Documentation
¶
Overview ¶
Package handler provides HTTP protocol handlers for package manager proxying.
Index ¶
- Constants
- Variables
- func JSONError(w http.ResponseWriter, status int, message string)
- func RegisterHomebrewArtifacts(container *ContainerHandler, artifactUpstream string)
- func ServeArtifact(w http.ResponseWriter, result *CacheResult)
- type APKHandler
- type CRANHandler
- type CacheResult
- type CargoConfig
- type CargoHandler
- type ComposerHandler
- type ConanHandler
- type CondaHandler
- type ContainerHandler
- type DebianHandler
- type GemHandler
- type GenericHandler
- type GoHandler
- type GradleBuildCacheHandler
- type HelmHandler
- type HexHandler
- type HomebrewHandler
- type JuliaHandler
- type MavenHandler
- type NPMHandler
- type NuGetHandler
- type Proxy
- func (p *Proxy) ClearCachedArtifact(ctx context.Context, ecosystem, name, version, filename string) error
- func (p *Proxy) FetchOrCacheMetadata(ctx context.Context, ecosystem, cacheKey, upstreamURL string, ...) ([]byte, string, error)
- func (p *Proxy) GetCachedArtifact(ctx context.Context, ecosystem, name, version, filename string) (*CacheResult, error)
- func (p *Proxy) GetOrFetchArtifact(ctx context.Context, ecosystem, name, version, filename string) (*CacheResult, error)
- func (p *Proxy) GetOrFetchArtifactFromURL(ctx context.Context, ecosystem, name, version, filename, downloadURL string) (*CacheResult, error)
- func (p *Proxy) GetOrFetchArtifactFromURLWithDigest(ctx context.Context, ...) (*CacheResult, error)
- func (p *Proxy) GetOrFetchArtifactFromURLWithHeaders(ctx context.Context, ecosystem, name, version, filename, downloadURL string, ...) (*CacheResult, error)
- func (p *Proxy) ProxyCached(w http.ResponseWriter, r *http.Request, ...)
- func (p *Proxy) ProxyFile(w http.ResponseWriter, r *http.Request, upstreamURL string)
- func (p *Proxy) ProxyUpstream(w http.ResponseWriter, r *http.Request, upstreamURL string, ...)
- func (p *Proxy) ReadMetadata(r io.Reader) ([]byte, error)
- func (p *Proxy) ServeScanFetch(w http.ResponseWriter, r *http.Request)
- type PubHandler
- type PyPIHandler
- type RPMHandler
- type SwiftHandler
Constants ¶
const ( // PyPIMetadataSuffix is the PEP 658 core-metadata sidecar suffix that pip // appends to a distribution URL when the index advertises core metadata. // A sidecar resolves to the same name and version as the distribution it // describes, so it is cached alongside it; consumers that expect an openable // archive must skip these. PyPIMetadataSuffix = ".metadata" )
Variables ¶
var ErrArtifactBlocked = errors.New("artifact blocked by security scan")
ErrArtifactBlocked indicates a pre-cache security scan blocked the artifact.
var ErrArtifactDigestMismatch = errors.New("artifact digest mismatch")
ErrArtifactDigestMismatch indicates that fetched bytes did not match the checksum the upstream declared and were not recorded in the cache database.
var ErrMetadataTooLarge = errors.New("metadata response exceeds size limit")
ErrMetadataTooLarge is returned when upstream metadata exceeds the configured limit.
var ErrUpstreamNotFound = fmt.Errorf("upstream: %w", fetch.ErrNotFound)
ErrUpstreamNotFound indicates the upstream returned 404.
Functions ¶
func JSONError ¶
func JSONError(w http.ResponseWriter, status int, message string)
JSONError writes a JSON error response.
func RegisterHomebrewArtifacts ¶ added in v0.8.0
func RegisterHomebrewArtifacts(container *ContainerHandler, artifactUpstream string)
RegisterHomebrewArtifacts routes homebrew/core OCI requests to its configured registry and blocks other homebrew repositories from reaching the default OCI registry.
func ServeArtifact ¶
func ServeArtifact(w http.ResponseWriter, result *CacheResult)
ServeArtifact writes a CacheResult to an HTTP response.
Types ¶
type APKHandler ¶ added in v0.8.0
type APKHandler struct {
// contains filtered or unexported fields
}
APKHandler handles Alpine APK repository protocol requests. Each configured upstream repository is mounted at /apk/{repository}/ and the remaining path mirrors the upstream layout ({release}/{repo}/{arch}/{file}).
Repository indexes (v2 APKINDEX.tar.gz, v3 Packages.adb) and detached signatures are served byte-for-byte unchanged through the metadata cache so apk signature verification keeps working. Package files are cached in the shared artifact cache and stay available when the upstream is unreachable.
func NewAPKHandler ¶ added in v0.8.0
func NewAPKHandler(proxy *Proxy, proxyURL string, repositories map[string]string) *APKHandler
NewAPKHandler creates an Alpine APK repository protocol handler. When repositories is empty, a single repository named "alpine" pointing at the official Alpine mirror is used.
func (*APKHandler) Routes ¶ added in v0.8.0
func (h *APKHandler) Routes() http.Handler
Routes returns the HTTP handler for APK requests. Mount this at /apk on your router.
type CRANHandler ¶
type CRANHandler struct {
// contains filtered or unexported fields
}
CRANHandler handles CRAN (R) registry protocol requests.
func NewCRANHandler ¶
func NewCRANHandler(proxy *Proxy, proxyURL string) *CRANHandler
NewCRANHandler creates a new CRAN protocol handler.
func NewCRANHandlerWithUpstream ¶ added in v0.8.0
func NewCRANHandlerWithUpstream(proxy *Proxy, proxyURL, upstreamURL string) *CRANHandler
NewCRANHandlerWithUpstream creates a CRAN handler with a custom upstream.
func (*CRANHandler) Routes ¶
func (h *CRANHandler) Routes() http.Handler
Routes returns the HTTP handler for CRAN requests.
type CacheResult ¶
type CacheResult struct {
Reader io.ReadCloser
RedirectURL string
Artifact artifacts.Artifact
Cached bool
// contains filtered or unexported fields
}
CacheResult contains information about a cached or fetched artifact.
type CargoConfig ¶
CargoConfig is the registry configuration returned by config.json.
type CargoHandler ¶
type CargoHandler struct {
// contains filtered or unexported fields
}
CargoHandler handles cargo registry protocol requests.
func NewCargoHandler ¶
func NewCargoHandler(proxy *Proxy, proxyURL, indexURL, downloadURL string) *CargoHandler
NewCargoHandler creates a new cargo protocol handler.
func (*CargoHandler) Routes ¶
func (h *CargoHandler) Routes() http.Handler
Routes returns the HTTP handler for cargo requests. Mount this at /cargo on your router.
type ComposerHandler ¶
type ComposerHandler struct {
// contains filtered or unexported fields
}
ComposerHandler handles Composer/Packagist registry protocol requests.
func NewComposerHandler ¶
func NewComposerHandler(proxy *Proxy, proxyURL string) *ComposerHandler
NewComposerHandler creates a new Composer protocol handler.
func NewComposerHandlerWithUpstreams ¶ added in v0.8.0
func NewComposerHandlerWithUpstreams(proxy *Proxy, proxyURL, upstreamURL, repoURL string) *ComposerHandler
NewComposerHandlerWithUpstreams creates a Composer handler with custom API and repository upstreams.
func (*ComposerHandler) Routes ¶
func (h *ComposerHandler) Routes() http.Handler
Routes returns the HTTP handler for Composer requests.
type ConanHandler ¶
type ConanHandler struct {
// contains filtered or unexported fields
}
ConanHandler handles Conan registry protocol requests.
func NewConanHandler ¶
func NewConanHandler(proxy *Proxy, proxyURL string) *ConanHandler
NewConanHandler creates a new Conan protocol handler.
func NewConanHandlerWithUpstream ¶ added in v0.8.0
func NewConanHandlerWithUpstream(proxy *Proxy, proxyURL, upstreamURL string) *ConanHandler
NewConanHandlerWithUpstream creates a Conan handler with a custom upstream.
func (*ConanHandler) Routes ¶
func (h *ConanHandler) Routes() http.Handler
Routes returns the HTTP handler for Conan requests.
type CondaHandler ¶
type CondaHandler struct {
// contains filtered or unexported fields
}
CondaHandler handles Conda/Anaconda registry protocol requests.
func NewCondaHandler ¶
func NewCondaHandler(proxy *Proxy, proxyURL string) *CondaHandler
NewCondaHandler creates a new Conda protocol handler.
func NewCondaHandlerWithUpstream ¶ added in v0.8.0
func NewCondaHandlerWithUpstream(proxy *Proxy, proxyURL, upstreamURL string) *CondaHandler
NewCondaHandlerWithUpstream creates a Conda handler with a custom upstream.
func (*CondaHandler) Routes ¶
func (h *CondaHandler) Routes() http.Handler
Routes returns the HTTP handler for Conda requests.
type ContainerHandler ¶
type ContainerHandler struct {
// contains filtered or unexported fields
}
ContainerHandler handles OCI/Docker container registry protocol requests. It implements the OCI Distribution Spec for pulling images. Reference: https://github.com/opencontainers/distribution-spec/blob/main/spec.md
func NewContainerHandler ¶
func NewContainerHandler(proxy *Proxy, proxyURL string, namedRegistries ...map[string]string) *ContainerHandler
NewContainerHandler creates a new container registry protocol handler. Named registries are selected with the repository prefix upstream/{name}/, leaving unprefixed requests compatible with the Docker Hub mirror behavior.
func NewContainerHandlerWithRegistry ¶ added in v0.8.0
func NewContainerHandlerWithRegistry( proxy *Proxy, proxyURL, registryURL string, namedRegistries ...map[string]string, ) *ContainerHandler
NewContainerHandlerWithRegistry creates a container handler with a custom default registry and optional named registries.
func (*ContainerHandler) BlockRegistry ¶ added in v0.8.0
func (h *ContainerHandler) BlockRegistry(repositoryPrefix string)
BlockRegistry prevents a repository and its descendants from falling back to the default OCI registry. A more specific registered repository still wins.
func (*ContainerHandler) RegisterRegistry ¶ added in v0.8.0
func (h *ContainerHandler) RegisterRegistry(repositoryPrefix, registryURL string)
RegisterRegistry routes a repository and its descendants to a specific OCI registry. The longest matching repository prefix wins.
func (*ContainerHandler) Routes ¶
func (h *ContainerHandler) Routes() http.Handler
Routes returns the HTTP handler for container registry requests. Mount this at /v2 on your router.
type DebianHandler ¶
type DebianHandler struct {
// contains filtered or unexported fields
}
DebianHandler handles APT/Debian repository protocol requests. It proxies requests to upstream Debian/Ubuntu repositories and caches .deb packages.
func NewDebianHandler ¶
func NewDebianHandler(proxy *Proxy, proxyURL string, upstreamURL string) *DebianHandler
NewDebianHandler creates a new Debian/APT protocol handler.
func (*DebianHandler) Routes ¶
func (h *DebianHandler) Routes() http.Handler
Routes returns the HTTP handler for Debian requests. Mount this at /debian on your router.
type GemHandler ¶
type GemHandler struct {
// contains filtered or unexported fields
}
GemHandler handles RubyGems registry protocol requests.
func NewGemHandler ¶
func NewGemHandler(proxy *Proxy, proxyURL string) *GemHandler
NewGemHandler creates a new RubyGems protocol handler.
func NewGemHandlerWithUpstream ¶ added in v0.8.0
func NewGemHandlerWithUpstream(proxy *Proxy, proxyURL, upstreamURL string) *GemHandler
NewGemHandlerWithUpstream creates a RubyGems handler with a custom upstream.
func (*GemHandler) Routes ¶
func (h *GemHandler) Routes() http.Handler
Routes returns the HTTP handler for RubyGems requests.
type GenericHandler ¶ added in v0.8.0
type GenericHandler struct {
// contains filtered or unexported fields
}
GenericHandler proxies plain HTTP downloads from configured upstream base URLs. Each configured upstream is mounted at /generic/{name}/ and the remaining request path (and query string) is appended to the upstream URL.
Only configured upstreams are reachable, so the proxy is not an open HTTP proxy. The handler is the caching layer behind tools that download from fixed URL shapes, such as mise's aqua backend fetching GitHub release assets, and is pointed at by URL-rewriting settings on the client.
Release-asset paths ({owner}/{repo}/releases/download/{tag}/{asset}) are version-pinned and cached in the shared artifact cache, so they keep being served when the upstream is unreachable. Every other path is served through the metadata cache: fresh within the metadata TTL, revalidated with the upstream's validators after that, and served stale when the upstream fails or refuses the request. That covers API responses such as api.github.com/repos/{owner}/{repo}/releases/tags/{tag}.
func NewGenericHandler ¶ added in v0.8.0
func NewGenericHandler(proxy *Proxy, repositories map[string]string) *GenericHandler
NewGenericHandler creates a generic HTTP download proxy handler.
func (*GenericHandler) Routes ¶ added in v0.8.0
func (h *GenericHandler) Routes() http.Handler
Routes returns the HTTP handler for generic download requests. Mount this at /generic on your router.
type GoHandler ¶
type GoHandler struct {
// contains filtered or unexported fields
}
GoHandler handles Go module proxy protocol requests.
func NewGoHandler ¶
NewGoHandler creates a new Go module proxy handler.
func NewGoHandlerWithUpstream ¶ added in v0.8.0
NewGoHandlerWithUpstream creates a Go module handler with a custom upstream.
type GradleBuildCacheHandler ¶ added in v0.4.0
type GradleBuildCacheHandler struct {
// contains filtered or unexported fields
}
GradleBuildCacheHandler handles Gradle HttpBuildCache GET/HEAD/PUT requests.
This handler accepts /{key} when mounted under a base URL.
func NewGradleBuildCacheHandler ¶ added in v0.4.0
func NewGradleBuildCacheHandler(proxy *Proxy) *GradleBuildCacheHandler
NewGradleBuildCacheHandler creates a Gradle HttpBuildCache handler.
func (*GradleBuildCacheHandler) Routes ¶ added in v0.4.0
func (h *GradleBuildCacheHandler) Routes() http.Handler
Routes returns the HTTP handler for Gradle HttpBuildCache requests.
type HelmHandler ¶ added in v0.8.0
type HelmHandler struct {
// contains filtered or unexported fields
}
HelmHandler serves read-only HTTP Helm chart repositories. Each configured repository is mounted at /helm/{repository}/.
func NewHelmHandler ¶ added in v0.8.0
func NewHelmHandler(proxy *Proxy, proxyURL string, repositories map[string]string) *HelmHandler
NewHelmHandler creates a Helm chart repository protocol handler.
func (*HelmHandler) Routes ¶ added in v0.8.0
func (h *HelmHandler) Routes() http.Handler
Routes returns the HTTP handler for Helm chart repository requests.
type HexHandler ¶
type HexHandler struct {
// contains filtered or unexported fields
}
HexHandler handles Hex.pm registry protocol requests.
func NewHexHandler ¶
func NewHexHandler(proxy *Proxy, proxyURL string) *HexHandler
NewHexHandler creates a new Hex.pm protocol handler.
func NewHexHandlerWithUpstreams ¶ added in v0.8.0
func NewHexHandlerWithUpstreams(proxy *Proxy, proxyURL, upstreamURL, apiURL string) *HexHandler
NewHexHandlerWithUpstreams creates a Hex handler with custom repository and API upstreams.
func (*HexHandler) Routes ¶
func (h *HexHandler) Routes() http.Handler
Routes returns the HTTP handler for Hex requests.
type HomebrewHandler ¶ added in v0.8.0
type HomebrewHandler struct {
// contains filtered or unexported fields
}
HomebrewHandler proxies Homebrew's JSON API without modifying signed files.
func NewHomebrewHandler ¶ added in v0.8.0
func NewHomebrewHandler(proxy *Proxy, apiUpstream string) *HomebrewHandler
NewHomebrewHandler creates a Homebrew JSON API handler.
func (*HomebrewHandler) Routes ¶ added in v0.8.0
func (h *HomebrewHandler) Routes() http.Handler
Routes returns the Homebrew JSON API handler. Mount this at /homebrew.
type JuliaHandler ¶ added in v0.4.0
type JuliaHandler struct {
// contains filtered or unexported fields
}
JuliaHandler handles Julia Pkg server protocol requests.
See https://pkgdocs.julialang.org/v1/registries/ and the PkgServer.jl reference implementation. The protocol is content-addressed: registry, package and artifact resources are all identified by git tree hashes and are immutable once published.
func NewJuliaHandler ¶ added in v0.4.0
func NewJuliaHandler(proxy *Proxy, _ string) *JuliaHandler
NewJuliaHandler creates a new Julia Pkg server handler.
func NewJuliaHandlerWithUpstream ¶ added in v0.8.0
func NewJuliaHandlerWithUpstream(proxy *Proxy, upstreamURL string) *JuliaHandler
NewJuliaHandlerWithUpstream creates a Julia handler with a custom upstream.
func (*JuliaHandler) Routes ¶ added in v0.4.0
func (h *JuliaHandler) Routes() http.Handler
Routes returns the HTTP handler for Julia requests.
type MavenHandler ¶
type MavenHandler struct {
// contains filtered or unexported fields
}
MavenHandler handles Maven repository protocol requests.
func NewMavenHandler ¶
func NewMavenHandler(proxy *Proxy, proxyURL, upstreamURL, pluginPortalUpstreamURL string) *MavenHandler
NewMavenHandler creates a new Maven repository handler.
func (*MavenHandler) Routes ¶
func (h *MavenHandler) Routes() http.Handler
Routes returns the HTTP handler for Maven requests.
type NPMHandler ¶
type NPMHandler struct {
// contains filtered or unexported fields
}
NPMHandler handles npm registry protocol requests.
func NewNPMHandler ¶
func NewNPMHandler(proxy *Proxy, proxyURL, upstreamURL string) *NPMHandler
NewNPMHandler creates a new npm protocol handler.
func (*NPMHandler) Routes ¶
func (h *NPMHandler) Routes() http.Handler
Routes returns the HTTP handler for npm requests. Mount this at /npm on your router.
type NuGetHandler ¶
type NuGetHandler struct {
// contains filtered or unexported fields
}
NuGetHandler handles NuGet V3 API protocol requests.
func NewNuGetHandler ¶
func NewNuGetHandler(proxy *Proxy, proxyURL string) *NuGetHandler
NewNuGetHandler creates a new NuGet protocol handler.
func NewNuGetHandlerWithUpstreams ¶ added in v0.8.0
func NewNuGetHandlerWithUpstreams(proxy *Proxy, proxyURL, upstreamURL, searchURL string) *NuGetHandler
NewNuGetHandlerWithUpstreams creates a NuGet handler with custom API and search upstreams.
func (*NuGetHandler) Routes ¶
func (h *NuGetHandler) Routes() http.Handler
Routes returns the HTTP handler for NuGet requests.
type Proxy ¶
type Proxy struct {
DB *database.DB
Storage storage.Storage
Fetcher fetch.FetcherInterface
Resolver *fetch.Resolver
Logger *slog.Logger
Cooldown *cooldown.Config
CacheMetadata bool
MetadataTTL time.Duration
MetadataMaxSize int64
GradleReadOnly bool
GradleMaxUploadSize int64
// NPMFullMetadata requests full npm packuments from upstream even when
// cooldown is disabled, so served metadata carries publish times.
NPMFullMetadata bool
DirectServe bool
DirectServeTTL time.Duration
// DirectServeBaseURL, if set, replaces the scheme and host of presigned
// URLs so clients receive a public address even when the proxy reaches
// storage at an internal one.
DirectServeBaseURL string
HTTPClient *http.Client
AuthForURL func(string) (headerName, headerValue string)
// Scanners runs pre-cache artifact scanning (e.g. trivy, ClamAV, Wiz).
// Nil or disabled means artifacts are cached without scanning.
Scanners *scanner.Group
// ScanSigningKey authenticates pull requests to the internal
// /_internal/scan-fetch route used by scanners to retrieve staged
// artifacts, for every storage backend.
ScanSigningKey []byte
// ScanFetchBaseURL is the address scanners use to reach this proxy to
// pull staged artifacts.
ScanFetchBaseURL string
}
Proxy provides shared functionality for protocol handlers.
func NewProxy ¶
func NewProxy(db *database.DB, store storage.Storage, fetcher fetch.FetcherInterface, resolver *fetch.Resolver, logger *slog.Logger) *Proxy
NewProxy creates a new Proxy with the given dependencies.
func (*Proxy) ClearCachedArtifact ¶ added in v0.8.0
func (p *Proxy) ClearCachedArtifact(ctx context.Context, ecosystem, name, version, filename string) error
ClearCachedArtifact removes both an artifact cache record and its stored bytes after an external integrity check fails.
func (*Proxy) FetchOrCacheMetadata ¶
func (p *Proxy) FetchOrCacheMetadata(ctx context.Context, ecosystem, cacheKey, upstreamURL string, acceptHeaders ...string) ([]byte, string, error)
FetchOrCacheMetadata fetches metadata from upstream with caching. On success it returns the raw response bytes and content type. If upstream fails and a cached copy exists, the cached version is returned. cacheKey is typically the package name but can include subpath components. Optional acceptHeaders specify the Accept header(s) to send; defaults to application/json.
func (*Proxy) GetCachedArtifact ¶ added in v0.7.0
func (p *Proxy) GetCachedArtifact(ctx context.Context, ecosystem, name, version, filename string) (*CacheResult, error)
GetCachedArtifact retrieves an artifact from cache without contacting an upstream. It returns nil when no usable cache entry exists.
func (*Proxy) GetOrFetchArtifact ¶
func (p *Proxy) GetOrFetchArtifact(ctx context.Context, ecosystem, name, version, filename string) (*CacheResult, error)
GetOrFetchArtifact retrieves an artifact from cache or fetches from upstream.
func (*Proxy) GetOrFetchArtifactFromURL ¶
func (p *Proxy) GetOrFetchArtifactFromURL(ctx context.Context, ecosystem, name, version, filename, downloadURL string) (*CacheResult, error)
GetOrFetchArtifactFromURL retrieves an artifact from cache or fetches from a specific URL. This is useful for registries where download URLs are determined from metadata.
func (*Proxy) GetOrFetchArtifactFromURLWithDigest ¶ added in v0.8.0
func (p *Proxy) GetOrFetchArtifactFromURLWithDigest(ctx context.Context, ecosystem, name, version, filename, downloadURL, digest string) (*CacheResult, error)
GetOrFetchArtifactFromURLWithDigest retrieves an artifact and verifies its SHA-256 digest before adding a newly fetched response to the cache. Non-sha256 digests are proxied without verification.
func (*Proxy) GetOrFetchArtifactFromURLWithHeaders ¶
func (p *Proxy) GetOrFetchArtifactFromURLWithHeaders(ctx context.Context, ecosystem, name, version, filename, downloadURL string, headers http.Header) (*CacheResult, error)
GetOrFetchArtifactFromURLWithHeaders retrieves an artifact from cache or fetches from a URL with additional request-specific HTTP headers.
func (*Proxy) ProxyCached ¶
func (p *Proxy) ProxyCached(w http.ResponseWriter, r *http.Request, upstreamURL, ecosystem, cacheKey string, acceptHeaders ...string)
ProxyCached fetches metadata from upstream (with optional caching for offline fallback) and writes it to the response. Optional acceptHeaders specify the Accept header to send. When metadata caching is disabled, the response is streamed directly to avoid buffering large metadata responses (e.g. npm packages with many versions) in memory.
func (*Proxy) ProxyFile ¶
ProxyFile forwards a file request to upstream, copying all response headers.
func (*Proxy) ProxyUpstream ¶
func (p *Proxy) ProxyUpstream(w http.ResponseWriter, r *http.Request, upstreamURL string, forwardHeaders []string)
ProxyUpstream forwards a request to an upstream URL without caching. It copies the request, forwards specified headers, and streams the response back. If forwardHeaders is nil, all response headers are copied.
func (*Proxy) ReadMetadata ¶ added in v0.5.0
ReadMetadata reads an upstream response body with a size limit to prevent OOM from unexpectedly large responses. Returns ErrMetadataTooLarge if the response is truncated by the limit.
func (*Proxy) ServeScanFetch ¶ added in v0.8.0
func (p *Proxy) ServeScanFetch(w http.ResponseWriter, r *http.Request)
ServeScanFetch streams a storage object to a caller presenting a valid short-lived HMAC token, so external scanners can pull a staged artifact without going through cooldown or the scan hook themselves. This handler never calls GetOrFetchArtifact/fetchAndCache/storeArtifact — the separation from the normal request path is structural, not a conditional bypass flag.
This route exists only for scanners configured under ScanningConfig; the URL is minted by scanFetchURL and passed as fetch_url in the scan notify request. It is not part of the public API and should be restricted to internal-network access at the ingress/network-policy layer — the HMAC scoping (one object, short TTL) limits what a leaked token can do, but isn't a substitute for network restriction.
@Summary Fetch a staged artifact for scanning @Description Streams the exact bytes staged in storage for a pre-cache security scan. @Description Requires a short-lived HMAC-signed token minted by the proxy itself and @Description delivered via the fetch_url field of the scan notify request (see the @Description Artifact Scanning section of docs/configuration.md). Not part of the @Description public API; restrict access to the scanner network at the ingress layer. @Tags scanning @Produce application/octet-stream @Param path query string true "Storage path of the staged artifact" @Param exp query int true "Token expiry, Unix seconds" @Param sig query string true "HMAC-SHA256 signature over the string path|exp" @Success 200 {file} file @Failure 403 {string} string "invalid, expired, or tampered token" @Failure 404 {string} string "object not found in storage, or scanning is not configured" @Router /_internal/scan-fetch [get]
type PubHandler ¶
type PubHandler struct {
// contains filtered or unexported fields
}
PubHandler handles pub.dev registry protocol requests.
func NewPubHandler ¶
func NewPubHandler(proxy *Proxy, proxyURL string) *PubHandler
NewPubHandler creates a new pub.dev protocol handler.
func NewPubHandlerWithUpstream ¶ added in v0.8.0
func NewPubHandlerWithUpstream(proxy *Proxy, proxyURL, upstreamURL string) *PubHandler
NewPubHandlerWithUpstream creates a pub handler with a custom upstream.
func (*PubHandler) Routes ¶
func (h *PubHandler) Routes() http.Handler
Routes returns the HTTP handler for pub requests.
type PyPIHandler ¶
type PyPIHandler struct {
// contains filtered or unexported fields
}
PyPIHandler handles PyPI registry protocol requests.
func NewPyPIHandler ¶
func NewPyPIHandler(proxy *Proxy, proxyURL string) *PyPIHandler
NewPyPIHandler creates a new PyPI protocol handler.
func NewPyPIHandlerWithUpstreams ¶ added in v0.8.0
func NewPyPIHandlerWithUpstreams(proxy *Proxy, proxyURL, upstreamURL, downloadURL string) *PyPIHandler
NewPyPIHandlerWithUpstreams creates a PyPI handler with custom API and package download upstreams.
func (*PyPIHandler) Routes ¶
func (h *PyPIHandler) Routes() http.Handler
Routes returns the HTTP handler for PyPI requests.
type RPMHandler ¶
type RPMHandler struct {
// contains filtered or unexported fields
}
RPMHandler handles RPM/Yum repository protocol requests. It proxies requests to upstream RPM repositories and caches .rpm packages.
func NewRPMHandler ¶
func NewRPMHandler(proxy *Proxy, proxyURL string) *RPMHandler
NewRPMHandler creates a new RPM/Yum protocol handler.
func NewRPMHandlerWithUpstream ¶ added in v0.8.0
func NewRPMHandlerWithUpstream(proxy *Proxy, proxyURL, upstreamURL string) *RPMHandler
NewRPMHandlerWithUpstream creates an RPM handler with a custom upstream.
func (*RPMHandler) Routes ¶
func (h *RPMHandler) Routes() http.Handler
Routes returns the HTTP handler for RPM requests. Mount this at /rpm on your router.
type SwiftHandler ¶ added in v0.8.0
type SwiftHandler struct {
// contains filtered or unexported fields
}
SwiftHandler handles the read-only Swift Package Registry v1 protocol.
func NewSwiftHandler ¶ added in v0.8.0
func NewSwiftHandler(proxy *Proxy, proxyURL, upstreamURL string) *SwiftHandler
NewSwiftHandler creates a Swift Package Registry protocol handler.
func (*SwiftHandler) Routes ¶ added in v0.8.0
func (h *SwiftHandler) Routes() http.Handler
Routes returns the HTTP handler for Swift registry requests.