Help us shape the future of Go! Take the 2026 Go Developer Survey

dependencyfirewall

package
v1.14.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 17, 2026 License: AGPL-3.0 Imports: 26 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type DependencyProxyCache 

type DependencyProxyCache struct {
	CacheDir string
	// MaxSizeMB bounds the size of the in-memory-tracked, disk-backed package
	// cache. Defaults to 1024 (1GB) if unset.
	MaxSizeMB int
}

type DependencyProxyConfigs 

type DependencyProxyConfigs struct {
	Rules         []string `json:"rules"`
	MinReleaseAge int      `json:"minReleaseAge"` // in hours
}

type DependencyProxyController 

type DependencyProxyController struct {
	// contains filtered or unexported fields
}

func NewDependencyProxyController 

func NewDependencyProxyController(
	dependencyProxyService shared.DependencyProxySecretService,
	config DependencyProxyCache,
	maliciousChecker shared.MaliciousPackageChecker,
	assetRepository shared.AssetRepository,
	projectRepository shared.ProjectRepository,
	orgRepository shared.OrganizationRepository,
) *DependencyProxyController

func (*DependencyProxyController) CheckNotAllowedPackage 

func (d *DependencyProxyController) CheckNotAllowedPackage(ctx context.Context, eco ecosystem, path string, configs DependencyProxyConfigs) (bool, string)

func (*DependencyProxyController) GetAssetDependencyProxyURLs added in v1.13.3 

func (d *DependencyProxyController) GetAssetDependencyProxyURLs(ctx shared.Context) error

@Summary Get asset dependency proxy URLs @Tags Dependency Firewall @Security CookieAuth @Security PATAuth @Security BearerAuth @Param organization path string true "organization slug" @Param projectSlug path string true "project slug" @Param assetSlug path string true "asset slug" @Success 200 {object} map[string]string @Router /organizations/{organization}/projects/{projectSlug}/assets/{assetSlug}/dependency-proxy-urls/ [get]

func (*DependencyProxyController) GetDependencyProxyConfigs 

func (d *DependencyProxyController) GetDependencyProxyConfigs(c shared.Context) (DependencyProxyConfigs, error)

GetDependencyProxyConfigs reads the proxy secret from the `:secret` route parameter and delegates to LoadConfigsBySecret.

func (*DependencyProxyController) GetDependencyProxyURLs 

func (d *DependencyProxyController) GetDependencyProxyURLs(ctx shared.Context) error

func (*DependencyProxyController) GetOrgDependencyProxyURLs added in v1.13.3 

func (d *DependencyProxyController) GetOrgDependencyProxyURLs(ctx shared.Context) error

@Summary Get organization dependency proxy URLs @Tags Dependency Firewall @Security CookieAuth @Security PATAuth @Security BearerAuth @Param organization path string true "organization slug" @Success 200 {object} map[string]string @Router /organizations/{organization}/dependency-proxy-urls/ [get]

func (*DependencyProxyController) GetProjectDependencyProxyURLs added in v1.13.3 

func (d *DependencyProxyController) GetProjectDependencyProxyURLs(ctx shared.Context) error

@Summary Get project dependency proxy URLs @Tags Dependency Firewall @Security CookieAuth @Security PATAuth @Security BearerAuth @Param organization path string true "organization slug" @Param projectSlug path string true "project slug" @Success 200 {object} map[string]string @Router /organizations/{organization}/projects/{projectSlug}/dependency-proxy-urls/ [get]

func (*DependencyProxyController) LoadConfigsBySecret 

func (d *DependencyProxyController) LoadConfigsBySecret(c shared.Context, secret string) (DependencyProxyConfigs, error)

LoadConfigsBySecret resolves DependencyProxyConfigs for a secret string. An empty secret returns empty (permissive) configs without error.

type GoDependencyProxyController 

type GoDependencyProxyController struct {
	*DependencyProxyController
}

GoDependencyProxyController handles Go dependency proxy requests. It embeds DependencyProxyController to reuse shared helpers and state.

func NewGoDependencyProxyController 

func NewGoDependencyProxyController(controller *DependencyProxyController) *GoDependencyProxyController

func (*GoDependencyProxyController) ExtractGoVersionAndReleaseTime 

func (d *GoDependencyProxyController) ExtractGoVersionAndReleaseTime(data []byte) (string, time.Time, bool)

ExtractGoVersionAndReleaseTime parses a Go proxy .info response and returns the resolved version and its release time.

func (*GoDependencyProxyController) ProxyGo 

func (d *GoDependencyProxyController) ProxyGo(c shared.Context) error

@Summary Proxy Go module requests @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @Param secret path string false "dependency proxy secret" @Success 200 {file} binary @Router /dependency-proxy/go [get] @Router /dependency-proxy/go/{path} [get] @Router /dependency-proxy/{secret}/go [get] @Router /dependency-proxy/{secret}/go/{path} [get]

type NPMDependencyProxyController 

type NPMDependencyProxyController struct {
	*DependencyProxyController
}

NPMDependencyProxyController handles npm dependency proxy requests. It embeds DependencyProxyController to reuse shared helpers and state.

func NewNPMDependencyProxyController 

func NewNPMDependencyProxyController(controller *DependencyProxyController) *NPMDependencyProxyController

func (*NPMDependencyProxyController) ExtractNPMVersionAndReleaseTimeFromMetadata 

func (d *NPMDependencyProxyController) ExtractNPMVersionAndReleaseTimeFromMetadata(data []byte) (string, time.Time)

ExtractNPMVersionAndReleaseTimeFromMetadata parses NPM package metadata JSON and extracts the latest version and its release time.

func (*NPMDependencyProxyController) ProxyNPMAudit 

func (d *NPMDependencyProxyController) ProxyNPMAudit(c shared.Context) error

@Summary Proxy npm audit request @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @Param secret path string false "dependency proxy secret" @Success 200 {object} map[string]interface{} @Router /dependency-proxy/npm/{path} [post] @Router /dependency-proxy/{secret}/npm/{path} [post]

func (*NPMDependencyProxyController) ProxyNPMMetadata 

func (d *NPMDependencyProxyController) ProxyNPMMetadata(c shared.Context) error

ProxyNPMMetadata handles metadata / version-resolution npm requests (no explicit version in path). Routes: GET /npm/:package and GET /npm/:scope/:name @Summary Proxy npm package metadata @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @Param secret path string false "dependency proxy secret" @Param package path string false "npm package name" @Param scope path string false "npm scope" @Param name path string false "npm package name (scoped)" @Success 200 {object} map[string]interface{} @Router /dependency-proxy/npm/{package} [get] @Router /dependency-proxy/npm/{scope}/{name} [get] @Router /dependency-proxy/{secret}/npm/{package} [get] @Router /dependency-proxy/{secret}/npm/{scope}/{name} [get]

func (*NPMDependencyProxyController) ProxyNPMTarball 

func (d *NPMDependencyProxyController) ProxyNPMTarball(c shared.Context) error

ProxyNPMTarball handles explicit-version npm requests (.tgz downloads). Routes: GET /npm/:package/-/* and GET /npm/:scope/:name/-/* @Summary Proxy npm tarball download @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @Param secret path string false "dependency proxy secret" @Param package path string false "npm package name" @Param scope path string false "npm scope" @Param name path string false "npm package name (scoped)" @Success 200 {file} binary @Router /dependency-proxy/npm/{package}/-/{path} [get] @Router /dependency-proxy/npm/{scope}/{name}/-/{path} [get] @Router /dependency-proxy/{secret}/npm/{package}/-/{path} [get] @Router /dependency-proxy/{secret}/npm/{scope}/{name}/-/{path} [get]

type OCIDependencyProxyController 

type OCIDependencyProxyController struct {
	*DependencyProxyController
}

OCIDependencyProxyController handles OCI registry proxy requests. Image references must be fully qualified: <registry>/<image> (e.g. docker.io/library/nginx). It embeds DependencyProxyController to reuse shared helpers and state.

func NewOCIDependencyProxyController 

func NewOCIDependencyProxyController(controller *DependencyProxyController) *OCIDependencyProxyController

func (*OCIDependencyProxyController) ProxyOCIBlob 

func (d *OCIDependencyProxyController) ProxyOCIBlob(c shared.Context) error

ProxyOCIBlob handles layer and config blob downloads. Routes:

  • GET|HEAD /oci/v2/:registry/:image/blobs/:digest
  • GET|HEAD /oci/v2/:registry/:namespace/:image/blobs/:digest

@Summary Proxy OCI image blob download @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @Param secret path string false "dependency proxy secret" @Param registry path string true "registry hostname" @Param namespace path string false "image namespace" @Param image path string true "image name" @Param digest path string true "blob digest" @Success 200 {file} binary @Router /v2/{registry}/{image}/blobs/{digest} [get] @Router /v2/{registry}/{image}/blobs/{digest} [head] @Router /v2/{registry}/{namespace}/{image}/blobs/{digest} [get] @Router /v2/{registry}/{namespace}/{image}/blobs/{digest} [head] @Router /v2/{secret}/{registry}/{namespace}/{image}/blobs/{digest} [get] @Router /v2/{secret}/{registry}/{namespace}/{image}/blobs/{digest} [head] @Router /v2/{secret}/{registry}/{ns1}/{ns2}/{image}/blobs/{digest} [get] @Router /v2/{secret}/{registry}/{ns1}/{ns2}/{image}/blobs/{digest} [head]

func (*OCIDependencyProxyController) ProxyOCIManifest 

func (d *OCIDependencyProxyController) ProxyOCIManifest(c shared.Context) error

ProxyOCIManifest handles manifest fetch and existence-check requests. The registry hostname is part of the route so that requests are fully qualified: 

docker.io/library/nginx:latest  →  GET /oci/v2/docker.io/library/nginx/manifests/latest
ghcr.io/org/image:sha256:abc    →  GET /oci/v2/ghcr.io/org/image/manifests/sha256:abc

Routes:

  • GET|HEAD /oci/v2/:registry/:image/manifests/:reference
  • GET|HEAD /oci/v2/:registry/:namespace/:image/manifests/:reference

@Summary Proxy OCI image manifest fetch @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @Param secret path string false "dependency proxy secret" @Param registry path string true "registry hostname" @Param namespace path string false "image namespace" @Param image path string true "image name" @Param reference path string true "tag or digest" @Success 200 {object} map[string]interface{} @Router /v2/{registry}/{image}/manifests/{reference} [get] @Router /v2/{registry}/{image}/manifests/{reference} [head] @Router /v2/{registry}/{namespace}/{image}/manifests/{reference} [get] @Router /v2/{registry}/{namespace}/{image}/manifests/{reference} [head] @Router /v2/{secret}/{registry}/{namespace}/{image}/manifests/{reference} [get] @Router /v2/{secret}/{registry}/{namespace}/{image}/manifests/{reference} [head] @Router /v2/{secret}/{registry}/{ns1}/{ns2}/{image}/manifests/{reference} [get] @Router /v2/{secret}/{registry}/{ns1}/{ns2}/{image}/manifests/{reference} [head]

func (*OCIDependencyProxyController) ProxyOCIReferrers 

func (d *OCIDependencyProxyController) ProxyOCIReferrers(c shared.Context) error

ProxyOCIReferrers handles the OCI referrers API (signatures, SBOMs, etc.). Routes:

  • GET /v2/:registry/:image/referrers/:digest
  • GET /v2/:registry/:namespace/:image/referrers/:digest

@Summary Proxy OCI image referrers list @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @Param secret path string false "dependency proxy secret" @Param registry path string true "registry hostname" @Param namespace path string false "image namespace" @Param image path string true "image name" @Param digest path string true "subject digest" @Success 200 {object} map[string]interface{} @Router /v2/{registry}/{image}/referrers/{digest} [get] @Router /v2/{registry}/{namespace}/{image}/referrers/{digest} [get] @Router /v2/{secret}/{registry}/{namespace}/{image}/referrers/{digest} [get] @Router /v2/{secret}/{registry}/{ns1}/{ns2}/{image}/referrers/{digest} [get]

func (*OCIDependencyProxyController) ProxyOCITagsList 

func (d *OCIDependencyProxyController) ProxyOCITagsList(c shared.Context) error

ProxyOCITagsList handles image tag listing. Routes:

  • GET /oci/v2/:registry/:image/tags/list
  • GET /oci/v2/:registry/:namespace/:image/tags/list

@Summary Proxy OCI image tags list @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @Param secret path string false "dependency proxy secret" @Param registry path string true "registry hostname" @Param namespace path string false "image namespace" @Param image path string true "image name" @Success 200 {object} map[string]interface{} @Router /v2/{registry}/{image}/tags/list [get] @Router /v2/{registry}/{namespace}/{image}/tags/list [get] @Router /v2/{secret}/{registry}/{namespace}/{image}/tags/list [get] @Router /v2/{secret}/{registry}/{ns1}/{ns2}/{image}/tags/list [get]

func (*OCIDependencyProxyController) ProxyOCIVersionCheck 

func (d *OCIDependencyProxyController) ProxyOCIVersionCheck(c shared.Context) error

ProxyOCIVersionCheck handles the OCI Distribution Spec v2 version check. Route: GET|HEAD /oci/v2/ @Summary OCI Distribution Spec v2 version check @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @Success 200 {object} map[string]string @Router /v2/ [get] @Router /v2 [head]

type PythonDependencyProxyController 

type PythonDependencyProxyController struct {
	*DependencyProxyController
}

PythonDependencyProxyController handles PyPI dependency proxy requests. It embeds DependencyProxyController to reuse shared helpers and state.

func NewPythonDependencyProxyController 

func NewPythonDependencyProxyController(controller *DependencyProxyController) *PythonDependencyProxyController

func (*PythonDependencyProxyController) ExtractPyPIReleaseTime 

func (d *PythonDependencyProxyController) ExtractPyPIReleaseTime(data []byte, version string) (string, time.Time, bool)

ExtractPyPIReleaseTime parses a PyPI JSON API response and returns the resolved version and its upload time. If version is empty, it uses info.version (the current release).

func (*PythonDependencyProxyController) ProxyPyPIPackage 

func (d *PythonDependencyProxyController) ProxyPyPIPackage(c shared.Context) error

ProxyPyPIPackage handles explicit-version PyPI package downloads (from /packages/). Route: GET /pypi/packages/* @Summary Proxy PyPI package download @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @Param secret path string false "dependency proxy secret" @Success 200 {file} binary @Router /dependency-proxy/pypi/packages/{path} [get] @Router /dependency-proxy/{secret}/pypi/packages/{path} [get]

func (*PythonDependencyProxyController) ProxyPyPISimple 

func (d *PythonDependencyProxyController) ProxyPyPISimple(c shared.Context) error

ProxyPyPISimple handles PyPI /simple/ metadata requests, resolving the latest version before checking rules. Route: GET /pypi/simple/:package @Summary Proxy PyPI simple index metadata @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @Param secret path string false "dependency proxy secret" @Param package path string true "PyPI package name" @Success 200 {string} string "HTML simple index" @Router /dependency-proxy/pypi/simple/{package} [get] @Router /dependency-proxy/{secret}/pypi/simple/{package} [get]

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.