GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — Accept Swift source repository PURLs in the denylist and retention rules by simonchrz · Pull Request #641 · git-pkgs/proxy

Conversation

simonchrz commented Oct 30, 2026

Copy link

Copy Markdown

Contributor

Closes #613. Swift packages can be configured by their source repository, as SBOM tools and GHSA write them (pkg:swift/github.com/apple/swift-nio), in the denylist and in retention package rules. Both resolve through upstream.swift's /identifiers with SwiftHandler.ResolveIdentity from #611, as you suggested on the issue.

Denylist: entries are resolved at startup, after the proxy is set up to fetch metadata. An entry that can't be resolved, with the upstream down or no package for the URL, stops startup. Entries are validated offline first, so a malformed one is reported without asking the upstream. The version is kept, so pkg:swift/github.com/apple/[email protected] becomes pkg:swift/apple/[email protected].
Retention: a source key passes validation and goes into Rules.Sources, by ecosystem key. Before each sweep the loop resolves what it can and moves it to Rules.Packages. While any Swift key is pending, Swift artifacts aren't swept, so a never-evict rule can't be skipped. A key that resolves to a package another rule sets differently stays pending and is logged.
retention.Spec gets SourcePackage, so other ecosystems can use the same path later. The mirror's source URL helper moves to the handler as SwiftSourceURL.

Tests: config accepts a source key as pending; a sweep leaves Swift alone while /identifiers fails and applies the rule once it answers; denylist entries resolve with their version, deny the stored archive, and fail for an unknown repository or a down upstream; Rules.Resolve conflicts and MinPositive with pending rules.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          Accept Swift source repository PURLs in the denylist and retention rules

f9024ba

Closes git-pkgs#613. pkg:swift/github.com/apple/swift-nio, as SBOM tools and GHSA
write Swift packages, is resolved to its registry identity through the
upstream's /identifiers:

- Denylist entries are resolved at startup, and the proxy refuses to start
  when one can't be, since a skipped entry would let the version through.
- Retention keys are accepted at validation and kept pending. The
  retention loop resolves them before each sweep, and Swift isn't swept
  while any is pending, so a rule that keeps a package is never skipped.

The mirror's source URL helper moves to the handler as SwiftSourceURL.

andrew requested changes

Oct 30, 2026

View reviewed changes

andrew left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Swift source-form denylist entries are only resolved during server startup. The mirror CLI still calls denylist.New(cfg.Denylist.Packages) directly at cmd/proxy/main.go:555, so those entries never match the registry identities used by mirror downloads.

I reproduced this through the real mirror CLI with an upstream mapping https://github.com/acme/widget to acme.widget: denying pkg:swift/github.com/acme/[email protected] still downloaded and cached version 1.0.0 and exited successfully. The equivalent registry-form entry, pkg:swift/acme/[email protected], blocked the download and exited with an error.

Please share source resolution with mirror startup and fail startup when a source entry cannot be resolved. Add CLI regression coverage for both a resolved source denylist entry blocking the download and an unresolved source entry preventing the mirror run.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          Resolve Swift source denylist entries in proxy mirror too

bdbd963

serve resolved source-form Swift denylist entries through the upstream,
but proxy mirror built its denylist directly, so such an entry never
matched a mirror download. Both now use server.ConfigureDenylist, and
neither runs when an entry can't be resolved.

simonchrz commented Oct 30, 2026

Copy link

Copy Markdown

Contributor Author

Fixed in bdbd963. Source resolution now lives in server.ConfigureDenylist, which both serve and proxy mirror call once the proxy can fetch metadata. An entry the upstream can't resolve stops either one from running.

New tests in cmd/proxy/mirror_swift_test.go run the real mirror command against a fake registry mapping https://github.com/acme/widget to acme.widget. Denying pkg:swift/github.com/acme/[email protected] makes the mirror of pkg:swift/acme/[email protected] exit 1 with nothing downloaded or cached. An entry the registry doesn't know makes the mirror exit 1 before mirroring anything. A control test without a denylist checks that the release does mirror. Both denylist tests fail on the previous commit.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

andrew requested changes

Oct 31, 2026

View reviewed changes

andrew left a comment

Copy link

Copy Markdown

Contributor

There was a problem hiding this comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ResolveSourcePURL at internal/handler/swift.go:72 uses ResolveIdentity, which selects only the first entry in the registry's identifiers array. The Swift registry specification permits multiple identifiers for one source URL, so the new policy paths can silently leave other identities unprotected.

I reproduced both effects on this head:

With /identifiers returning ["other.widget", "acme.widget"], denying pkg:swift/github.com/acme/[email protected] still lets proxy mirror pkg:swift/acme/[email protected] download the archive and exit 0.
With ["other.swift-nio", "apple.swift-nio"], a never-evict source rule for pkg:swift/github.com/apple/swift-nio resolves only to other.swift-nio. The rule stops being pending, and the retention sweep clears the cached apple.swift-nio archive under the ecosystem's one-day rule.

Please apply source policies to every returned identity, or reject ambiguous mappings so denylist setup fails and retention remains pending. Add regression coverage for both the mirror download and retention sweep when the protected identity is not first.

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions


          Apply Swift source policies to every listed identity

ce99ad1

A Swift registry may list several identities for one source repository,
but a denylist entry or retention rule naming the repository only
covered the first. Denying pkg:swift/github.com/acme/[email protected] let
acme.widget through when the registry listed other.widget first, and a
never-evict rule cleared the cached apple.swift-nio archive when
other.swift-nio came first.

Both now cover every identity the registry lists. A retention rule that
conflicts with another rule for any of them stays pending, with none
applied. Mirroring a source PURL still downloads the first identity.

simonchrz commented Oct 31, 2026

Copy link

Copy Markdown

Contributor Author

Thanks, ready for another look.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

andrew approved these changes

Oct 31, 2026

View reviewed changes

andrew merged commit 1979fb0 into git-pkgs:main

Oct 31, 2026

7 checks passed

Uh oh!

There was an error while loading. Please reload this page.

Reviewers

andrew

andrew approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Accept source-coordinate Swift PURLs in retention and denylist config

Uh oh!

There was an error while loading. Please reload this page.

2 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.