GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Fetch the pinned commit for Composer branch downloads by pinguinfuss · Pull Request #430 · git-pkgs/proxy

Conversation

@pinguinfuss

@pinguinfuss pinguinfuss commented Oct 11, 2026

Copy link
Copy Markdown
Contributor

Found while working on Composer retention (#306).

For branch versions like dev-master, the download handler fetched whatever commit the metadata lists now and cached it under the file name the client asked for. A composer.lock pinning an older commit got the current head, cached under the old commit's name. GitHub zipballs have no shasum, so Composer doesn't notice.

Now the requested file has to match the metadata. For branches with commit-hash dist URLs (GitHub, Bitbucket), the proxy fetches the requested commit, as Composer would without the proxy. Tagged releases only get the listed commit. Anything else returns a 404 instead of the wrong archive. Bare hashes without .zip, from proxy versions before 0.2.1, still work.

Not fixed here:

  • archives already cached under the wrong commit are still served
  • GitLab caches every commit as archive.zip
  • branch names with a slash (dev-feature/x) don't match the download route

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions
pinguinfuss added 4 commits October 11, 2026 01:02
@pinguinfuss
Fetch the pinned commit for Composer branch downloads
6013e10
The download handler resolved a version's dist URL from the current metadata and cached the archive under whatever file name the client asked for. A lock file pinning an older commit of a branch like dev-master got the branch head, stored and served as that older commit.

Downloads now fetch the commit the file name stands for when the dist URL ends in a commit hash (GitHub zipballs, Bitbucket archives), and return 404 for other names the metadata no longer lists.
@pinguinfuss
Accept bare commit names from older Composer lock files
d124ed3
Proxy versions before the .zip suffix handed out GitHub zipball URLs ending in the bare commit hash. Lock files written back then still ask for those names, and the new file name check turned them into 404s.
@pinguinfuss
Rebuild Composer commit URLs only for branch versions
12f7711
A tagged release lists one commit and lock files ask for that one. Rebuilding the URL for any requested commit let a client store another commit, even one from a fork, as the release, and the browse view could then show it.
@pinguinfuss
Note that the Composer cache key leaves out the query
5b3d265
andrew
andrew approved these changes Oct 11, 2026
View reviewed changes
@andrew
andrew merged commit 3c09523 into git-pkgs:main Oct 11, 2026
6 checks passed

Uh oh!

There was an error while loading. Please reload this page.

@pinguinfuss
pinguinfuss deleted the fix-composer-dev-dist branch October 11, 2026 15:58
This was referenced Oct 11, 2026
Composer downloads: gaps left after #430 #432
Closed
Close the Composer download gaps left after #430 #433
Merged
andrew pushed a commit that referenced this pull request Oct 12, 2026
@pinguinfuss
Close the Composer download gaps left after #430 (#433)
dcf90cf
* GitLab Composer archives are now cached per commit and fetched for the commit the lock file pins, and branch names with a slash are escaped in dist URLs so the download route matches them.

* Composer branch archives that an older proxy cached from another commit's URL are now discarded and fetched again, and a refetched artifact records the URL it actually came from.

* When a GitLab commit is fetched under its own name, the archive older proxies cached under the shared archive.zip name is dropped. A test now moves the branch from A to B and checks that A keeps coming from the cache.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@andrew andrew andrew approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

2 participants

@pinguinfuss @andrew
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.