Commit graph

Select branches

Hide pull requests

bump-deps

bump-deps-v0.4.0

bump-vulnerable-deps

bump-x-net

composer-unset-sentinel

cosign-signing

deps/pre-v0.7.0

enforce-max-size-eviction

extract-portable-npm-metadata

fix-197-cooldown-scoped-purls

fix-database-log-173

http-timeout-config

issue-186-container-offline-auth

issue-186-upstream-auth

issue-225-sign-container-image

julia-support

lint-cleanup

main

path-traversal-decode

perf/cache-hit-path

pin-vendored-assets

registries-v0.6.0-cooldown

ui-polish

use-database-package

validate-package-name

#1

#10

#100

#101

#102

#103

#104

#105

#106

#107

#108

#109

#11

#110

#111

#113

#114

#115

#117

#119

#120

#121

#122

#124

#125

#13

#135

#136

#137

#138

#139

#14

#140

#146

#148

#15

#150

#151

#152

#153

#154

#156

#157

#158

#159

#160

#161

#162

#163

#164

#165

#166

#167

#168

#169

#17

#170

#171

#172

#174

#175

#176

#177

#178

#179

#18

#180

#181

#185

#188

#189

#19

#190

#191

#192

#193

#194

#195

#196

#198

#199

#2

#200

#201

#202

#203

#204

#205

#206

#209

#21

#210

#211

#212

#213

#214

#215

#216

#217

#218

#219

#22

#220

#221

#222

#223

#224

#227

#229

#23

#230

#232

#233

#234

#235

#237

#238

#24

#240

#241

#243

#244

#245

#246

#25

#250

#251

#252

#253

#254

#255

#257

#258

#259

#26

#260

#267

#268

#269

#27

#270

#272

#273

#275

#277

#278

#279

#28

#280

#281

#283

#284

#285

#286

#287

#288

#289

#29

#290

#291

#293

#294

#296

#297

#298

#299

#3

#30

#301

#302

#304

#307

#308

#31

#310

#311

#314

#315

#316

#317

#318

#319

#32

#324

#328

#329

#33

#330

#331

#332

#333

#334

#335

#336

#337

#340

#346

#347

#348

#349

#35

#350

#351

#352

#353

#354

#355

#356

#357

#359

#36

#360

#361

#362

#363

#364

#365

#366

#367

#368

#369

#37

#370

#371

#372

#373

#374

#375

#376

#377

#378

#379

#38

#380

#381

#382

#383

#387

#388

#389

#39

#390

#391

#392

#393

#394

#395

#396

#397

#398

#399

#399

#4

#40

#400

#401

#402

#404

#405

#406

#407

#408

#413

#417

#418

#419

#420

#421

#422

#423

#424

#425

#426

#427

#428

#429

#430

#431

#433

#435

#436

#437

#438

#439

#44

#440

#441

#442

#443

#444

#445

#446

#447

#448

#449

#45

#450

#451

#452

#453

#454

#455

#456

#457

#458

#459

#46

#462

#463

#464

#465

#468

#469

#47

#470

#471

#472

#473

#475

#476

#477

#479

#48

#481

#482

#483

#484

#485

#487

#488

#489

#490

#491

#492

#493

#494

#495

#496

#5

#50

#502

#503

#503

#504

#505

#506

#507

#508

#509

#51

#510

#511

#512

#513

#515

#516

#518

#519

#520

#527

#528

#531

#533

#534

#537

#538

#539

#540

#541

#544

#545

#546

#547

#548

#549

#550

#551

#552

#553

#554

#555

#556

#557

#558

#559

#561

#564

#565

#566

#567

#568

#569

#57

#570

#571

#572

#573

#574

#575

#576

#577

#578

#579

#58

#580

#581

#582

#583

#584

#585

#586

#587

#588

#589

#59

#590

#591

#592

#593

#594

#595

#597

#598

#599

#6

#60

#600

#601

#602

#603

#604

#605

#606

#607

#608

#609

#610

#611

#612

#615

#616

#618

#620

#621

#622

#623

#624

#625

#626

#627

#628

#629

#63

#630

#631

#633

#634

#635

#636

#637

#638

#639

#64

#640

#641

#642

#643

#644

#645

#646

#647

#649

#650

#650

#651

#653

#654

#655

#656

#658

#659

#66

#660

#661

#662

#663

#664

#666

#667

#669

#67

#671

#672

#674

#675

#676

#677

#678

#679

#68

#680

#681

#682

#683

#684

#687

#687

#688

#688

#689

#689

#69

#690

#691

#692

#693

#694

#696

#697

#699

#7

#70

#701

#702

#702

#703

#703

#704

#705

#706

#706

#707

#708

#709

#709

#71

#710

#711

#712

#713

#714

#715

#716

#717

#718

#719

#72

#720

#721

#722

#722

#723

#723

#77

#79

#8

#80

#81

#82

#83

#84

#85

#87

#88

#89

#9

#90

#91

#92

#93

#93

#94

#95

#97

#98

v0.1.0

v0.10.0

v0.11.0

v0.2.0

v0.2.1

v0.3.0

v0.3.1

v0.3.2

v0.4.0

v0.5.0

v0.5.1

v0.6.0

v0.6.1

v0.7.0

v0.8.0

v0.8.1

v0.9.0

v0.9.1

Mono Color

• 21fdf772fe
  Use shared registries size limits and rate-limit gate Andrew Nesbitt 2026-10-18 14:50:53 +01:00
• f279edf35d fix(mirror): exit with status 1 when downloads fail yunaremaia 2026-10-18 12:59:16 +00:00
• 39d10b1d15 Remove constant parameter from generic retention test helper ztzhou 2026-10-18 20:11:06 +08:00
• f1ea481161 Add opt-in retention for generic artifacts ztzhou 2026-10-18 20:02:39 +08:00
• 51743c6840
  Use shared cooldown package-pattern policy Andrew Nesbitt 2026-10-18 12:39:21 +01:00
• ac000eb601
  Use shared sbom parser for mirror sources Andrew Nesbitt 2026-10-18 12:10:26 +01:00
• 1c20b60445 Make the Gradle build cache read-only by default, so a client that can reach the proxy can no longer overwrite cache entries; CI jobs that upload now need gradle.build_cache.read_only: false (or PROXY_GRADLE_BUILD_CACHE_READ_ONLY=false). The environment variable is parsed strictly, so a value like "yes" keeps uploads off and logs a warning instead of opening them. Fixes #497. Christian Heim 2026-10-18 12:48:42 +02:00
• 3e88cd027a Check cached layers during a mirror without opening them, so a refresh no longer counts as a cache hit and doesn't keep scheduled images at the top of LRU eviction. Christian Heim 2026-10-18 11:08:53 +02:00
• c561cfede9 Start the schedules with the server and let shutdown wait for a running refresh before storage and database are closed. Docs included. Christian Heim 2026-10-18 08:14:50 +02:00
• ce82a153d4 Run each schedule through the normal mirror, one run after the other. The first run starts at a random point within ten minutes and later runs get ±10 % jitter, so several instances don't hit the registry at once. Christian Heim 2026-10-18 08:14:50 +02:00
• 9f058aa36a Add mirror.schedules, a list of image tags the server re-mirrors at a fixed interval. Digests are rejected since they never move. Christian Heim 2026-10-18 08:14:50 +02:00
• 552f0496f4 Shorter comments on the metadata last-access migration. Christian Heim 2026-10-18 07:30:20 +02:00
• b87c6567a0 max_size now counts cached metadata as well as artifacts, and eviction drops whichever was used least recently, so metadata no longer piles up for good (#461). Metadata rows record when they were last served, an artifact not yet served counts from its download, and Arch stores a database blob again if eviction removed it under a refreshed row. Christian Heim 2026-10-17 23:37:29 +02:00
• c0320c7c87 Clearing a record and queueing its file for deletion now happen in one transaction, so a failed queue write keeps the record instead of leaving a file nothing points at. Eviction drops the queue entry again once it has deleted the file itself. Christian Heim 2026-10-17 23:20:45 +02:00
• 56e1c9eb4e Refetch a cached Go zip that an older version stored for the other spelling of the module. Christian Heim 2026-10-17 23:21:08 +02:00
• 3fda7fd176 Keep the capitals of a Go module path in the cached zip's filename, so github.com/Sirupsen/logrus and github.com/sirupsen/logrus no longer share one cache entry. Lowercase paths keep their filename. Christian Heim 2026-10-17 23:12:46 +02:00
• 4b23b3f5a9 Abort the response when a cached artifact fails its integrity check orshih6 2026-10-17 17:40:15 +00:00
• 15aa90aea4
  Exit with status 1 when proxy mirror fails to mirror a package Cestercian 2026-10-17 22:44:26 +05:30
• db6d1d672d Request npm packuments in one format for downloads too Simon Chrzanowski 2026-10-17 14:10:55 +02:00
• 2dde10be4c Keep the stored metadata on an upstream 304 Simon Chrzanowski 2026-10-17 14:08:17 +02:00
• 9dafb8cb36 Resolve Composer downloads from the cached metadata Simon Chrzanowski 2026-10-17 13:58:36 +02:00
• 3f862bfd9c
  Refuse package mirroring from the CLI while scanning is enabled abhinavgautam01 2026-10-16 11:12:09 +05:30
• 1950c0b6a4
  Merge pull request #487 from git-pkgs/dependabot/go_modules/github.com/aws/aws-sdk-go-v2/service/ecr-1.66.2 Andrew Nesbitt 2026-10-15 16:55:55 +01:00
• b8d5cf4f27
  Bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.66.1 to 1.66.2 dependabot[bot] 2026-10-15 15:33:50 +00:00
• 78b1913865
  Merge pull request #490 from git-pkgs/dependabot/go_modules/github.com/prometheus/client_golang-1.25.0 Andrew Nesbitt 2026-10-15 16:31:13 +01:00
• 29046e6013
  Merge pull request #489 from git-pkgs/dependabot/go_modules/github.com/aws/aws-sdk-go-v2/config-1.33.7 Andrew Nesbitt 2026-10-15 16:30:33 +01:00
• 1a4a372c4c
  Merge pull request #488 from git-pkgs/dependabot/go_modules/golang.org/x/sync-0.24.0 Andrew Nesbitt 2026-10-15 16:29:35 +01:00
• 7e35cfc4dd
  Merge pull request #483 from gilesw/feat/upstream-retry-after Andrew Nesbitt 2026-10-15 16:27:51 +01:00
• eb29011659
  Merge pull request #485 from simonchrz/perf/gzip-rewritten-metadata Andrew Nesbitt 2026-10-15 16:25:09 +01:00
• ba61c45077
  Bump github.com/prometheus/client_golang from 1.24.1 to 1.25.0 dependabot[bot] 2026-10-15 15:16:44 +00:00
• fc312a0c59
  Bump github.com/aws/aws-sdk-go-v2/config from 1.33.6 to 1.33.7 dependabot[bot] 2026-10-15 15:16:38 +00:00
• b884a5f63f
  Bump golang.org/x/sync from 0.23.0 to 0.24.0 dependabot[bot] 2026-10-15 15:15:16 +00:00
• a1fdd8037a
  Serve metadata cache stats from a shared snapshot and split Grafana cache panels by kind abhinavgautam01 2026-10-15 18:30:05 +05:30
• 201e60c78c
  Merge upstream main into fix/metadata-cache-metrics-416 abhinavgautam01 2026-10-15 18:29:59 +05:30
• b2955ef458 Keep holds through late successes and away from the circuit breaker Giles Westwood 2026-10-15 13:35:12 +01:00
• e74e5abc79
  Serve cached npm and Composer metadata gzip-compressed simon chrzanowski 2026-10-15 12:46:55 +02:00
• 8bc8b3ab75
  Merge pull request #484 from gilesw/fix/maven-checksums-as-artifacts Andrew Nesbitt 2026-10-15 09:34:54 +01:00
• 88cf5be075
  Merge pull request #482 from simonchrz/fix/sandbox-upstream-content Andrew Nesbitt 2026-10-15 09:31:23 +01:00
• adf9d3097c
  Merge pull request #481 from simonchrz/fix/registry-token-scope Andrew Nesbitt 2026-10-15 09:29:50 +01:00
• cbf457bceb
  Merge pull request #479 from simonchrz/feat/registry-checksums Andrew Nesbitt 2026-10-15 09:28:48 +01:00
• e9ecde70ed Hold requests to an upstream that rate limits the proxy Giles Westwood 2026-10-14 12:51:43 +01:00
• 6051e20adf Cache Maven checksums and signatures as artifacts Giles Westwood 2026-10-14 12:31:06 +01:00
• 3bbb5aa7a3 Give the detached fetch test time on slow runners Simon Chrzanowski 2026-10-14 18:14:06 +02:00
• ba5e6e84c5 Leave Composer dev branch archives unverified Simon Chrzanowski 2026-10-14 18:06:01 +02:00
• bf74d982d7 Verify npm and Composer archives against their SHA-1 shasum Simon Chrzanowski 2026-10-14 15:43:39 +02:00
• cbb1978026 Bump git-pkgs/integrity to v0.2.0 Simon Chrzanowski 2026-10-14 16:43:11 +02:00
• e0fb8be4d9
  Merge pull request #473 from simonchrz/fix/artifact-integrity Andrew Nesbitt 2026-10-14 16:56:28 +01:00
• 6a90fb411f Only send credentialed registry tokens to trusted registries Simon Chrzanowski 2026-10-14 17:56:18 +02:00
• cf7eafbbe8 Sandbox upstream content on package routes Simon Chrzanowski 2026-10-14 17:53:48 +02:00
• 2a8717cb77
  Merge pull request #477 from git-pkgs/fix/oci-referrers-tag-offline Andrew Nesbitt 2026-10-14 16:52:18 +01:00
• 0add4d7368
  Merge pull request #476 from git-pkgs/fix/oci-multiple-accept-headers Andrew Nesbitt 2026-10-14 16:51:38 +01:00
• 18f6587f36
  Merge pull request #475 from git-pkgs/fix/browse-encode-file-path Andrew Nesbitt 2026-10-14 16:50:51 +01:00
• 2d258ddc4b Verify npm tarballs against dist.integrity Simon Chrzanowski 2026-10-14 15:36:26 +02:00
• 544e1a5bdd
  Note that the container registry is pull-only Andrew Nesbitt 2026-10-14 13:17:37 +01:00
• 27f65297c6
  Merge pull request #464 from simonchrz/133_local-package-upload Andrew Nesbitt 2026-10-14 13:09:53 +01:00
• 513687ce10
  Answer uncached referrers tags with 404 when the upstream is down Andrew Nesbitt 2026-10-14 12:50:03 +01:00
• dc809b0762
  Join every Accept header on container manifest requests Andrew Nesbitt 2026-10-14 12:43:14 +01:00
• ba81c1db42
  Merge pull request #438 from pinguinfuss/issue-411-mirror-images Andrew Nesbitt 2026-10-14 12:25:04 +01:00
• c0ac418160
  Serve pushed artifacts when streaming upstream artifacts simon chrzanowski 2026-10-14 13:21:57 +02:00
• 8265c7d44b
  Nest the hosted commands under proxy hosted simon chrzanowski 2026-10-13 15:20:57 +02:00
• eca224bb56
  Leave denied pushed versions out of package metadata simon chrzanowski 2026-10-13 15:18:49 +02:00
• 2a957b92e9
  Prefer the root composer.json of a pushed archive simon chrzanowski 2026-10-13 15:17:48 +02:00
• e0ab227f14
  Never replace a pushed artifact with the upstream copy simon chrzanowski 2026-10-13 15:16:55 +02:00
• 3dae0fbae0
  Stop UpsertPackage from clearing packages.source simon chrzanowski 2026-10-13 15:13:02 +02:00
• 69313c26d9
  Serve hosted-only npm scopes and Composer vendors from pushed packages alone simon chrzanowski 2026-10-13 13:42:34 +02:00
• 0916eabe37
  Fix leftover /api/packages references to the hosted endpoints simon chrzanowski 2026-10-13 13:37:58 +02:00
• 96241b910b
  Serve pushed npm tarballs before the cooldown check simon chrzanowski 2026-10-13 13:34:52 +02:00
• c0b2a200c2
  Document how pushed versions appear in package metadata simon chrzanowski 2026-10-13 13:27:27 +02:00
• 112fc590b7
  List pushed Composer versions in package metadata simon chrzanowski 2026-10-13 13:27:13 +02:00
• c566949573
  List pushed npm versions in package metadata simon chrzanowski 2026-10-13 13:23:29 +02:00
• e7449d1540
  Read the package manifest of pushed archives simon chrzanowski 2026-10-13 13:19:58 +02:00
• 80fdd16719
  Add push, list and delete commands for hosted packages simon chrzanowski 2026-10-13 13:11:49 +02:00
• 5e66688873
  Push, list and delete npm and Composer archives through /api/hosted simon chrzanowski 2026-10-13 13:11:49 +02:00
• ea696a7abc
  Add a hosted config block and a bearer token check for writes simon chrzanowski 2026-10-13 12:35:22 +02:00
• 87505c01c1
  Mark pushed artifacts as local and keep them out of eviction simon chrzanowski 2026-10-13 12:35:22 +02:00
• 02ae49d401
  Merge remote-tracking branch 'origin/main' into issue-411-mirror-images Andrew Nesbitt 2026-10-14 12:21:14 +01:00
• 784402ed30
  Merge pull request #472 from simonchrz/fix/artifact-size-limits Andrew Nesbitt 2026-10-14 12:19:53 +01:00
• 61eeaf59ad
  Merge remote-tracking branch 'origin/main' into issue-411-mirror-images Andrew Nesbitt 2026-10-14 12:19:25 +01:00
• 167e6b8ce7
  Merge pull request #462 from pinguinfuss/issue-409-go-sumdb Andrew Nesbitt 2026-10-14 12:10:03 +01:00
• 53c03c9694
  Merge pull request #465 from pinguinfuss/issue-306-retention-deb Andrew Nesbitt 2026-10-14 12:05:48 +01:00
• f3f35df900
  Note that streamed artifacts over the size limit are cut off Andrew Nesbitt 2026-10-14 12:02:54 +01:00
• 65ffb7c6bd
  Merge pull request #471 from simonchrz/fix/diff2html-pin Andrew Nesbitt 2026-10-14 11:59:30 +01:00
• ea4c1ba125
  Encode file paths when loading files in the source browser Andrew Nesbitt 2026-10-14 11:58:16 +01:00
• 320149399d
  Merge pull request #470 from simonchrz/fix/browse-xss Andrew Nesbitt 2026-10-14 11:51:27 +01:00
• ab413e8966
  Merge pull request #469 from simonchrz/fix/composer-download-cooldown Andrew Nesbitt 2026-10-14 11:50:48 +01:00
• f73f6a796f
  Merge pull request #468 from simonchrz/fix/redirect-auth-header-leak Andrew Nesbitt 2026-10-14 11:49:50 +01:00
• a9cff7fa60
  Limit how many version diffs run at once simon chrzanowski 2026-10-14 08:41:10 +02:00
• b7b7a64239
  Add a size limit for upstream artifacts simon chrzanowski 2026-10-14 08:39:12 +02:00
• aa0b543ae8
  Stop forwarding custom auth headers across redirects simon chrzanowski 2026-10-14 08:38:51 +02:00
• 832c800ea5
  Serve diff2html from the proxy instead of jsDelivr simon chrzanowski 2026-10-14 08:37:43 +02:00
• f5e7599749
  Stop interpolating archive paths into inline handlers simon chrzanowski 2026-10-14 08:37:40 +02:00
• 03c8e680cc
  Withhold Composer archives still in cooldown simon chrzanowski 2026-10-14 08:37:39 +02:00
• d7a6a891e3
  Abort blob writes when the download fails simon chrzanowski 2026-10-14 08:36:21 +02:00
• 329780050f Enable storage retention for deb Christian Heim 2026-10-11 01:12:41 +02:00
• b0570bdf9d Mirroring a tag now checks it with a HEAD first and reuses the cached manifest when the digest is unchanged, falls back to the cached tag when the upstream body is cut off, and keeps a tag that a client pull moved while the walk ran. The platform filter is checked across the whole image, so a nested index without the wanted platform no longer fails it, and a 304 for a per-Accept fallback entry only refreshes that client's own keys instead of overwriting the shared entry. Christian Heim 2026-10-13 17:02:32 +02:00
• 42df87e035 Forward data tiles without storing them. The go command never fetches them, and kept for good they would add up to the whole log; the record count check from before is no longer needed. Christian Heim 2026-10-13 16:23:12 +02:00
• e3cdf73a89 Wait for the clock to move on in the fresh-tree test, since on Windows the first probe's success and the start of the lookup can get the same time. Christian Heim 2026-10-12 23:08:08 +02:00
• c2ab81031e Move upstream.go_sumdbs_offline next to upstream.go in the configuration table. Christian Heim 2026-10-12 22:35:23 +02:00
• 5332f1f5e0 Don't count a tree fresh in the cache as the database answering. The probe never asked it, and during an outage that kept lookups from remembering the failure, so offline mode waited for the upstream timeout on every request until the tree expired. Christian Heim 2026-10-12 22:35:23 +02:00
• 943009c669 Check that a data tile holds W records before caching it. Complete tiles are never fetched again, so a block page cached as one stayed for good. Christian Heim 2026-10-12 22:35:20 +02:00