hostrules

func EmitArtifactConfig ¶

func EmitArtifactConfig(bases map[string]string, goSumDBOff bool) (files map[string]string, env map[string]string)

EmitArtifactConfig turns operator-configured artifact-registry redirects (ecosystem -> corporate base URL) into the per-tool config each toolchain reads to use the corporate mirror. Returns files (path -> content, relative to HOME) and env (Go's GOPROXY/GOSUMDB, which has no config file). Go's checksum database stays on, reached through the mirror's /sumdb/ path; goSumDBOff is the per-mirror opt-out for one that does not proxy it.

Output is URL-ONLY, no secret: a registry token is injected proxy-side, never written to a committable/readable config file. Maven's settings.xml is MIRRORS-ONLY — no <proxies>, since the sandbox reaches the mirror through wardyn-proxy via MAVEN_OPTS. GOPRIVATE is deliberately NOT set (it would route modules to direct VCS and defeat the corp GOPROXY).

Injection safety: base URLs come from site-config, which validateSiteConfig already rejects if they contain shell/XML metacharacters, so embedding base verbatim into TOML/XML/ini here is safe.

func HostOf ¶

func HostOf(rawURL string) string

HostOf extracts the lowercase host of an http(s) URL, or "" if unparseable.

func PublicRegistryHosts ¶

func PublicRegistryHosts(ecosystem string) []string

PublicRegistryHosts returns the public-registry hosts a corporate redirect replaces for an artifact ecosystem, or nil for an unknown key. The egress-substitution layer drops these and adds the corp host when the operator configures a redirect for that ecosystem.

func ValidApprovedHost ¶

func ValidApprovedHost(h string) bool

ValidApprovedHost reports whether h is a plain lowercase dotted host of the exact shape the approved-egress API accepts (no scheme/port/path/wildcard; wildcards stay a policy-allowlist privilege).