Andrew Nesbitt
3e534690d7
Bump git-pkgs dependencies ( #253 )
2026-08-14 12:17:14 +01:00
Andrew Nesbitt
41c033a1e8
Bump google.golang.org/protobuf from 1.36.11 to 1.36.12 ( #252 )
2026-08-14 11:44:00 +01:00
wickedOne
849500de1e
fix: decode PURL percent-encoding in versions and package paths ( #244 )
...
* fix: decode PURL percent-encoding in versions and package paths
* review fix
2026-08-14 10:38:08 +01:00
dependabot[bot]
ed540053fa
Bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 ( #251 )
...
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ) from 0.6.1 to 0.6.2.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](6fc4b00623...3dc1ecc9bc
2026-08-14 09:15:33 +01:00
Andrew Nesbitt
6fcc57c994
Optimize cached artifact serving ( #245 )
2026-08-13 08:06:41 +01:00
Andrew Nesbitt
538a15d9f8
fix(container): serve cached images when upstream is unavailable ( #199 )
...
* container: cache manifests for offline pulls
* Preserve direct-serve redirects for blob HEAD requests
2026-08-13 07:35:07 +01:00
Andrew Nesbitt
bbea63f046
fix(upstream): apply authentication through shared transport ( #198 )
...
* upstream: apply authentication through shared transport
* Address upstream authentication review findings
2026-08-13 07:08:23 +01:00
Andrew Nesbitt
a17bdc7c89
Sign published container images ( #227 )
...
* Sign published container images
* Attest per-platform SPDX SBOMs with cosign
Extract each platform's SPDX document from the BuildKit SBOM attestation
and sign it as a cosign spdxjson attestation against the manifest-list
digest, so downstream consumers (e.g. Kyverno image-verification policies)
can verify the predicate signature rather than relying on the unsigned
BuildKit attachment.
2026-08-10 16:42:52 +01:00
Andrew Nesbitt
30e4052615
Document upstream.debian in README and config.example.yaml ( #237 )
...
Follow-up to #229 which added the config key and env var but didn't
touch docs.
2026-08-10 09:34:56 +01:00
oscar-broman
4fa903e01e
Enforce cooldown on artifact downloads ( #240 )
...
Cooldown filtering only ran when rewriting metadata, so a version could
be missing from the npm packument and the PyPI simple index while its
tarball stayed reachable. Lockfiles record artifact URLs verbatim, so
npm ci and pinned pip requirements reach handleDownload without ever
requesting metadata.
The shared artifact path has no publish time to check against, since
updateCacheDB upserts versions without PublishedAt and the column is
only set by enrichment. Each handler now resolves the publish time from
metadata it already fetches and returns 404 while a version is inside
the window. Versions with no usable publish time are still served, as
they are when filtering metadata.
2026-08-10 09:27:03 +01:00
Philipp Garbe
14f80ced34
fix(npm): use combined Accept header to support Artifactory upstreams ( #241 )
...
When cooldown is disabled, send:
Accept: application/vnd.npm.install-v1+json;q=1.0, application/json;q=0.8
This allows upstreams like JFrog Artifactory that return 406 for the
abbreviated packument type to fall back to full JSON metadata, while
letting the public npm registry continue to serve the smaller
abbreviated format it prefers.
When cooldown is enabled, keep sending only application/json because
the abbreviated format omits the "time" map required for version age
filtering.
Fixes #228
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-08-10 09:21:49 +01:00
Andrew Nesbitt
d0f93196a3
Bump dependencies ahead of v0.7.0 ( #235 )
...
- github.com/git-pkgs/archives v0.4.0 -> v0.5.0
- github.com/git-pkgs/magic v0.1.0 -> v0.2.0
- github.com/git-pkgs/spdx v0.1.4 -> v0.3.0
- github.com/prometheus/client_golang v1.24.0 -> v1.24.1
- modernc.org/sqlite v1.55.0 -> v1.56.0
- golang.org/x/text v0.38.0 -> v0.40.0 (fixes GO-2026-5970)
2026-08-06 22:14:51 +01:00
Ondrej Kokes
bc1ea307f3
Multi-platform build (linux/amd64 and linux/arm64) ( #230 )
...
* wip
* pin to latest version, not commit
* test run
* Revert "test run"
This reverts commit 355e8f867e
2026-08-06 22:03:20 +01:00
dependabot[bot]
5f993e3961
Bump docker/login-action from 4.5.0 to 4.6.0 ( #232 )
...
Bumps [docker/login-action](https://github.com/docker/login-action ) from 4.5.0 to 4.6.0.
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](06fb636fac...dbcb813823
2026-08-06 21:59:52 +01:00
Vincent Palatin
800ffc6b38
Make Debian upstream repository configurable. ( #229 )
...
* Refactor LoadFromEnv to use helpers
Avoid triggering the linter about the cyclomatic complexity of the LoadFromEnv
function in later changes by refactoring it to use setEnvString/setEnvBool
helpers.
No functional change, just collapse ~29 repetitive if-blocks into single-line
calls to two small helpers.
* Make Debian upstream repository configurable
Support overriding the Debian handler's upstream (e.g. Ubuntu archives)
via PROXY_UPSTREAM_DEBIAN or upstream.debian in the config file.
Tested with PROXY_UPSTREAM_DEBIAN=http://archive.ubuntu.com/ubuntu
to get Ubuntu Resolute packages.
2026-08-05 17:48:00 +01:00
wickedOne
63f0efd0e9
fix(pypi): resolve name and version for PEP 658 metadata sidecars ( #222 )
...
* resolve name and version for PEP 658 metadata sidecars
* fix(pypi): parse Windows installer and egg filenames separately
The bdist_wininst and bdist_msi layout joins the platform to the version
with a '.' rather than a '-', so treating .exe/.msi like a wheel folded
the platform into the version: foo-1.0.win32-py2.0.exe resolved to
version "1.0.win32". Eggs shared the problem, as setuptools' hyphen
escaping is not universal: aws-sdk-1.0.0-py3.11.egg resolved to name
"aws", version "sdk".
Give each format its own parser. Wheels keep the PEP 427
spec-guaranteed field positions, eggs locate the version relative to the
py{X.Y} interpreter field, and Windows installers strip the platform and
interpreter fields before splitting name from version.
A PEP 658 sidecar resolves to the same name and version as the
distribution it describes, so it is cached under that version. Browse and
compare took the first cached artifact without checking its extension,
handing openArchive plain text: a version pip had only fetched metadata
for reported hasCached and then 500'd.
Add firstBrowsableArtifact, replacing five duplicated selection loops,
and export PyPIMetadataSuffix so the suffix has a single definition.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-08-03 11:14:03 +01:00
Andrew Nesbitt
a7cad7828d
Merge pull request #224 from git-pkgs/magic-integration
...
Detect content types when browsing files
2026-08-01 11:26:51 +01:00
Andrew Nesbitt
7dbf13e345
Avoid repeated content type path lookup
2026-08-01 11:22:13 +01:00
Andrew Nesbitt
36f3a51c65
Detect content types when browsing files
2026-07-31 17:04:01 +01:00
dependabot[bot]
9a9a82176d
Bump modernc.org/sqlite from 1.54.0 to 1.55.0 ( #219 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.54.0 to 1.55.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.54.0...v1.55.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.55.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-31 09:32:38 +01:00
dependabot[bot]
31ecca8cf1
Bump github.com/prometheus/client_golang from 1.23.2 to 1.24.0 ( #221 )
...
Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang ) from 1.23.2 to 1.24.0.
- [Release notes](https://github.com/prometheus/client_golang/releases )
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.24.0/CHANGELOG.md )
- [Commits](https://github.com/prometheus/client_golang/compare/v1.23.2...v1.24.0 )
---
updated-dependencies:
- dependency-name: github.com/prometheus/client_golang
dependency-version: 1.24.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-31 09:31:21 +01:00
dependabot[bot]
1057ee926e
Bump zizmorcore/zizmor-action from 0.6.0 to 0.6.1 ( #217 )
...
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ) from 0.6.0 to 0.6.1.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](6599ee8b7a...6fc4b00623
2026-07-30 17:55:16 +01:00
dependabot[bot]
b56a1fed65
Bump docker/login-action from 4.4.0 to 4.5.0 ( #220 )
...
Bumps [docker/login-action](https://github.com/docker/login-action ) from 4.4.0 to 4.5.0.
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](af1e73f918...06fb636fac
2026-07-30 17:52:35 +01:00
dependabot[bot]
a5d456790d
Bump actions/checkout from 7.0.0 to 7.0.1 ( #218 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](9c091bb21b...3d3c42e5aa
2026-07-30 17:14:36 +01:00
dependabot[bot]
90422697b8
Bump google.golang.org/grpc from 1.81.1 to 1.82.1 ( #216 )
...
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go ) from 1.81.1 to 1.82.1.
- [Release notes](https://github.com/grpc/grpc-go/releases )
- [Commits](https://github.com/grpc/grpc-go/compare/v1.81.1...v1.82.1 )
---
updated-dependencies:
- dependency-name: google.golang.org/grpc
dependency-version: 1.82.1
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-27 12:16:27 +01:00
Andrew Nesbitt
44041d07a9
Bump git-pkgs archives, enrichment, purl, registries, vulns ( #215 )
2026-07-27 12:15:57 +01:00
Andrew Nesbitt
cf3741162f
fix(upstream): honor npm and Cargo overrides ( #200 )
...
* fix(upstream): honor npm and cargo overrides
* Preserve npm scope separators in download URLs
* Apply upstream auth to metadata requests
2026-07-26 19:11:24 +01:00
Tilian Honig
532e4925fe
fix: proper handling of upstream registry 404s ( #209 )
...
* fix: proper handling of upstream registry 404s
* fix: consistently return 404s for all artifact types
2026-07-26 19:07:46 +01:00
Andrew Nesbitt
6b767d0128
Merge pull request #211 from git-pkgs/dependabot/go_modules/github.com/git-pkgs/vers-0.3.0
...
Bump github.com/git-pkgs/vers from 0.2.6 to 0.3.0
2026-07-23 17:01:32 +01:00
Andrew Nesbitt
4737777e80
Merge pull request #212 from git-pkgs/dependabot/github_actions/zizmorcore/zizmor-action-0.6.0
...
Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0
2026-07-23 16:52:51 +01:00
Andrew Nesbitt
238c628b31
Merge pull request #213 from git-pkgs/dependabot/go_modules/modernc.org/sqlite-1.54.0
...
Bump modernc.org/sqlite from 1.53.0 to 1.54.0
2026-07-23 16:47:03 +01:00
Andrew Nesbitt
ced9c1198b
Merge pull request #210 from git-pkgs/dependabot/github_actions/actions/setup-go-7.0.0
...
Bump actions/setup-go from 6.5.0 to 7.0.0
2026-07-23 16:45:51 +01:00
dependabot[bot]
13ae3970e9
Bump github.com/git-pkgs/vers from 0.2.6 to 0.3.0
...
Bumps [github.com/git-pkgs/vers](https://github.com/git-pkgs/vers ) from 0.2.6 to 0.3.0.
- [Commits](https://github.com/git-pkgs/vers/compare/v0.2.6...v0.3.0 )
---
updated-dependencies:
- dependency-name: github.com/git-pkgs/vers
dependency-version: 0.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-07-23 15:42:03 +00:00
Andrew Nesbitt
7071d4fb0e
Merge pull request #214 from git-pkgs/dependabot/go_modules/github.com/git-pkgs/vulns-0.2.0
...
Bump github.com/git-pkgs/vulns from 0.1.6 to 0.2.0
2026-07-23 16:39:43 +01:00
dependabot[bot]
5ae5eab031
Bump github.com/git-pkgs/vulns from 0.1.6 to 0.2.0
...
Bumps [github.com/git-pkgs/vulns](https://github.com/git-pkgs/vulns ) from 0.1.6 to 0.2.0.
- [Commits](https://github.com/git-pkgs/vulns/compare/v0.1.6...v0.2.0 )
---
updated-dependencies:
- dependency-name: github.com/git-pkgs/vulns
dependency-version: 0.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-07-23 15:14:10 +00:00
dependabot[bot]
c3f1577017
Bump modernc.org/sqlite from 1.53.0 to 1.54.0
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.53.0 to 1.54.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.53.0...v1.54.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.54.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-07-23 15:14:01 +00:00
dependabot[bot]
d9b7a30294
Bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0
...
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ) from 0.5.7 to 0.6.0.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](192e21d79a...6599ee8b7a
2026-07-23 15:13:53 +00:00
dependabot[bot]
60c72be65e
Bump actions/setup-go from 6.5.0 to 7.0.0
...
Bumps [actions/setup-go](https://github.com/actions/setup-go ) from 6.5.0 to 7.0.0.
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](924ae3a1cd...b7ad1dad31
2026-07-23 15:13:49 +00:00
Andrew Nesbitt
0a3b9e58f2
Merge pull request #201 from git-pkgs/fix-197-cooldown-scoped-purls
...
Normalize cooldown package PURL overrides
2026-07-17 18:18:54 -07:00
Andrew Nesbitt
cdbd1a9369
Canonicalize cooldown lookup PURLs to match config
...
NormalizedPackages runs config keys through purl.Parse().String(), which
applies per-type rules like lowercasing pypi names. The handler side was
building lookup keys with MakePURLString, which does not, so a config
entry for pkg:pypi/Django would be normalized to pkg:pypi/django and
never match the runtime key pkg:pypi/Django.
Route both sides through the same canonical form: a new
canonicalPackagePURL helper calls Normalize() on the constructed PURL
before stringifying, and all cooldown IsAllowed call sites use it.
2026-07-17 18:11:47 -07:00
Andrew Nesbitt
785c989f12
Merge pull request #206 from git-pkgs/dependabot/go_modules/github.com/git-pkgs/enrichment-0.5.0
...
Bump github.com/git-pkgs/enrichment from 0.4.1 to 0.6.0
2026-07-17 10:23:03 -07:00
dependabot[bot]
41ef27907e
Bump github.com/git-pkgs/enrichment from 0.4.1 to 0.6.0
...
Bumps [github.com/git-pkgs/enrichment](https://github.com/git-pkgs/enrichment ) from 0.4.1 to 0.6.0.
- [Commits](https://github.com/git-pkgs/enrichment/compare/v0.4.1...v0.6.0 )
---
updated-dependencies:
- dependency-name: github.com/git-pkgs/enrichment
dependency-version: 0.5.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-07-17 15:20:18 +00:00
Andrew Nesbitt
95b4e34ebe
Merge pull request #204 from git-pkgs/dependabot/go_modules/github.com/git-pkgs/purl-0.1.14
...
Bump github.com/git-pkgs/purl from 0.1.13 to 0.1.14
2026-07-17 08:19:09 -07:00
Andrew Nesbitt
61b91fbebb
Merge pull request #203 from git-pkgs/dependabot/go_modules/github.com/go-chi/chi/v5-5.3.1
...
Bump github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1
2026-07-17 08:18:12 -07:00
Andrew Nesbitt
4e0575a3ab
Merge pull request #202 from git-pkgs/dependabot/docker/golang-1.26.5-alpine
...
Bump golang from 1.26.4-alpine to 1.26.5-alpine
2026-07-17 08:15:36 -07:00
Andrew Nesbitt
a79ec25bc9
Merge pull request #205 from git-pkgs/dependabot/github_actions/docker/login-action-4.4.0
...
Bump docker/login-action from 4.3.0 to 4.4.0
2026-07-16 09:50:50 -07:00
dependabot[bot]
df997e5825
Bump docker/login-action from 4.3.0 to 4.4.0
...
Bumps [docker/login-action](https://github.com/docker/login-action ) from 4.3.0 to 4.4.0.
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](c99871dec2...af1e73f918
2026-07-16 15:14:14 +00:00
dependabot[bot]
96e113213d
Bump github.com/git-pkgs/purl from 0.1.13 to 0.1.14
...
Bumps [github.com/git-pkgs/purl](https://github.com/git-pkgs/purl ) from 0.1.13 to 0.1.14.
- [Commits](https://github.com/git-pkgs/purl/compare/v0.1.13...v0.1.14 )
---
updated-dependencies:
- dependency-name: github.com/git-pkgs/purl
dependency-version: 0.1.14
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-07-16 15:14:12 +00:00
dependabot[bot]
ec3cc35795
Bump github.com/go-chi/chi/v5 from 5.3.0 to 5.3.1
...
Bumps [github.com/go-chi/chi/v5](https://github.com/go-chi/chi ) from 5.3.0 to 5.3.1.
- [Release notes](https://github.com/go-chi/chi/releases )
- [Changelog](https://github.com/go-chi/chi/blob/master/CHANGELOG.md )
- [Commits](https://github.com/go-chi/chi/compare/v5.3.0...v5.3.1 )
---
updated-dependencies:
- dependency-name: github.com/go-chi/chi/v5
dependency-version: 5.3.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-07-16 15:14:06 +00:00
dependabot[bot]
cdf075695f
Bump golang from 1.26.4-alpine to 1.26.5-alpine
...
Bumps golang from 1.26.4-alpine to 1.26.5-alpine.
---
updated-dependencies:
- dependency-name: golang
dependency-version: 1.26.5-alpine
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com>
2026-07-16 15:14:00 +00:00
