Repository navigation
Composer downloads: gaps left after #430 #432
Description
#430 stopped the proxy from caching a branch's current head under an older commit's file name. Three gaps are left:
- Wrong archives already in the cache. Archives cached under the wrong commit before Fetch the pinned commit for Composer branch downloads #430 are still served, because a cache hit doesn't look at the stored upstream URL. A one-off cleanup or a check on cache hit would fix it.
- GitLab. GitLab dists look like
…/repository/archive.zip?sha=<commit>, so every commit of a version is cached asarchive.zip. A lock file can get a different commit than it pins, and older commits get a 404. The cache file name needs to include the commit. - Branch names with a slash.
proxyDistURLdoesn't escape the version, sodev-feature/xproduces a URL the download route can't match. Escaping the version should be enough.
Metadata
Metadata
Assignees
Labels
No labels
Activity
andrew commentedon Oct 11, 2026
Assigned to you @pinguinfuss, hope you don't mind?
andrew commentedon Oct 11, 2026
For GitLab, include the commit in the cache key and use the commit from the lock file in the upstream
shaparameter. Changing the cache key alone still leaves older commits returning 404.For example, a lock file pins A, then the branch moves to B. Test that both commits return the right archive, with and without cached downloads. This applies to new lock files too.