dependencyfirewall

package
v1.18.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 6, 2026 License: AGPL-3.0 Imports: 57 Imported by: 0

Documentation

Overview

Copyright (C) 2026 l3montree GmbH

This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more details.

You should have received a copy of the GNU Affero General Public License along with this program. If not, see <https://www.gnu.org/licenses/>.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func EcosystemFromString added in v1.15.0 

func EcosystemFromString(eco string) ecosystem

func ExtractNPMPackageFromMetadata added in v1.18.0 

func ExtractNPMPackageFromMetadata(data []byte, version string) (celrules.Package, error)

func SecurityHeadersMiddleware added in v1.18.0 

func SecurityHeadersMiddleware(next echo.HandlerFunc) echo.HandlerFunc

Types

type AlpineDependencyProxyController added in v1.18.0 

type AlpineDependencyProxyController struct {
	*DependencyProxyController
	// contains filtered or unexported fields
}

func NewAlpineDependencyProxyController added in v1.18.0 

func NewAlpineDependencyProxyController(controller *DependencyProxyController) *AlpineDependencyProxyController

func (*AlpineDependencyProxyController) ProxyAlpine added in v1.18.0 

func (d *AlpineDependencyProxyController) ProxyAlpine(c shared.Context) error

@Summary Proxy Alpine repository request @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Success 200 {file} binary @Router /dependency-proxy/{secret}/apk/{path} [get]

type CacheStats added in v1.17.0 

type CacheStats struct {
	SizeBytes int64 `json:"sizeBytes"`
	MaxBytes  int64 `json:"maxBytes"`
	Entries   int   `json:"entries"`
	Hits      int64 `json:"hits"`
	Misses    int64 `json:"misses"`
	Evictions int64 `json:"evictions"`
}

type ComposerDependencyProxyController added in v1.16.0 

type ComposerDependencyProxyController struct {
	*DependencyProxyController
}

ComposerDependencyProxyController handles php dependency proxy requests. It embeds DependencyProxyController to reuse shared helpers and state.

func NewComposerDependencyProxyController added in v1.16.0 

func NewComposerDependencyProxyController(controller *DependencyProxyController) *ComposerDependencyProxyController

func (*ComposerDependencyProxyController) ProxyComposer added in v1.16.0 

func (d *ComposerDependencyProxyController) ProxyComposer(c shared.Context) error

ProxyComposer dispatches a request to the root, metadata or dist handler. All three kinds of request live in the same path tree, so they cannot be told apart by route. @Summary Proxy Composer repository request @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Success 200 {file} binary @Router /dependency-proxy/{secret}/composer/{path} [get]

type DebDependencyProxyController added in v1.16.0 

type DebDependencyProxyController struct {
	*DependencyProxyController
	// contains filtered or unexported fields
}

DEBDependencyProxyController handles debian dependency proxy requests. It embeds DependencyProxyController to reuse shared helpers and state.

func NewDebDependencyProxyController added in v1.16.0 

func NewDebDependencyProxyController(controller *DependencyProxyController, debReleaseTimeService shared.DebReleaseTimeService) *DebDependencyProxyController

func (*DebDependencyProxyController) ProxyDeb added in v1.16.0 

func (d *DebDependencyProxyController) ProxyDeb(c shared.Context) error

@Summary Proxy Debian repository request @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Success 200 {file} binary @Router /dependency-proxy/{secret}/deb/{path} [get]

type DependencyProxyCache 

type DependencyProxyCache struct {
	CacheDir string
	// MaxSizeMB bounds the size of each organization's in-memory-tracked,
	// disk-backed package cache. Defaults to 1024 (1GB) per organization if unset.
	MaxSizeMB int
}

type DependencyProxyConfigs 

type DependencyProxyConfigs struct {
	Rules      []celrules.CompiledPackageRule `yaml:"-"`
	Registries dtos.RegistryConfigs           `yaml:"registries"`
	Secret     uuid.UUID                      `yaml:"-"`
	Hash       string                         `yaml:"-"`
}

type DependencyProxyController 

type DependencyProxyController struct {
	// contains filtered or unexported fields
}

func NewDependencyProxyController 

func NewDependencyProxyController(
	dependencyProxyService shared.DependencyProxySecretService,
	config DependencyProxyCache,
	maliciousChecker shared.MaliciousPackageChecker,
	assetRepository shared.AssetRepository,
	projectRepository shared.ProjectRepository,
	orgRepository shared.OrganizationRepository,
) *DependencyProxyController

func (*DependencyProxyController) CheckNotAllowedPackage 

func (d *DependencyProxyController) CheckNotAllowedPackage(pkg celrules.Package, configs DependencyProxyConfigs) (bool, string)

func (*DependencyProxyController) GetAssetDependencyProxyURLs added in v1.13.3 

func (d *DependencyProxyController) GetAssetDependencyProxyURLs(ctx shared.Context) error

@Summary Get asset dependency proxy URLs @Tags Dependency Firewall @Security CookieAuth @Security PATAuth @Security BearerAuth @Param organization path string true "organization slug" @Param projectSlug path string true "project slug" @Param assetSlug path string true "asset slug" @Success 200 {object} map[string]string @Router /organizations/{organization}/projects/{projectSlug}/assets/{assetSlug}/dependency-proxy-urls/ [get]

func (*DependencyProxyController) GetDependencyProxyConfigs 

func (d *DependencyProxyController) GetDependencyProxyConfigs(c shared.Context) (DependencyProxyConfigs, error)

GetDependencyProxyConfigs reads the proxy secret from the `:secret` route parameter and delegates to LoadConfigsBySecret.

func (*DependencyProxyController) GetDependencyProxyURLs 

func (d *DependencyProxyController) GetDependencyProxyURLs(ctx shared.Context) error

func (*DependencyProxyController) GetInstanceCacheStats added in v1.17.0 

func (d *DependencyProxyController) GetInstanceCacheStats(ctx shared.Context) error

@Summary Get instance-wide dependency proxy cache statistics @Tags Admin @Security AdminSignedAuth @Success 200 {object} dependencyfirewall.CacheStats @Router /admin/statistics/dependency-proxy-cache/ [get]

func (*DependencyProxyController) GetOrgDependencyProxyURLs added in v1.13.3 

func (d *DependencyProxyController) GetOrgDependencyProxyURLs(ctx shared.Context) error

@Summary Get organization dependency proxy URLs @Tags Dependency Firewall @Security CookieAuth @Security PATAuth @Security BearerAuth @Param organization path string true "organization slug" @Success 200 {object} map[string]string @Router /organizations/{organization}/dependency-proxy-urls/ [get]

func (*DependencyProxyController) GetProjectDependencyProxyURLs added in v1.13.3 

func (d *DependencyProxyController) GetProjectDependencyProxyURLs(ctx shared.Context) error

@Summary Get project dependency proxy URLs @Tags Dependency Firewall @Security CookieAuth @Security PATAuth @Security BearerAuth @Param organization path string true "organization slug" @Param projectSlug path string true "project slug" @Success 200 {object} map[string]string @Router /organizations/{organization}/projects/{projectSlug}/dependency-proxy-urls/ [get]

func (*DependencyProxyController) GetSecretCacheStats added in v1.17.0 

func (d *DependencyProxyController) GetSecretCacheStats(ctx shared.Context) error

@Summary Get dependency proxy cache statistics for an organization, project or asset @Tags Dependency Firewall @Security CookieAuth @Security PATAuth @Security BearerAuth @Param organization path string true "organization slug" @Success 200 {object} dependencyfirewall.CacheStats @Router /organizations/{organization}/dependency-proxy/cache-stats/ [get] @Router /organizations/{organization}/projects/{projectSlug}/dependency-proxy/cache-stats/ [get] @Router /organizations/{organization}/projects/{projectSlug}/assets/{assetSlug}/dependency-proxy/cache-stats/ [get]

func (*DependencyProxyController) LoadConfigsBySecret 

func (d *DependencyProxyController) LoadConfigsBySecret(c shared.Context, secret string) (DependencyProxyConfigs, error)

LoadConfigsBySecret resolves DependencyProxyConfigs for a secret string.

type GoDependencyProxyController 

type GoDependencyProxyController struct {
	*DependencyProxyController
}

GoDependencyProxyController handles Go dependency proxy requests. It embeds DependencyProxyController to reuse shared helpers and state.

func NewGoDependencyProxyController 

func NewGoDependencyProxyController(controller *DependencyProxyController) *GoDependencyProxyController

func (*GoDependencyProxyController) ProxyGo 

func (d *GoDependencyProxyController) ProxyGo(c shared.Context) error

@Summary Proxy Go module requests @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Success 200 {file} binary @Router /dependency-proxy/{secret}/go [get] @Router /dependency-proxy/{secret}/go/{path} [get]

type MavenDependencyProxyController added in v1.16.0 

type MavenDependencyProxyController struct {
	*DependencyProxyController
}

MavenDependencyProxyController handles Maven dependency proxy requests. It embeds DependencyProxyController to reuse shared helpers and state.

func NewMavenDependencyProxyController added in v1.16.0 

func NewMavenDependencyProxyController(controller *DependencyProxyController) *MavenDependencyProxyController

func (*MavenDependencyProxyController) ProxyMaven added in v1.16.0 

func (d *MavenDependencyProxyController) ProxyMaven(c shared.Context) error

ProxyMaven dispatches a request to the metadata or the artifact handler. Both kinds of request live in the same path tree, so they cannot be told apart by route. @Summary Proxy Maven repository request @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Success 200 {file} binary @Router /dependency-proxy/{secret}/maven/{path} [get] @Router /dependency-proxy/{secret}/maven/{path} [head]

type NPMDependencyProxyController 

type NPMDependencyProxyController struct {
	*DependencyProxyController
}

NPMDependencyProxyController handles npm dependency proxy requests. It embeds DependencyProxyController to reuse shared helpers and state.

func NewNPMDependencyProxyController 

func NewNPMDependencyProxyController(controller *DependencyProxyController) *NPMDependencyProxyController

func (*NPMDependencyProxyController) ProxyNPMMetadata 

func (d *NPMDependencyProxyController) ProxyNPMMetadata(c shared.Context) error

ProxyNPMMetadata handles metadata / version-resolution npm requests (no explicit version in path). Routes: GET /npm/:package and GET /npm/:scope/:name @Summary Proxy npm package metadata @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Param package path string false "npm package name" @Param scope path string false "npm scope" @Param name path string false "npm package name (scoped)" @Success 200 {object} map[string]interface{} @Router /dependency-proxy/{secret}/npm/{package} [get] @Router /dependency-proxy/{secret}/npm/{scope}/{name} [get]

func (*NPMDependencyProxyController) ProxyNPMRegistryAPI added in v1.15.0 

func (d *NPMDependencyProxyController) ProxyNPMRegistryAPI(c shared.Context) error

ProxyNPMRegistryAPI passes npm registry API requests (every path below /-/) through to upstream: audits (POST /-/npm/v1/security/advisories/bulk, /-/npm/v1/security/audits/quick), signing keys (GET /-/npm/v1/keys) and attestations (GET /-/npm/v1/attestations/<pkg>@<version>) used by `npm audit signatures`. These carry no package contents, so no firewall checks apply. @Summary Proxy npm registry API request @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Success 200 {object} map[string]interface{} @Router /dependency-proxy/{secret}/npm/-/{path} [get] @Router /dependency-proxy/{secret}/npm/-/{path} [post]

func (*NPMDependencyProxyController) ProxyNPMTarball 

func (d *NPMDependencyProxyController) ProxyNPMTarball(c shared.Context) error

ProxyNPMTarball handles explicit-version npm requests (.tgz downloads). Routes: GET /npm/:package/-/* and GET /npm/:scope/:name/-/* @Summary Proxy npm tarball download @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Param package path string false "npm package name" @Param scope path string false "npm scope" @Param name path string false "npm package name (scoped)" @Success 200 {file} binary @Router /dependency-proxy/{secret}/npm/{package}/-/{path} [get] @Router /dependency-proxy/{secret}/npm/{scope}/{name}/-/{path} [get]

type OCIDependencyProxyController 

type OCIDependencyProxyController struct {
	*DependencyProxyController
}

OCIDependencyProxyController handles OCI registry proxy requests. Image references must be fully qualified: <registry>/<image> (e.g. docker.io/library/nginx). It embeds DependencyProxyController to reuse shared helpers and state.

func NewOCIDependencyProxyController 

func NewOCIDependencyProxyController(controller *DependencyProxyController) *OCIDependencyProxyController

func (*OCIDependencyProxyController) ProxyOCIBlob 

func (d *OCIDependencyProxyController) ProxyOCIBlob(c shared.Context) error

ProxyOCIBlob handles layer and config blob downloads. Routes:

  • GET|HEAD /oci/v2/:registry/:image/blobs/:digest
  • GET|HEAD /oci/v2/:registry/:namespace/:image/blobs/:digest

@Summary Proxy OCI image blob download @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Param registry path string true "registry hostname" @Param namespace path string false "image namespace" @Param image path string true "image name" @Param digest path string true "blob digest" @Success 200 {file} binary @Router /v2/{secret}/{registry}/{namespace}/{image}/blobs/{digest} [get] @Router /v2/{secret}/{registry}/{namespace}/{image}/blobs/{digest} [head] @Router /v2/{secret}/{registry}/{ns1}/{ns2}/{image}/blobs/{digest} [get] @Router /v2/{secret}/{registry}/{ns1}/{ns2}/{image}/blobs/{digest} [head]

func (*OCIDependencyProxyController) ProxyOCIManifest 

func (d *OCIDependencyProxyController) ProxyOCIManifest(c shared.Context) error

ProxyOCIManifest handles manifest fetch and existence-check requests. The registry hostname is part of the route so that requests are fully qualified: 

docker.io/library/nginx:latest  →  GET /oci/v2/docker.io/library/nginx/manifests/latest
ghcr.io/org/image:sha256:abc    →  GET /oci/v2/ghcr.io/org/image/manifests/sha256:abc

Routes:

  • GET|HEAD /oci/v2/:registry/:image/manifests/:reference
  • GET|HEAD /oci/v2/:registry/:namespace/:image/manifests/:reference

@Summary Proxy OCI image manifest fetch @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Param registry path string true "registry hostname" @Param namespace path string false "image namespace" @Param image path string true "image name" @Param reference path string true "tag or digest" @Success 200 {object} map[string]interface{} @Router /v2/{secret}/{registry}/{namespace}/{image}/manifests/{reference} [get] @Router /v2/{secret}/{registry}/{namespace}/{image}/manifests/{reference} [head] @Router /v2/{secret}/{registry}/{ns1}/{ns2}/{image}/manifests/{reference} [get] @Router /v2/{secret}/{registry}/{ns1}/{ns2}/{image}/manifests/{reference} [head]

func (*OCIDependencyProxyController) ProxyOCIReferrers 

func (d *OCIDependencyProxyController) ProxyOCIReferrers(c shared.Context) error

ProxyOCIReferrers handles the OCI referrers API (signatures, SBOMs, etc.). Routes:

  • GET /v2/:registry/:image/referrers/:digest
  • GET /v2/:registry/:namespace/:image/referrers/:digest

@Summary Proxy OCI image referrers list @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Param registry path string true "registry hostname" @Param namespace path string false "image namespace" @Param image path string true "image name" @Param digest path string true "subject digest" @Success 200 {object} map[string]interface{} @Router /v2/{secret}/{registry}/{namespace}/{image}/referrers/{digest} [get] @Router /v2/{secret}/{registry}/{ns1}/{ns2}/{image}/referrers/{digest} [get]

func (*OCIDependencyProxyController) ProxyOCITagsList 

func (d *OCIDependencyProxyController) ProxyOCITagsList(c shared.Context) error

ProxyOCITagsList handles image tag listing. Routes:

  • GET /oci/v2/:registry/:image/tags/list
  • GET /oci/v2/:registry/:namespace/:image/tags/list

@Summary Proxy OCI image tags list @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Param registry path string true "registry hostname" @Param namespace path string false "image namespace" @Param image path string true "image name" @Success 200 {object} map[string]interface{} @Router /v2/{secret}/{registry}/{namespace}/{image}/tags/list [get] @Router /v2/{secret}/{registry}/{ns1}/{ns2}/{image}/tags/list [get]

func (*OCIDependencyProxyController) ProxyOCIVersionCheck 

func (d *OCIDependencyProxyController) ProxyOCIVersionCheck(c shared.Context) error

ProxyOCIVersionCheck handles the OCI Distribution Spec v2 version check. Route: GET|HEAD /oci/v2/ @Summary OCI Distribution Spec v2 version check @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @Success 200 {object} map[string]string @Router /v2/ [get] @Router /v2 [head]

type PythonDependencyProxyController 

type PythonDependencyProxyController struct {
	*DependencyProxyController
}

PythonDependencyProxyController handles PyPI dependency proxy requests. It embeds DependencyProxyController to reuse shared helpers and state.

func NewPythonDependencyProxyController 

func NewPythonDependencyProxyController(controller *DependencyProxyController) *PythonDependencyProxyController

func (*PythonDependencyProxyController) ProxyPyPIPackage 

func (d *PythonDependencyProxyController) ProxyPyPIPackage(c shared.Context) error

ProxyPyPIPackage handles explicit-version PyPI package downloads (from /packages/). Route: GET /pypi/packages/* @Summary Proxy PyPI package download @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Success 200 {file} binary @Router /dependency-proxy/{secret}/pypi/packages/{path} [get]

func (*PythonDependencyProxyController) ProxyPyPISimple 

func (d *PythonDependencyProxyController) ProxyPyPISimple(c shared.Context) error

ProxyPyPISimple handles PyPI /simple/ metadata requests. Route: GET /pypi/simple/:package @Summary Proxy PyPI simple index metadata @Tags Dependency Firewall @Security PATAuth @Security BearerAuth @param secret path string true "dependency proxy secret" @Param package path string true "PyPI package name" @Success 200 {string} string "HTML simple index" @Router /dependency-proxy/{secret}/pypi/simple/{package} [get]

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.