Help us shape the future of Go! Take the 2026 Go Developer Survey

dependencyfirewall

package
v1.17.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 27, 2026 License: AGPL-3.0 Imports: 33 Imported by: 0

Documentation

Overview

Copyright (C) 2026 l3montree GmbH

This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.

You should have received a copy of the GNU Affero General Public License along with this program. If not, see <https://www.gnu.org/licenses/>.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func EcosystemFromString added in v1.15.0 

func EcosystemFromString(eco string) ecosystem

Types

type CacheStats added in v1.17.0 

type CacheStats struct {
	SizeBytes int64 `json:"sizeBytes"`
	MaxBytes  int64 `json:"maxBytes"`
	Entries   int   `json:"entries"`
	Hits      int64 `json:"hits"`
	Misses    int64 `json:"misses"`
	Evictions int64 `json:"evictions"`
}

type ComposerDependencyProxyController added in v1.16.0 

type ComposerDependencyProxyController struct {
	*DependencyProxyController
}

ComposerDependencyProxyController handles php dependency proxy requests. It embeds DependencyProxyController to reuse shared helpers and state.

func NewComposerDependencyProxyController added in v1.16.0 

func NewComposerDependencyProxyController(controller *DependencyProxyController) *ComposerDependencyProxyController

func (*ComposerDependencyProxyController) ProxyComposer added in v1.16.0 

func (d *ComposerDependencyProxyController) ProxyComposer(c shared.Context) error

ProxyComposer dispatches a request to the root, metadata or dist handler. All three kinds of request live in the same path tree, so they cannot be told apart by route. @Summary Proxy Composer repository request @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Success 200 {file} binary @Router /dependency-proxy/{secret}/composer/{path} [get]

type DebDependencyProxyController added in v1.16.0 

type DebDependencyProxyController struct {
	*DependencyProxyController
}

DEBDependencyProxyController handles debian dependency proxy requests. It embeds DependencyProxyController to reuse shared helpers and state.

func NewDebDependencyProxyController added in v1.16.0 

func NewDebDependencyProxyController(controller *DependencyProxyController) *DebDependencyProxyController

func (*DebDependencyProxyController) ProxyDeb added in v1.16.0 

func (d *DebDependencyProxyController) ProxyDeb(c shared.Context) error

@Summary Proxy Debian repository request @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Success 200 {file} binary @Router /dependency-proxy/{secret}/deb/{path} [get]

type DependencyProxyCache 

type DependencyProxyCache struct {
	CacheDir string
	// MaxSizeMB bounds the size of each organization's in-memory-tracked,
	// disk-backed package cache. Defaults to 1024 (1GB) per organization if unset.
	MaxSizeMB int
}

type DependencyProxyConfigs 

type DependencyProxyConfigs struct {
	Rules         []string          `json:"rules"`
	MinReleaseAge int               `json:"minReleaseAge"` // in hours
	Registries    map[string]string `json:"registries"`
	Secret        uuid.UUID         `json:"-"`
}

type DependencyProxyController 

type DependencyProxyController struct {
	// contains filtered or unexported fields
}

func NewDependencyProxyController 

func NewDependencyProxyController(
	dependencyProxyService shared.DependencyProxySecretService,
	config DependencyProxyCache,
	maliciousChecker shared.MaliciousPackageChecker,
	assetRepository shared.AssetRepository,
	projectRepository shared.ProjectRepository,
	orgRepository shared.OrganizationRepository,
) *DependencyProxyController

func (*DependencyProxyController) CheckNotAllowedPackage 

func (d *DependencyProxyController) CheckNotAllowedPackage(ctx context.Context, eco ecosystem, path string, configs DependencyProxyConfigs) (bool, string)

func (*DependencyProxyController) GetAssetDependencyProxyURLs added in v1.13.3 

func (d *DependencyProxyController) GetAssetDependencyProxyURLs(ctx shared.Context) error

@Summary Get asset dependency proxy URLs @Tags Dependency Firewall @Security CookieAuth @Security PATAuth @Security BearerAuth @Param organization path string true "organization slug" @Param projectSlug path string true "project slug" @Param assetSlug path string true "asset slug" @Success 200 {object} map[string]string @Router /organizations/{organization}/projects/{projectSlug}/assets/{assetSlug}/dependency-proxy-urls/ [get]

func (*DependencyProxyController) GetDependencyProxyConfigs 

func (d *DependencyProxyController) GetDependencyProxyConfigs(c shared.Context) (DependencyProxyConfigs, error)

GetDependencyProxyConfigs reads the proxy secret from the `:secret` route parameter and delegates to LoadConfigsBySecret.

func (*DependencyProxyController) GetDependencyProxyURLs 

func (d *DependencyProxyController) GetDependencyProxyURLs(ctx shared.Context) error

func (*DependencyProxyController) GetInstanceCacheStats added in v1.17.0 

func (d *DependencyProxyController) GetInstanceCacheStats(ctx shared.Context) error

@Summary Get instance-wide dependency proxy cache statistics @Tags Admin @Security AdminSignedAuth @Success 200 {object} dependencyfirewall.CacheStats @Router /admin/statistics/dependency-proxy-cache/ [get]

func (*DependencyProxyController) GetOrgDependencyProxyURLs added in v1.13.3 

func (d *DependencyProxyController) GetOrgDependencyProxyURLs(ctx shared.Context) error

@Summary Get organization dependency proxy URLs @Tags Dependency Firewall @Security CookieAuth @Security PATAuth @Security BearerAuth @Param organization path string true "organization slug" @Success 200 {object} map[string]string @Router /organizations/{organization}/dependency-proxy-urls/ [get]

func (*DependencyProxyController) GetProjectDependencyProxyURLs added in v1.13.3 

func (d *DependencyProxyController) GetProjectDependencyProxyURLs(ctx shared.Context) error

@Summary Get project dependency proxy URLs @Tags Dependency Firewall @Security CookieAuth @Security PATAuth @Security BearerAuth @Param organization path string true "organization slug" @Param projectSlug path string true "project slug" @Success 200 {object} map[string]string @Router /organizations/{organization}/projects/{projectSlug}/dependency-proxy-urls/ [get]

func (*DependencyProxyController) GetSecretCacheStats added in v1.17.0 

func (d *DependencyProxyController) GetSecretCacheStats(ctx shared.Context) error

@Summary Get dependency proxy cache statistics for an organization, project or asset @Tags Dependency Firewall @Security CookieAuth @Security PATAuth @Security BearerAuth @Param organization path string true "organization slug" @Success 200 {object} dependencyfirewall.CacheStats @Router /organizations/{organization}/dependency-proxy/cache-stats/ [get] @Router /organizations/{organization}/projects/{projectSlug}/dependency-proxy/cache-stats/ [get] @Router /organizations/{organization}/projects/{projectSlug}/assets/{assetSlug}/dependency-proxy/cache-stats/ [get]

func (*DependencyProxyController) LoadConfigsBySecret 

func (d *DependencyProxyController) LoadConfigsBySecret(c shared.Context, secret string) (DependencyProxyConfigs, error)

LoadConfigsBySecret resolves DependencyProxyConfigs for a secret string.

type GoDependencyProxyController 

type GoDependencyProxyController struct {
	*DependencyProxyController
}

GoDependencyProxyController handles Go dependency proxy requests. It embeds DependencyProxyController to reuse shared helpers and state.

func NewGoDependencyProxyController 

func NewGoDependencyProxyController(controller *DependencyProxyController) *GoDependencyProxyController

func (*GoDependencyProxyController) ProxyGo 

func (d *GoDependencyProxyController) ProxyGo(c shared.Context) error

@Summary Proxy Go module requests @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Success 200 {file} binary @Router /dependency-proxy/{secret}/go [get] @Router /dependency-proxy/{secret}/go/{path} [get]

type MavenDependencyProxyController added in v1.16.0 

type MavenDependencyProxyController struct {
	*DependencyProxyController
}

MavenDependencyProxyController handles Maven dependency proxy requests. It embeds DependencyProxyController to reuse shared helpers and state.

func NewMavenDependencyProxyController added in v1.16.0 

func NewMavenDependencyProxyController(controller *DependencyProxyController) *MavenDependencyProxyController

func (*MavenDependencyProxyController) ProxyMaven added in v1.16.0 

func (d *MavenDependencyProxyController) ProxyMaven(c shared.Context) error

ProxyMaven dispatches a request to the metadata or the artifact handler. Both kinds of request live in the same path tree, so they cannot be told apart by route. @Summary Proxy Maven repository request @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Success 200 {file} binary @Router /dependency-proxy/{secret}/maven/{path} [get]

type NPMDependencyProxyController 

type NPMDependencyProxyController struct {
	*DependencyProxyController
}

NPMDependencyProxyController handles npm dependency proxy requests. It embeds DependencyProxyController to reuse shared helpers and state.

func NewNPMDependencyProxyController 

func NewNPMDependencyProxyController(controller *DependencyProxyController) *NPMDependencyProxyController

func (*NPMDependencyProxyController) ExtractNPMReleaseTimeFromMetadata added in v1.15.0 

func (d *NPMDependencyProxyController) ExtractNPMReleaseTimeFromMetadata(data []byte, version string) (time.Time, error)

ExtractNPMReleaseTimeFromMetadata parses NPM package metadata JSON and returns the publish time of the given version. A zero time is returned when the version has no publish time.

func (*NPMDependencyProxyController) ProxyNPMMetadata 

func (d *NPMDependencyProxyController) ProxyNPMMetadata(c shared.Context) error

ProxyNPMMetadata handles metadata / version-resolution npm requests (no explicit version in path). Routes: GET /npm/:package and GET /npm/:scope/:name @Summary Proxy npm package metadata @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Param package path string false "npm package name" @Param scope path string false "npm scope" @Param name path string false "npm package name (scoped)" @Success 200 {object} map[string]interface{} @Router /dependency-proxy/{secret}/npm/{package} [get] @Router /dependency-proxy/{secret}/npm/{scope}/{name} [get]

func (*NPMDependencyProxyController) ProxyNPMRegistryAPI added in v1.15.0 

func (d *NPMDependencyProxyController) ProxyNPMRegistryAPI(c shared.Context) error

ProxyNPMRegistryAPI passes npm registry API requests (every path below /-/) through to upstream: audits (POST /-/npm/v1/security/advisories/bulk, /-/npm/v1/security/audits/quick), signing keys (GET /-/npm/v1/keys) and attestations (GET /-/npm/v1/attestations/<pkg>@<version>) used by `npm audit signatures`. These carry no package contents, so no firewall checks apply. @Summary Proxy npm registry API request @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Success 200 {object} map[string]interface{} @Router /dependency-proxy/{secret}/npm/-/{path} [get] @Router /dependency-proxy/{secret}/npm/-/{path} [post]

func (*NPMDependencyProxyController) ProxyNPMTarball 

func (d *NPMDependencyProxyController) ProxyNPMTarball(c shared.Context) error

ProxyNPMTarball handles explicit-version npm requests (.tgz downloads). Routes: GET /npm/:package/-/* and GET /npm/:scope/:name/-/* @Summary Proxy npm tarball download @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Param package path string false "npm package name" @Param scope path string false "npm scope" @Param name path string false "npm package name (scoped)" @Success 200 {file} binary @Router /dependency-proxy/{secret}/npm/{package}/-/{path} [get] @Router /dependency-proxy/{secret}/npm/{scope}/{name}/-/{path} [get]

type OCIDependencyProxyController 

type OCIDependencyProxyController struct {
	*DependencyProxyController
}

OCIDependencyProxyController handles OCI registry proxy requests. Image references must be fully qualified: <registry>/<image> (e.g. docker.io/library/nginx). It embeds DependencyProxyController to reuse shared helpers and state.

func NewOCIDependencyProxyController 

func NewOCIDependencyProxyController(controller *DependencyProxyController) *OCIDependencyProxyController

func (*OCIDependencyProxyController) ProxyOCIBlob 

func (d *OCIDependencyProxyController) ProxyOCIBlob(c shared.Context) error

ProxyOCIBlob handles layer and config blob downloads. Routes:

  • GET|HEAD /oci/v2/:registry/:image/blobs/:digest
  • GET|HEAD /oci/v2/:registry/:namespace/:image/blobs/:digest

@Summary Proxy OCI image blob download @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Param registry path string true "registry hostname" @Param namespace path string false "image namespace" @Param image path string true "image name" @Param digest path string true "blob digest" @Success 200 {file} binary @Router /v2/{secret}/{registry}/{namespace}/{image}/blobs/{digest} [get] @Router /v2/{secret}/{registry}/{namespace}/{image}/blobs/{digest} [head] @Router /v2/{secret}/{registry}/{ns1}/{ns2}/{image}/blobs/{digest} [get] @Router /v2/{secret}/{registry}/{ns1}/{ns2}/{image}/blobs/{digest} [head]

func (*OCIDependencyProxyController) ProxyOCIManifest 

func (d *OCIDependencyProxyController) ProxyOCIManifest(c shared.Context) error

ProxyOCIManifest handles manifest fetch and existence-check requests. The registry hostname is part of the route so that requests are fully qualified: 

docker.io/library/nginx:latest  →  GET /oci/v2/docker.io/library/nginx/manifests/latest
ghcr.io/org/image:sha256:abc    →  GET /oci/v2/ghcr.io/org/image/manifests/sha256:abc

Routes:

  • GET|HEAD /oci/v2/:registry/:image/manifests/:reference
  • GET|HEAD /oci/v2/:registry/:namespace/:image/manifests/:reference

@Summary Proxy OCI image manifest fetch @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Param registry path string true "registry hostname" @Param namespace path string false "image namespace" @Param image path string true "image name" @Param reference path string true "tag or digest" @Success 200 {object} map[string]interface{} @Router /v2/{secret}/{registry}/{namespace}/{image}/manifests/{reference} [get] @Router /v2/{secret}/{registry}/{namespace}/{image}/manifests/{reference} [head] @Router /v2/{secret}/{registry}/{ns1}/{ns2}/{image}/manifests/{reference} [get] @Router /v2/{secret}/{registry}/{ns1}/{ns2}/{image}/manifests/{reference} [head]

func (*OCIDependencyProxyController) ProxyOCIReferrers 

func (d *OCIDependencyProxyController) ProxyOCIReferrers(c shared.Context) error

ProxyOCIReferrers handles the OCI referrers API (signatures, SBOMs, etc.). Routes:

  • GET /v2/:registry/:image/referrers/:digest
  • GET /v2/:registry/:namespace/:image/referrers/:digest

@Summary Proxy OCI image referrers list @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Param registry path string true "registry hostname" @Param namespace path string false "image namespace" @Param image path string true "image name" @Param digest path string true "subject digest" @Success 200 {object} map[string]interface{} @Router /v2/{secret}/{registry}/{namespace}/{image}/referrers/{digest} [get] @Router /v2/{secret}/{registry}/{ns1}/{ns2}/{image}/referrers/{digest} [get]

func (*OCIDependencyProxyController) ProxyOCITagsList 

func (d *OCIDependencyProxyController) ProxyOCITagsList(c shared.Context) error

ProxyOCITagsList handles image tag listing. Routes:

  • GET /oci/v2/:registry/:image/tags/list
  • GET /oci/v2/:registry/:namespace/:image/tags/list

@Summary Proxy OCI image tags list @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Param registry path string true "registry hostname" @Param namespace path string false "image namespace" @Param image path string true "image name" @Success 200 {object} map[string]interface{} @Router /v2/{secret}/{registry}/{namespace}/{image}/tags/list [get] @Router /v2/{secret}/{registry}/{ns1}/{ns2}/{image}/tags/list [get]

func (*OCIDependencyProxyController) ProxyOCIVersionCheck 

func (d *OCIDependencyProxyController) ProxyOCIVersionCheck(c shared.Context) error

ProxyOCIVersionCheck handles the OCI Distribution Spec v2 version check. Route: GET|HEAD /oci/v2/ @Summary OCI Distribution Spec v2 version check @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @Success 200 {object} map[string]string @Router /v2/ [get] @Router /v2 [head]

type PythonDependencyProxyController 

type PythonDependencyProxyController struct {
	*DependencyProxyController
}

PythonDependencyProxyController handles PyPI dependency proxy requests. It embeds DependencyProxyController to reuse shared helpers and state.

func NewPythonDependencyProxyController 

func NewPythonDependencyProxyController(controller *DependencyProxyController) *PythonDependencyProxyController

func (*PythonDependencyProxyController) ProxyPyPIPackage 

func (d *PythonDependencyProxyController) ProxyPyPIPackage(c shared.Context) error

ProxyPyPIPackage handles explicit-version PyPI package downloads (from /packages/). Route: GET /pypi/packages/* @Summary Proxy PyPI package download @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Success 200 {file} binary @Router /dependency-proxy/{secret}/pypi/packages/{path} [get]

func (*PythonDependencyProxyController) ProxyPyPISimple 

func (d *PythonDependencyProxyController) ProxyPyPISimple(c shared.Context) error

ProxyPyPISimple handles PyPI /simple/ metadata requests. Route: GET /pypi/simple/:package @Summary Proxy PyPI simple index metadata @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Param package path string true "PyPI package name" @Success 200 {string} string "HTML simple index" @Router /dependency-proxy/{secret}/pypi/simple/{package} [get]

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.