mirrors/pkg-proxy
Watch
1
0
Fork
You've already forked pkg-proxy
 1
mirror of https://github.com/git-pkgs/proxy.git synced 2026-08-23 04:14:57 -04:00
Code Issues Releases Packages Wiki Activity
301 commits 31 branches 12 tags 3 MiB
Commit graph

301 commits

This branch
This branch
All branches
Author SHA1 Message Date
Andrew Nesbitt
0a64d9ad9a
 		Address review: upstream-hash refetch and cache PURL cleanup 
- Re-fetch instead of 502 when a cached artifact's hash disagrees with
  the upstream-declared checksum; log and discard the stale entry.
- Rename expectedHash to upstreamHash and document how the check
  differs from checkCache's stream integrity verification.
- Drop the repository_url qualifier from swift cache PURLs so cache
  entries survive an upstream.swift change, matching other ecosystems.
- Pass name to handleSourceArchiveHead instead of re-deriving it.
 2026-08-20 09:18:05 +01:00
Andrew Nesbitt
7f04f4faac
 		Use stored PURLs for cache lookups 2026-08-20 09:03:14 +01:00
Andrew Nesbitt
535617197d
 		Handle Swift registry cache identities 2026-08-20 09:01:33 +01:00
Andrew Nesbitt
92cae1e1e7
 		Canonicalize Swift package identifiers 2026-08-20 09:00:20 +01:00
Andrew Nesbitt
53f2fee3c3
 		Fix Swift registry pagination and archive HEAD requests 2026-08-20 09:00:20 +01:00
Andrew Nesbitt
0af8d6b654
 		Fix Swift archive integrity handling 2026-08-20 09:00:20 +01:00
Andrew Nesbitt
38264bdd65
 		Add Swift package registry support 2026-08-20 09:00:19 +01:00
Andrew Nesbitt
5cdbc89ed4
 		Remove supporting-module-issues.md 2026-08-20 08:29:51 +01:00
Andrew Nesbitt
1a814c7e1f
 		Use shared integrity verification (#260) 
* Use shared integrity verification

* Finish integrity migration
 2026-08-17 09:20:11 +01:00
Andrew Nesbitt
12ad4ecefc
 		Bump github.com/git-pkgs/purl to v0.1.17 (#273) 
MakePURL/MakePURLString/New now apply the same per-type normalization as
Parse (git-pkgs/purl#30), so canonicalPackagePURL no longer needs its own
Normalize call and DB writes/lookups produce canonical keys.

Existing rows written under a non-canonical purl (mixed-case pypi,
composer, etc) become cache misses on lookup and re-populate under the
canonical key on the next fetch; the old rows are left in place.

Closes #207
 2026-08-17 08:36:20 +01:00
Andrew Nesbitt
f0e6e11e8c
 		Upgrade to Go 1.26.6 (#246) 
* Upgrade to Go 1.26.5

* Use go.mod to select Go 1.26.6
 2026-08-16 18:22:26 +01:00
Abhinav Gautam
088027cac3
 		feat: add Helm repository proxy support (#268) 
* feat: add Helm repository proxy support

* fix(helm): address review feedback

* fix(helm): serve cached charts without index
 2026-08-16 18:12:55 +01:00
Andrew Nesbitt
49a68f1d81
 		Record proxy request metrics (#270) 2026-08-16 18:12:03 +01:00
Andrew Nesbitt
e4fbf3f277
 		Add JSONL access logging (#269) 
* Add JSONL access logging

* Initialize access log before server dependencies
 2026-08-16 18:07:39 +01:00
Andrew Nesbitt
879e89efca
 		Correct cache metrics (#272) 2026-08-16 18:01:59 +01:00
Andrew Nesbitt
87bf742237
 		Document package support issue drafts 2026-08-15 22:42:58 +01:00
joyheroes
78b29e5a21
 		fix: cache PyPI metadata for filtered versions (#258) 
Co-authored-by: dindin <dindin@DMBA.local>
 2026-08-15 09:59:53 +01:00
Andrew Nesbitt
3e534690d7
 		Bump git-pkgs dependencies (#253) v0.7.0 2026-08-14 12:17:14 +01:00
Andrew Nesbitt
41c033a1e8
 		Bump google.golang.org/protobuf from 1.36.11 to 1.36.12 (#252) 2026-08-14 11:44:00 +01:00
wickedOne
849500de1e
 		fix: decode PURL percent-encoding in versions and package paths (#244) 
* fix: decode PURL percent-encoding in versions and package paths

* review fix
 2026-08-14 10:38:08 +01:00
dependabot[bot]
ed540053fa
 		Bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 (#251) 
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.6.1 to 0.6.2.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](6fc4b00623...3dc1ecc9bc)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.6.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-14 09:15:33 +01:00
Andrew Nesbitt
6fcc57c994
 		Optimize cached artifact serving (#245) 2026-08-13 08:06:41 +01:00
Andrew Nesbitt
538a15d9f8
 		fix(container): serve cached images when upstream is unavailable (#199) 
* container: cache manifests for offline pulls

* Preserve direct-serve redirects for blob HEAD requests
 2026-08-13 07:35:07 +01:00
Andrew Nesbitt
bbea63f046
 		fix(upstream): apply authentication through shared transport (#198) 
* upstream: apply authentication through shared transport

* Address upstream authentication review findings
 2026-08-13 07:08:23 +01:00
Andrew Nesbitt
a17bdc7c89
 		Sign published container images (#227) 
* Sign published container images

* Attest per-platform SPDX SBOMs with cosign

Extract each platform's SPDX document from the BuildKit SBOM attestation
and sign it as a cosign spdxjson attestation against the manifest-list
digest, so downstream consumers (e.g. Kyverno image-verification policies)
can verify the predicate signature rather than relying on the unsigned
BuildKit attachment.
 2026-08-10 16:42:52 +01:00
Andrew Nesbitt
30e4052615
 		Document upstream.debian in README and config.example.yaml (#237) 
Follow-up to #229 which added the config key and env var but didn't
touch docs.
 2026-08-10 09:34:56 +01:00
oscar-broman
4fa903e01e
 		Enforce cooldown on artifact downloads (#240) 
Cooldown filtering only ran when rewriting metadata, so a version could
be missing from the npm packument and the PyPI simple index while its
tarball stayed reachable. Lockfiles record artifact URLs verbatim, so
npm ci and pinned pip requirements reach handleDownload without ever
requesting metadata.

The shared artifact path has no publish time to check against, since
updateCacheDB upserts versions without PublishedAt and the column is
only set by enrichment. Each handler now resolves the publish time from
metadata it already fetches and returns 404 while a version is inside
the window. Versions with no usable publish time are still served, as
they are when filtering metadata.
 2026-08-10 09:27:03 +01:00
Philipp Garbe
14f80ced34
 		fix(npm): use combined Accept header to support Artifactory upstreams (#241) 
When cooldown is disabled, send:
  Accept: application/vnd.npm.install-v1+json;q=1.0, application/json;q=0.8

This allows upstreams like JFrog Artifactory that return 406 for the
abbreviated packument type to fall back to full JSON metadata, while
letting the public npm registry continue to serve the smaller
abbreviated format it prefers.

When cooldown is enabled, keep sending only application/json because
the abbreviated format omits the "time" map required for version age
filtering.

Fixes #228

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-08-10 09:21:49 +01:00
Andrew Nesbitt
d0f93196a3
 		Bump dependencies ahead of v0.7.0 (#235) v0.6.1 
- github.com/git-pkgs/archives v0.4.0 -> v0.5.0
- github.com/git-pkgs/magic v0.1.0 -> v0.2.0
- github.com/git-pkgs/spdx v0.1.4 -> v0.3.0
- github.com/prometheus/client_golang v1.24.0 -> v1.24.1
- modernc.org/sqlite v1.55.0 -> v1.56.0
- golang.org/x/text v0.38.0 -> v0.40.0 (fixes GO-2026-5970)
 2026-08-06 22:14:51 +01:00
Ondrej Kokes
bc1ea307f3
 		Multi-platform build (linux/amd64 and linux/arm64) (#230) 
* wip

* pin to latest version, not commit

* test run

* Revert "test run"

This reverts commit 355e8f867e.
 2026-08-06 22:03:20 +01:00
dependabot[bot]
5f993e3961
 		Bump docker/login-action from 4.5.0 to 4.6.0 (#232) 
Bumps [docker/login-action](https://github.com/docker/login-action) from 4.5.0 to 4.6.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](06fb636fac...dbcb813823)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-08-06 21:59:52 +01:00
Vincent Palatin
800ffc6b38
 		Make Debian upstream repository configurable. (#229) 
* Refactor LoadFromEnv to use helpers

Avoid triggering the linter about the cyclomatic complexity of the LoadFromEnv
function in later changes by refactoring it to use setEnvString/setEnvBool
helpers.

No functional change, just collapse ~29 repetitive if-blocks into single-line
calls to two small helpers.

* Make Debian upstream repository configurable

Support overriding the Debian handler's upstream (e.g. Ubuntu archives)
via PROXY_UPSTREAM_DEBIAN or upstream.debian in the config file.

Tested with PROXY_UPSTREAM_DEBIAN=http://archive.ubuntu.com/ubuntu
to get Ubuntu Resolute packages.
 2026-08-05 17:48:00 +01:00
wickedOne
63f0efd0e9
 		fix(pypi): resolve name and version for PEP 658 metadata sidecars (#222) 
* resolve name and version for PEP 658 metadata sidecars

* fix(pypi): parse Windows installer and egg filenames separately

The bdist_wininst and bdist_msi layout joins the platform to the version
with a '.' rather than a '-', so treating .exe/.msi like a wheel folded
the platform into the version: foo-1.0.win32-py2.0.exe resolved to
version "1.0.win32". Eggs shared the problem, as setuptools' hyphen
escaping is not universal: aws-sdk-1.0.0-py3.11.egg resolved to name
"aws", version "sdk".

Give each format its own parser. Wheels keep the PEP 427
spec-guaranteed field positions, eggs locate the version relative to the
py{X.Y} interpreter field, and Windows installers strip the platform and
interpreter fields before splitting name from version.

A PEP 658 sidecar resolves to the same name and version as the
distribution it describes, so it is cached under that version. Browse and
compare took the first cached artifact without checking its extension,
handing openArchive plain text: a version pip had only fetched metadata
for reported hasCached and then 500'd.

Add firstBrowsableArtifact, replacing five duplicated selection loops,
and export PyPIMetadataSuffix so the suffix has a single definition.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
 2026-08-03 11:14:03 +01:00
Andrew Nesbitt
a7cad7828d
 		Merge pull request #224 from git-pkgs/magic-integration 
Detect content types when browsing files
 2026-08-01 11:26:51 +01:00
Andrew Nesbitt
7dbf13e345
 		Avoid repeated content type path lookup 2026-08-01 11:22:13 +01:00
Andrew Nesbitt
36f3a51c65
 		Detect content types when browsing files 2026-07-31 17:04:01 +01:00
dependabot[bot]
9a9a82176d
 		Bump modernc.org/sqlite from 1.54.0 to 1.55.0 (#219) 
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.54.0 to 1.55.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md)
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.54.0...v1.55.0)

---
updated-dependencies:
- dependency-name: modernc.org/sqlite
  dependency-version: 1.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-31 09:32:38 +01:00
dependabot[bot]
31ecca8cf1
 		Bump github.com/prometheus/client_golang from 1.23.2 to 1.24.0 (#221) 
Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.23.2 to 1.24.0.
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.24.0/CHANGELOG.md)
- [Commits](https://github.com/prometheus/client_golang/compare/v1.23.2...v1.24.0)

---
updated-dependencies:
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-31 09:31:21 +01:00
dependabot[bot]
1057ee926e
 		Bump zizmorcore/zizmor-action from 0.6.0 to 0.6.1 (#217) 
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action) from 0.6.0 to 0.6.1.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases)
- [Commits](6599ee8b7a...6fc4b00623)

---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
  dependency-version: 0.6.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-30 17:55:16 +01:00
dependabot[bot]
b56a1fed65
 		Bump docker/login-action from 4.4.0 to 4.5.0 (#220) 
Bumps [docker/login-action](https://github.com/docker/login-action) from 4.4.0 to 4.5.0.
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](af1e73f918...06fb636fac)

---
updated-dependencies:
- dependency-name: docker/login-action
  dependency-version: 4.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-30 17:52:35 +01:00
dependabot[bot]
a5d456790d
 		Bump actions/checkout from 7.0.0 to 7.0.1 (#218) 
Bumps [actions/checkout](https://github.com/actions/checkout) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](9c091bb21b...3d3c42e5aa)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-30 17:14:36 +01:00
dependabot[bot]
90422697b8
 		Bump google.golang.org/grpc from 1.81.1 to 1.82.1 (#216) v0.6.0 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.81.1 to 1.82.1.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.1)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.82.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-07-27 12:16:27 +01:00
Andrew Nesbitt
44041d07a9
 		Bump git-pkgs archives, enrichment, purl, registries, vulns (#215) 2026-07-27 12:15:57 +01:00
Andrew Nesbitt
cf3741162f
 		fix(upstream): honor npm and Cargo overrides (#200) 
* fix(upstream): honor npm and cargo overrides

* Preserve npm scope separators in download URLs

* Apply upstream auth to metadata requests
 2026-07-26 19:11:24 +01:00
Tilian Honig
532e4925fe
 		fix: proper handling of upstream registry 404s (#209) 
* fix: proper handling of upstream registry 404s

* fix: consistently return 404s for all artifact types
 2026-07-26 19:07:46 +01:00
Andrew Nesbitt
6b767d0128
 		Merge pull request #211 from git-pkgs/dependabot/go_modules/github.com/git-pkgs/vers-0.3.0 
Bump github.com/git-pkgs/vers from 0.2.6 to 0.3.0
 2026-07-23 17:01:32 +01:00
Andrew Nesbitt
4737777e80
 		Merge pull request #212 from git-pkgs/dependabot/github_actions/zizmorcore/zizmor-action-0.6.0 
Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0
 2026-07-23 16:52:51 +01:00
Andrew Nesbitt
238c628b31
 		Merge pull request #213 from git-pkgs/dependabot/go_modules/modernc.org/sqlite-1.54.0 
Bump modernc.org/sqlite from 1.53.0 to 1.54.0
 2026-07-23 16:47:03 +01:00
Andrew Nesbitt
ced9c1198b
 		Merge pull request #210 from git-pkgs/dependabot/github_actions/actions/setup-go-7.0.0 
Bump actions/setup-go from 6.5.0 to 7.0.0
 2026-07-23 16:45:51 +01:00
dependabot[bot]
13ae3970e9
 		Bump github.com/git-pkgs/vers from 0.2.6 to 0.3.0 
Bumps [github.com/git-pkgs/vers](https://github.com/git-pkgs/vers) from 0.2.6 to 0.3.0.
- [Commits](https://github.com/git-pkgs/vers/compare/v0.2.6...v0.3.0)

---
updated-dependencies:
- dependency-name: github.com/git-pkgs/vers
  dependency-version: 0.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-07-23 15:42:03 +00:00