolve source PURLs 2026-10-26 16:43:42 +01:00
mirror_versions.go Mirror Homebrew bottles 2026-10-28 15:18:14 +00:00
mirror_versions_test.go Merge remote-tracking branch 'origin/main' into mirror-swift 2026-10-27 11:00:10 +01:00
oci_mirrors_test.go Route containerd ns mirror requests to configured registries (#405) 2026-10-10 07:35:50 +01:00
package_routes_test.go Add package routes for private Composer and npm registries (#426) 2026-10-11 18:06:18 +01:00
packages_list_page_test.go Filter cached packages by ecosystem using pills (#319) 2026-10-05 08:20:36 +01:00
packages_list_test.go Fix all golangci-lint issues across the codebase (#32) 2026-03-18 10:59:29 +00:00
query_in_path_test.go Ignore path parameters when checking for dot segments 2026-10-23 09:47:07 +02:00
reclaim.go Fetch each cache miss once across instances 2026-10-23 16:54:54 +02:00
reclaim_test.go Clear before deleting on eviction, and requeue failed reclaims 2026-09-29 10:24:22 -07:00
registry_policies_test.go Share upstream rate-limit holds across instances 2026-10-25 17:34:08 +01:00
relay_test.go fix: centralize pass-through response relaying 2026-09-26 15:44:28 +05:30
request_timeouts_test.go Make response write and artifact download timeouts configurable (#531) 2026-10-19 08:54:21 +01:00
resolve.go fix: decode PURL percent-encoding in versions and package paths (#244) 2026-08-14 10:38:08 +01:00
resolve_test.go fix: decode PURL percent-encoding in versions and package paths (#244) 2026-08-14 10:38:08 +01:00
retention.go Accept Swift source repository PURLs in the denylist and retention rules (#641) 2026-10-31 11:34:05 +00:00
retention_alpine_test.go Enable storage retention for alpine 2026-10-12 10:23:27 +02:00
retention_cargo_test.go Enable storage retention for cargo 2026-10-12 16:16:22 +01:00
retention_composer_test.go Enable storage retention for composer 2026-10-12 16:23:36 +01:00
retention_conan_test.go Enable storage retention for conan 2026-10-12 16:29:59 +01:00
retention_conda_test.go Cache conda packages per subdir 2026-10-22 20:42:17 +02:00
retention_cran_test.go Enable storage retention for cran 2026-10-12 10:23:27 +02:00
retention_deb_test.go Enable storage retention for deb 2026-10-13 20:08:24 +02:00
retention_gem_test.go Enable storage retention for gem 2026-10-12 15:24:20 +02:00
retention_generic_test.go Add opt-in retention for generic artifacts (#513) 2026-10-19 08:43:57 +01:00
retention_golang_test.go Preserve Swift and Go compatibility when upgrading PURL (#642) 2026-10-31 09:49:35 +00:00
retention_helm_test.go Enable storage retention for helm 2026-10-12 15:24:20 +02:00
retention_hex_test.go Enable storage retention for hex 2026-10-12 19:56:45 +02:00
retention_julia_test.go Enable storage retention for julia 2026-10-12 15:24:20 +02:00
retention_maven_test.go Enable storage retention for maven (#444) 2026-10-12 12:58:09 +01:00
retention_npm_test.go Enable storage retention for npm (#440) 2026-10-12 13:21:38 +01:00
retention_nuget_test.go Store mirrored NuGet ids lowercased 2026-10-12 19:56:38 +02:00
retention_oci_test.go Enable storage retention for oci (#443) 2026-10-12 13:00:57 +01:00
retention_pub_test.go Enable storage retention for pub 2026-10-12 15:24:21 +02:00
retention_pypi_test.go Enable storage retention for pypi (#441) 2026-10-12 13:06:37 +01:00
retention_rpm_test.go Enable storage retention for rpm 2026-10-12 15:24:21 +02:00
retention_swift_test.go Accept Swift source repository PURLs in the denylist and retention rules (#641) 2026-10-31 11:34:05 +00:00
retention_test.go Add opt-in retention for generic artifacts (#513) 2026-10-19 08:43:57 +01:00
server.go Accept Swift source repository PURLs in the denylist and retention rules (#641) 2026-10-31 11:34:05 +00:00
server_test.go Use git-pkgs/enrichment for the enrichment API 2026-10-24 15:55:37 +02:00
sources.go Proxy FreeBSD pkg repositories at /freebsd/{name}/ 2026-10-22 12:36:27 +02:00
sources_test.go Proxy FreeBSD pkg repositories at /freebsd/{name}/ 2026-10-22 12:36:27 +02:00
static.go Add Container, Debian, RPM handlers and enrichment API 2026-01-29 19:35:15 +00:00
stats_test.go Report the per-ecosystem breakdown from GET /stats 2026-10-01 16:15:03 +02:00
swagger_gen.go Add pre-cache artifact scanning hook (trivy/ClamAV/Wiz/custom) (#298) 2026-09-03 10:06:44 +01:00
swift_sources.go Accept Swift source repository PURLs in the denylist and retention rules (#641) 2026-10-31 11:34:05 +00:00
swift_vulns_test.go Preserve Swift and Go compatibility when upgrading PURL (#642) 2026-10-31 09:49:35 +00:00
templates.go Filter cached packages by ecosystem using pills (#319) 2026-10-05 08:20:36 +01:00
templates_handlers_test.go Stop interpolating archive paths into inline handlers 2026-10-14 08:37:40 +02:00
templates_test.go Separate artifact and metadata cache metrics on /metrics and the analytics page (#463) 2026-10-20 11:25:33 +01:00
transport_test.go fix(server): tune the shared upstream transport defaults (#351) 2026-09-16 08:11:06 +01:00
untrusted_content_test.go Sandbox upstream content on package routes 2026-10-14 17:53:48 +02:00
upstream_auth_redirect_test.go Stop forwarding custom auth headers across redirects 2026-10-14 08:38:51 +02:00