Repository navigation
Accept Swift source repository PURLs in the denylist and retention rules - #641
Conversation
Closes git-pkgs#613. pkg:swift/github.com/apple/swift-nio, as SBOM tools and GHSA write Swift packages, is resolved to its registry identity through the upstream's /identifiers: - Denylist entries are resolved at startup, and the proxy refuses to start when one can't be, since a skipped entry would let the version through. - Retention keys are accepted at validation and kept pending. The retention loop resolves them before each sweep, and Swift isn't swept while any is pending, so a rule that keeps a package is never skipped. The mirror's source URL helper moves to the handler as SwiftSourceURL.
andrew
left a comment
andrew
left a comment
There was a problem hiding this comment.
Swift source-form denylist entries are only resolved during server startup. The mirror CLI still calls denylist.New(cfg.Denylist.Packages) directly at cmd/proxy/main.go:555, so those entries never match the registry identities used by mirror downloads.
I reproduced this through the real mirror CLI with an upstream mapping https://github.com/acme/widget to acme.widget: denying pkg:swift/github.com/acme/widget@1.0.0 still downloaded and cached version 1.0.0 and exited successfully. The equivalent registry-form entry, pkg:swift/acme/widget@1.0.0, blocked the download and exited with an error.
Please share source resolution with mirror startup and fail startup when a source entry cannot be resolved. Add CLI regression coverage for both a resolved source denylist entry blocking the download and an unresolved source entry preventing the mirror run.
serve resolved source-form Swift denylist entries through the upstream, but proxy mirror built its denylist directly, so such an entry never matched a mirror download. Both now use server.ConfigureDenylist, and neither runs when an entry can't be resolved.
|
Fixed in bdbd963. Source resolution now lives in New tests in |
andrew
left a comment
andrew
left a comment
There was a problem hiding this comment.
ResolveSourcePURL at internal/handler/swift.go:72 uses ResolveIdentity, which selects only the first entry in the registry's identifiers array. The Swift registry specification permits multiple identifiers for one source URL, so the new policy paths can silently leave other identities unprotected.
I reproduced both effects on this head:
- With
/identifiersreturning["other.widget", "acme.widget"], denyingpkg:swift/github.com/acme/widget@1.0.0still letsproxy mirror pkg:swift/acme/widget@1.0.0download the archive and exit 0. - With
["other.swift-nio", "apple.swift-nio"], a never-evict source rule forpkg:swift/github.com/apple/swift-nioresolves only toother.swift-nio. The rule stops being pending, and the retention sweep clears the cachedapple.swift-nioarchive under the ecosystem's one-day rule.
Please apply source policies to every returned identity, or reject ambiguous mappings so denylist setup fails and retention remains pending. Add regression coverage for both the mirror download and retention sweep when the protected identity is not first.
A Swift registry may list several identities for one source repository, but a denylist entry or retention rule naming the repository only covered the first. Denying pkg:swift/github.com/acme/widget@1.0.0 let acme.widget through when the registry listed other.widget first, and a never-evict rule cleared the cached apple.swift-nio archive when other.swift-nio came first. Both now cover every identity the registry lists. A retention rule that conflicts with another rule for any of them stays pending, with none applied. Mirroring a source PURL still downloads the first identity.
|
Thanks, ready for another look. |
Closes #613. Swift packages can be configured by their source repository, as SBOM tools and GHSA write them (
pkg:swift/github.com/apple/swift-nio), in the denylist and in retention package rules. Both resolve throughupstream.swift's/identifierswithSwiftHandler.ResolveIdentityfrom #611, as you suggested on the issue.pkg:swift/github.com/apple/swift-nio@2.62.0becomespkg:swift/apple/swift-nio@2.62.0.Rules.Sources, by ecosystem key. Before each sweep the loop resolves what it can and moves it toRules.Packages. While any Swift key is pending, Swift artifacts aren't swept, so a never-evict rule can't be skipped. A key that resolves to a package another rule sets differently stays pending and is logged.retention.SpecgetsSourcePackage, so other ecosystems can use the same path later. The mirror's source URL helper moves to the handler asSwiftSourceURL.Tests: config accepts a source key as pending; a sweep leaves Swift alone while
/identifiersfails and applies the rule once it answers; denylist entries resolve with their version, deny the stored archive, and fail for an unknown repository or a down upstream;Rules.Resolveconflicts andMinPositivewith pending rules.