chore(deps): update ghcr.io/git-pkgs/proxy docker tag to v0.10.0 #34
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/ghcr.io-git-pkgs-proxy-0.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
v0.8.1→v0.10.0Release Notes
git-pkgs/proxy (ghcr.io/git-pkgs/proxy)
v0.10.0Compare Source
Proxy adds hosted npm and Composer packages, age-based cache retention, container image mirroring and schedules, and cache deletion through the API and web UI.
Before upgrading:
gradle.build_cache.read_only: falseorPROXY_GRADLE_BUILD_CACHE_READ_ONLY=false.storage.max_sizenow includes cached metadata. Existing installations may evict metadata or artifacts when the combined total exceeds the configured limit.kindlabel forartifactormetadata; check custom Prometheus queries and dashboards.proxy mirrorreturns a nonzero exit status when a package fails and refuses CLI mirroring while scanning is enabled.Changelog
086abebA database refresh now fetches the signature as well and stores it for that exact database content, keyed by its digest. A signature requested later, after the upstream has moved on, is still the one for the database the client got, and a refresh that returns the same bytes keeps the cached signature, so it is served offline too. The database is fetched once more after its signature to catch a mirror that swapped both in between. A missing signature is remembered per database, so official repos answer 404 without going upstream.5ce445fA database signature that belongs to an older database is no longer served. When the database was refreshed and the signature refetch fails, the proxy answers 404 or 502 instead of falling back to the cached signature, which pacman would reject. Paths with a decoded ? or # are refused, since they would fetch one file and cache it under another name. The README now says that pacman -Sy only works offline with cache_metadata enabled.d7a6a89Abort blob writes when the download fails6857fadAbort the response when a cached artifact fails its integrity check (#504)bf0c784Add Chef Supermarket proxy support for Berkshelf and Policyfiles (#518)ea696a7Add a hosted config block and a bearer token check for writes599b2e1Add a metadata_dates table for rewritten metadata datesb7b7a64Add a size limit for upstream artifactsb664530Add age-based retention for cached artifacts (#428)d643836Add opt-in retention for generic artifacts (#513)832a441Add package routes for private Composer and npm registries (#426)80fdd16Add push, list and delete commands for hosted packages9532c6aAdd upstream.go_sumdbs_offline for networks where only the proxy has egress513687cAnswer uncached referrers tags with 404 when the upstream is down111b271Arch Linux pacman repositories are now proxied at /arch/{name}/, with geo.mirror.pkgbuild.com as the built-in archlinux repository and more mirrors configurable under upstream.arch. Databases and file lists go through the metadata cache byte for byte, and a database signature is refreshed together with its database so the two always match. Packages and package signatures go to the artifact cache and stay available offline. The path is passed through unchanged, so Arch Linux ARM's $arch/$repo layout works too. README, config example, configuration docs and the dashboard have pacman instructions.094a962At most 64 fetches keep running after their client hangs up; beyond that a fetch is tied to its client again, so nobody can start an unbounded number of large downloads and leave. A server test now checks that client requests actually get the detach marker.fdd0c81Build in version-pinned paths for well-known download hostscbb1978Bump git-pkgs/integrity to v0.2.0fc312a0Bump github.com/aws/aws-sdk-go-v2/config from 1.33.6 to 1.33.7b8d5cf4Bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.66.1 to 1.66.2ba61c45Bump github.com/prometheus/client_golang from 1.24.1 to 1.25.0b884a5fBump golang.org/x/sync from 0.23.0 to 0.24.05683349Cache Conan 2 recipe and package archives (#431)6051e20Cache Maven checksums and signatures as artifacts579ab79Cache archive artifacts from Maven repositories (#425)d2a069fCache configured version-pinned paths of generic upstreams (#424)2e0f132Check gofmt in CI and reformat (#528)943009cCheck that a data tile holds W records before caching it. Complete tiles are never fetched again, so a block page cached as one stayed for good.9a93ce0Check tile sizes before caching themdcf90cfClose the Composer download gaps left after #430 (#433)854182fConcurrent clients could still end up with a database and a signature that don't belong together. Databases are now stored under their digest like signatures, so a cache row and its bytes always agree, also with several replicas on shared storage. Writes for one database are serialized, and the signature recovery shares the refresh with database requests, so a slow fetch can no longer store an older database over a newer one. When the cache write fails, the proxy serves the database the cache still describes. Unchanged databases are no longer rewritten, and a remembered missing signature is asked for again after the metadata TTL. The new tests force these interleavings with storage and upstream hooks.d56d436Count cached metadata against max_size and evict it LRU (#507)1584499Cut memory use of npm metadata rewriting (#413)cff4b51Date rewritten metadata by when its package started serving it8903a8cDate rewritten metadata by when the rewrite was made8bebc56Delete cached artifacts through the API and the UI (#491)bf7d17dDerive cooldown metadata ETags from the rewrite's inputsc0b2a20Document how pushed versions appear in package metadata9eb88e4Document upstream.go_sumdbs5332f1fDon't count a tree fresh in the cache as the database answering. The probe never asked it, and during an outage that kept lookups from remembering the failure, so offline mode waited for the upstream timeout on every request until the tree expired.c1a597dDon't let the supported check hang, and don't take a block page for an answer1d88be5Enable storage retention for alpine70ea921Enable storage retention for cargo9c75e59Enable storage retention for composerff4d5caEnable storage retention for conanbffba28Enable storage retention for conda42b4303Enable storage retention for cran3297800Enable storage retention for deb20855caEnable storage retention for gemc61cb51Enable storage retention for golang (#442)f3505adEnable storage retention for helm743fbe5Enable storage retention for hex8f30c6dEnable storage retention for julia90989ebEnable storage retention for maven (#444)4b8678cEnable storage retention for npm (#440)dcfb9a8Enable storage retention for nugetb40a3f0Enable storage retention for oci (#443)48edbb8Enable storage retention for pub18f410dEnable storage retention for pypi (#441)42f459eEnable storage retention for rpmf8ca190Enable storage retention for swiftea4c1baEncode file paths when loading files in the source browserbdec446Exit with status 1 when proxy mirror fails to mirror a package (#502)3adae30Explain APT signing keys and add a deb822 example (#429)3c09523Fetch the pinned commit for Composer branch downloads (#430)680a2daFix gem filenames whose platform ends in a numberc3c1204Fix hex tarballs whose version contains a hyphen0916eabFix leftover /api/packages references to the hosted endpoints42df87eForward data tiles without storing them. The go command never fetches them, and kept for good they would add up to the whole log; the record count check from before is no longer needed.3bbb5aaGive the detached fetch test time on slow runnerse9ecde7Hold requests to an upstream that rate limits the proxyb131db3Isolate the recent failure history in testsdc809b0Join every Accept header on container manifest requests2ed0327Keep fetching an artifact after the client that started the fetch disconnects. pacman gives up after 10 seconds without data, and since the proxy only starts sending once the whole file is stored, a large package on a slow upstream was cancelled on every try and never got cached. Client requests now mark their context so the shared fetch runs on context.WithoutCancel, still bounded by the artifact client timeout. Mirror jobs don't set the marker, so cancelling a job still aborts its fetches.b2955efKeep holds through late successes and away from the circuit breaker85b674fKeep the stored metadata on an upstream 304 (#495)ba5e6e8Leave Composer dev branch archives unverifiedeca224bLeave denied pushed versions out of package metadataa9cff7fLimit how many version diffs run at once112fc59List pushed Composer versions in package metadatac566949List pushed npm versions in package metadata496f272List recent failures under each failure count on /ui/analytics4de5419Make response write and artifact download timeouts configurable (#531)83e2fb4Make the Gradle build cache read-only by default, so a client that can reach the proxy can no longer overwrite cache entries; CI jobs that upload now need gradle.build_cache.read_only: false (or PROXY_GRADLE_BUILD_CACHE_READ_ONLY=false). The environment variable is parsed strictly, so a value like "yes" keeps uploads off and logs a warning instead of opening them. Fixes #497. (#509)055540aManifests are now cached under a key that ignores the client's Accept header: a digest names one document, and a tag is shared by all clients that accept an index type, so Docker, containerd and Podman read the same entry and a pre-fetched image is found offline. Clients without index support keep their per-Accept entry, and the old keys are still written and read as fallback.fd4e9b7Mark Helm cooldown as supported in README87505c0Mark pushed artifacts as local and keep them out of eviction61eeaf5Merge remote-tracking branch 'origin/main' into issue-411-mirror-images02ae49dMerge remote-tracking branch 'origin/main' into issue-411-mirror-imagesb0570bdMirroring a tag now checks it with a HEAD first and reuses the cached manifest when the digest is unchanged, falls back to the cached tag when the upstream body is cut off, and keeps a tag that a client pull moved while the walk ran. The platform filter is checked across the whole image, so a nested index without the wanted platform no longer fails it, and a 304 for a per-Accept fallback entry only refreshes that client's own keys instead of overwriting the shared entry.c2ab810Move upstream.go_sumdbs_offline next to upstream.go in the configuration table.8265c7dNest the hosted commands under proxy hostede0ab227Never replace a pushed artifact with the upstream copyf3f35dfNote that streamed artifacts over the size limit are cut off544e1a5Note that the container registry is pull-only16ebeaaOn Postgres, metadata fetched_at is now stored in UTC, so metadata_ttl no longer expires hours late when the proxy runs east of UTC. Entries written before this expire late one last time and are stored in UTC on their next refresh. (#435)cf463c1Only cache real pub archives on download (#520)e6aadb2Only claim checksum database support when the database is reachable6a90fb4Only send credentialed registry tokens to trusted registries2a957b9Prefer the root composer.json of a pushed archive0c495fdProxy the OCI referrers API in the container handler (#427)5e66688Push, list and delete npm and Composer archives through /api/hostedc7f8e2fREADME: say when the go command still goes to the database itself8d96791Re-mirror container images on a schedule (#508)e7449d1Read the package manifest of pushed archives3b262f1Record the detail behind each failure counterc58cdaeRefuse conda rules with more than a channel and a namead7f299Refuse package mirroring from the CLI while scanning is enabled (#493)729138dReject package requests with ? or # in the decoded path (#437)fa7ae81Request npm packuments in one format for downloads too (#496)d4e89b0Resolve Composer downloads from the cached metadata (#494)449683aRewrite Composer metadata in place and keep it minified (#418)1559be6Route containerd ns mirror requests to configured registries (#405)cf7eafbSandbox upstream content on package routesf47dd2fSay that the 4 KiB limit on 404 text only applies with the metadata cache4f680ddSend ETag and Last-Modified with rewritten npm and Composer metadataa97b690Separate artifact and metadata cache metrics on /metrics and the analytics page (#463)e74e5abServe cached npm and Composer metadata gzip-compressed832c800Serve diff2html from the proxy instead of jsDelivr69313c2Serve hosted-only npm scopes and Composer vendors from pushed packages alonec0ac418Serve pushed artifacts when streaming upstream artifacts96241b9Serve pushed npm tarballs before the cooldown check1c6cfaeServe the Go checksum database from its own URL054c45cShare the dates of rewritten metadata across replicas3dae0fbStop UpsertPackage from clearing packages.sourceaa0b543Stop forwarding custom auth headers across redirectsf5e7599Stop interpolating archive paths into inline handlers5d7855fStore mirrored NuGet ids lowercased8b3b933Stream archives when listing and reading browsed files (#408)cae9c08Stream conda repodata through the cooldown filter (#527)1b20307Test the probe timeout, the block pages and a damaged cached tile9f42425Test upgrading cached metadata through the metadata_dates migration67fd1adThe mirror now resolves a tag without caching it, mirrors the image it points to, and stores the tag only once that image is complete, so a failed or interrupted mirror keeps the previously cached tag instead of pointing it at an image with missing layers.9d0175bTry configured generic_artifacts before built-in patterns5b5a848Update Go dependencies (#534)d58dd3dUpdate x/net and remove unused production helpers03f0ebdUse shared archives browser for cached artifacts (#512)6d771a8Use shared cooldown package-pattern policy8e04713Use shared registries size limits and rate-limit gate (#516)5dfd01eUse shared sbom parser for mirror sources (#510)bf74d98Verify npm and Composer archives against their SHA-1 shasum2d258ddVerify npm tarballs against dist.integritye3cdf73Wait for the clock to move on in the fresh-tree test, since on Windows the first probe's success and the start of the lookup can get the same time.59f0203When a signature has to be fetched on request because its fetch failed during the database refresh, it is now only served if it belongs to the database the proxy had cached at that point. If the upstream has published a new database in the meantime, the request fails with 502 instead of handing out a signature that cannot verify the database the client already has. The next sync gets the new pair.5b9a5fcWhen the shared tag entry holds a representation the client does not accept, the lookup now goes on to the client's own per-Accept entry instead of giving up, so a Docker-only client still gets its cached manifest list after an OCI index was cached for the same tag.03c8e68Withhold Composer archives still in cooldown73ed6bfbuild(deps): bump github.com/aws/aws-sdk-go-v2/config (#422)a691e99build(deps): bump github.com/aws/aws-sdk-go-v2/service/ecr (#423)52e8b5cbuild(deps): bump modernc.org/sqlite from 1.59.0 to 1.60.1 (#421)6e334b4npm: version lookup returns 502 (#419)7b6c64aproxy mirror and the mirror API now pre-fetch container images from pkg:docker and pkg:oci PURLs: the mirror walks index, platform manifests (with their attestations) and blobs through the container handler, so a later pull is served from cache even when the upstream is down. A --platform filter (platforms in the API) limits multi-arch images, repository_url only resolves to configured registries, and names, tags and digests are validated before anything is fetched.cc18c88proxy mirror now builds its upstream clients the same way as serve, so it follows OCI Bearer challenges, uses configured upstream credentials and the SSRF guard, and artifact downloads have no overall time limit. Before this the CLI used a plain client and Docker Hub answered every request with 401.v0.9.1Compare Source
Changelog
36fe6abAdd a Grafana dashboard866e559Add cooldown package pattern overrides (#407)b40a50aAdd storage.cache_artifacts to serve artifacts without storing them (#387)0501534Add the /ui/analytics page3655000Attribute requests to a caller and a client tool4827cb9Batch cache hit writes8cc63c4Cache rewritten npm and Composer metadata (#402)dc1fc5bCoalesce concurrent metadata fetches (#400)4b1625bCopy inherited Composer fields shallowly when expanding (#401)739bba3Drop unused registry from TestUpdateEcosystemStatsSumsAliasedRows129e6c6Filter cached packages by ecosystem using pills (#319)76db945Install development tools directly in CI (#398)55ed6b9Keep hit timestamps from moving backwards9dff45dMerge remote-tracking branch 'origin/main' into analytics-2-ecosystem-statsfb04bb8Name every mounted route in requestEcosystem4ebd805Per-ecosystem cache and download statistics4b8c5a8Report the per-ecosystem breakdown from GET /stats4261bcbShow the by-client table regardless of ui_request_sourcesf60772dSupport HTTP byte-range requests for local file cached artifact downloads (#404)34985b5Support npm content-addressed tarball URLs107301cbuild(deps): bump alpine from 3.24.1 to 3.24.2 (#397)v0.9.0Compare Source
Changelog
c1f420aAdd and align CI security and dependency automation73a9863Assert omitted Helm releases are not downloadable8d3dacfBump azure/setup-helm from 4.3.1 to 5.0.1 (#332)f0580d9Bump docker/setup-qemu-action from 4.2.0 to 4.3.0 (#331)0935c15Bump github.com/aws/aws-sdk-go-v2/config from 1.32.40 to 1.33.2 (#336)b2817dcBump github.com/aws/aws-sdk-go-v2/config from 1.33.2 to 1.33.4 (#356)f29c916Bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.61.0 to 1.64.0 (#334)2ae6213Bump github.com/aws/aws-sdk-go-v2/service/ecr from 1.64.0 to 1.65.0 (#357)2aad8bfBump github.com/git-pkgs/spdx from 0.3.1 to 0.3.2 (#355)66a6d81Bump github.com/prometheus/client_model from 0.6.2 to 0.6.3 (#330)83e7e80Bump golang.org/x/sync from 0.22.0 to 0.23.0 (#335)4436130Bump google.golang.org/grpc from 1.83.1 to 1.83.2 (#346)dc1ce8dBump modernc.org/sqlite from 1.57.0 to 1.58.0 (#337)7e4b13cBump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 (#333)b83bc0eBump zizmorcore/zizmor-action from 0.6.3 to 0.6.4 (#354)436155eClear before deleting on eviction, and requeue failed reclaims7835f7aDiscard a stale cache entry under the coalescing key (#348)1001cd7End an eviction pass that cannot evict anything499033bExit non-zero when mirror denylist is invalid2736fe0Fall back to embedded build info for Version (#352)c895e5bFix NuGet cooldown enforcement for listings and downloads (#340)eb45cd5Fix duplicate fetches and 502s on concurrent cache misses (#329)8f09c1dFix the handler test build4ce6c37Give each fetch its own storage patheb43505Log and count requests aborted mid-relay2fef446Mark Helm as completed in registry table (#316)8b1e7cbOmit malformed Helm chart releases instead of failing the index0bab9bdSeparate OCI request timeout from readiness probes in loopback test (#347)00a49e2Standardize the README license footer0089917Stop writing fileblob's .attrs sidecar (#328)e635a62Test that GCS Delete of a missing object returns nil5f0f3b0Update enrichment to v0.7.2 (#394)51caa17Update git-pkgs dependencies (#396)65f2bf5Widen wall-clock bound in flaky probe timeout test94c11b4align data in the dashboard table more nicely (#318)d8a8111apply review changesd14b240build(deps): bump docker/build-push-action from 7.3.0 to 7.4.03724c93build(deps): bump docker/setup-buildx-action from 4.3.0 to 4.4.115d5ac0build(deps): bump docker/setup-qemu-action from 4.3.0 to 4.4.0ccc80f8build(deps): bump github.com/aws/aws-sdk-go-v2/config8bbe117build(deps): bump github.com/aws/aws-sdk-go-v2/service/ecreedc290build(deps): bump github.com/git-pkgs/archives from 0.7.0 to 0.7.12a35d3dbuild(deps): bump github.com/git-pkgs/magic from 0.3.1 to 0.4.0ceee79fbuild(deps): bump github.com/git-pkgs/registries from 0.9.1 to 0.9.23611ff2build(deps): bump github.com/git-pkgs/vers from 0.7.0 to 0.7.1442b591build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0468e9e5build(deps): bump golang.org/x/net from 0.58.0 to 0.59.0fbb89c9build(deps): bump modernc.org/sqlite from 1.58.0 to 1.59.0bb2205adocker host is trimmed too much in the docs (#317)658664adocs(debian): drop a stray space in a test comment46faf76docs(debian): trim comments on the named-repositories change9788aa7feat(debian): report a misspelled repository name8a51d04feat(debian): serve additional APT archives at /debian/{name}/548a50dfeat: add exact-version package denylistc4f34b0fix pnpm audite40c78ffix(conda): preserve gzip for large repodata indexes3db2cd5fix(database): set connection pool limits for Postgres (#350)8696a25fix(handler): let the ProxyCached path request a per-call Accept-Encoding (#324)429e745fix(helm): support OCI references in HTTP repository indexesa55f42efix(mirror): match cached artifacts by resolved filenamebe2a1f0fix(server): tune the shared upstream transport defaults (#351)ac261ccfix: centralize pass-through response relayingba45227test(database): drop every schema table in the Postgres fixture (#349)e738a21test(handler): stop asserting on an upstream connection the proxy abandonsConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate CLI.
View command line instructions
Checkout
From your project repository, check out a new branch and test the changes.Merge
Merge the changes and update on Forgejo.Warning: The "Autodetect manual merge" setting is not enabled for this repository, you will have to mark this pull request as manually merged afterwards.