Repository navigation
Mirror packages from the configured upstreams - #550
Merged
Merged
Conversation
proxy mirror and mirror API jobs resolved download URLs with a bare resolver, so npm, cargo, gem, golang, hex, pub, maven and nuget packages came from the public registries whatever upstream.* says. The resolver now takes the configured upstreams as base URLs. npm packages in upstream.npm_routes are fetched from their route and stored under the route's filename prefix, the way the npm handler does, so a public package can't stand in for a routed one and clients are served the mirrored tarball. Refs git-pkgs#414
andrew
approved these changes
Oct 23, 2026
4 of 11 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
proxy mirrorand mirror API jobs resolved download URLs with a barefetch.NewResolver(), so npm, cargo, gem, golang, hex, pub, maven and nuget packages came from the public registries whateverupstream.*says. The resolver now takes the configured upstreams throughfetch.WithBaseURLs(registries v0.11.0, git-pkgs/registries#103).npm packages in
upstream.npm_routesget their own resolver with the route as base URL, so a public package can't stand in for a routed one. They're stored under the route's filename prefix, the way the npm handler stores them; without that a client would never see the mirrored tarball. The test mirrors a routed package, stops the route and checks the npm handler serves it from the cache.With
PROXY_UPSTREAM_NPM=http://127.0.0.1:1,proxy mirror pkg:npm/left-pad@1.3.0downloads from registry.npmjs.org on main and now fails on the unreachable upstream.Only the mirror resolves through the resolver; handlers serving clients take URLs from upstream metadata, so they're unaffected.
This doesn't depend on #548. Both add the same
handler.RoutedPackageURL, and merging #548, #549 and this onto main gave no conflicts in the three orders I tried.The rest of #414, resolving pypi, composer, conda, helm and the other ecosystems, still needs registry clients registered on the resolver, so this refs the issue.
Refs #414