From 221f3a74023e5e5bc20ec61476a7edc5eb60cd22 Mon Sep 17 00:00:00 2001
From: Ben Vincent <ben@unkin.net>
Date: Thu, 2 Jul 2026 23:05:45 +1000
Subject: [PATCH] test: add comprehensive dockerised end-to-end suite

Add a black-box e2e suite (build tag dockere2e) that runs against the
built container image via docker-compose, plus a static nginx mock
upstream for hermetic caching tests.

Coverage:
- repository add/change/delete for remote, local and virtual repos
- caching (miss -> hit + byte integrity) for all 10 remote package types
- local uploads: generic, pypi (with generated simple index), rpm (with
  automatic repodata generation from a real package)
- virtual merges: pypi simple index and helm index.yaml

Driven by scripts/docker-e2e.sh (make docker-e2e): builds the image,
brings the stack up, waits for health, runs the suite, and tears down.
The artifactapi host port is parameterised (ARTIFACTAPI_PORT, default
8000; the e2e run uses 8001). Fixtures are force-tracked over the global
gitignore.
---
 .gitignore                                    |   4 +
 Makefile                                      |   7 +-
 docker-compose.e2e.yml                        |  18 +++
 docker-compose.yml                            |   2 +-
 e2e-docker/README.md                          |  39 +++++
 e2e-docker/caching_test.go                    |  76 ++++++++++
 .../fixtures/alpine/x86_64/testpkg-1.0-r0.apk | Bin 0 -> 3072 bytes
 e2e-docker/fixtures/blobs/hello.bin           |   1 +
 e2e-docker/fixtures/charts/mychart-1.0.0.tgz  | Bin 0 -> 8192 bytes
 .../goproxy/example.com/mod/@v/v1.0.0.zip     | Bin 0 -> 4096 bytes
 e2e-docker/fixtures/helm-a/index.yaml         |   8 ++
 e2e-docker/fixtures/helm-b/index.yaml         |   8 ++
 e2e-docker/fixtures/mypkg/-/mypkg-1.0.0.tgz   | Bin 0 -> 4096 bytes
 .../packages/foo-1.0-py3-none-any.whl         | Bin 0 -> 2048 bytes
 .../puppet-releases/author-mod-1.0.0.tar.gz   | Bin 0 -> 5120 bytes
 .../Packages/e2e-testpkg-1.0-1.noarch.rpm     | Bin 0 -> 6838 bytes
 .../providers/hashicorp/aws/download/pkg.zip  | Bin 0 -> 6144 bytes
 .../v2/library/testimg/blobs/blobdata         | Bin 0 -> 7168 bytes
 e2e-docker/helpers_test.go                    | 108 ++++++++++++++
 e2e-docker/local_test.go                      |  93 ++++++++++++
 e2e-docker/repos_test.go                      | 134 ++++++++++++++++++
 e2e-docker/virtual_test.go                    |  54 +++++++
 scripts/docker-e2e.sh                         |  40 ++++++
 23 files changed, 590 insertions(+), 2 deletions(-)
 create mode 100644 docker-compose.e2e.yml
 create mode 100644 e2e-docker/README.md
 create mode 100644 e2e-docker/caching_test.go
 create mode 100644 e2e-docker/fixtures/alpine/x86_64/testpkg-1.0-r0.apk
 create mode 100644 e2e-docker/fixtures/blobs/hello.bin
 create mode 100644 e2e-docker/fixtures/charts/mychart-1.0.0.tgz
 create mode 100644 e2e-docker/fixtures/goproxy/example.com/mod/@v/v1.0.0.zip
 create mode 100644 e2e-docker/fixtures/helm-a/index.yaml
 create mode 100644 e2e-docker/fixtures/helm-b/index.yaml
 create mode 100644 e2e-docker/fixtures/mypkg/-/mypkg-1.0.0.tgz
 create mode 100644 e2e-docker/fixtures/packages/foo-1.0-py3-none-any.whl
 create mode 100644 e2e-docker/fixtures/puppet-releases/author-mod-1.0.0.tar.gz
 create mode 100644 e2e-docker/fixtures/rpmrepo/Packages/e2e-testpkg-1.0-1.noarch.rpm
 create mode 100644 e2e-docker/fixtures/v1/providers/hashicorp/aws/download/pkg.zip
 create mode 100644 e2e-docker/fixtures/v2/library/testimg/blobs/blobdata
 create mode 100644 e2e-docker/helpers_test.go
 create mode 100644 e2e-docker/local_test.go
 create mode 100644 e2e-docker/repos_test.go
 create mode 100644 e2e-docker/virtual_test.go
 create mode 100755 scripts/docker-e2e.sh

diff --git a/.gitignore b/.gitignore
index 897030b..472957c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,6 @@
 bin/
 terraform/
+
+# e2e-docker fixtures are real package files (.rpm, .tgz, .whl, .zip, ...) that
+# are intentionally tracked, overriding any global ignore of those extensions.
+!e2e-docker/fixtures/**
diff --git a/Makefile b/Makefile
index e2d1889..62b99aa 100644
--- a/Makefile
+++ b/Makefile
@@ -1,4 +1,4 @@
-.PHONY: build test lint fmt e2e docker docker-ui compose clean tidy check-go
+.PHONY: build test lint fmt e2e docker-e2e docker docker-ui compose clean tidy check-go
 
 BINARY := bin/artifactapi
 MODULE := git.unkin.net/unkin/artifactapi
@@ -28,6 +28,11 @@ fmt: check-go
 e2e: check-go
 	TESTCONTAINERS_RYUK_DISABLED=true go test -tags=e2e -race -count=1 -timeout=5m ./e2e/...
 
+# Build the container, bring up the full docker-compose stack + a mock upstream,
+# and run the black-box suite against the running product.
+docker-e2e: check-go
+	./scripts/docker-e2e.sh
+
 docker:
 	docker build -t artifactapi:$(VERSION) .
 
diff --git a/docker-compose.e2e.yml b/docker-compose.e2e.yml
new file mode 100644
index 0000000..8bfa2d6
--- /dev/null
+++ b/docker-compose.e2e.yml
@@ -0,0 +1,18 @@
+# Overlay for the dockerised end-to-end suite (scripts/docker-e2e.sh).
+# Adds a static mock upstream that the artifactapi container proxies, so the
+# caching tests are hermetic and need no internet access.
+services:
+  mockupstream:
+    image: nginx:alpine
+    volumes:
+      - ./e2e-docker/fixtures:/usr/share/nginx/html:ro,z
+    # No host port needed: only the artifactapi container talks to it, and the
+    # tests compare served bytes against the on-disk fixtures.
+
+  artifactapi:
+    # The host port is set via ARTIFACTAPI_PORT (see scripts/docker-e2e.sh),
+    # defaulting to 8000; the e2e run uses 8001 to avoid colliding with a
+    # locally-running instance.
+    depends_on:
+      mockupstream:
+        condition: service_started
diff --git a/docker-compose.yml b/docker-compose.yml
index 7687e20..0ee2dba 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -2,7 +2,7 @@ services:
   artifactapi:
     build: .
     ports:
-      - "8000:8000"
+      - "${ARTIFACTAPI_PORT:-8000}:8000"
     environment:
       LISTEN_ADDR: ":8000"
       DBHOST: postgres
diff --git a/e2e-docker/README.md b/e2e-docker/README.md
new file mode 100644
index 0000000..3a7773a
--- /dev/null
+++ b/e2e-docker/README.md
@@ -0,0 +1,39 @@
+# Dockerised end-to-end suite
+
+Black-box tests that run against a fully **containerised** artifactapi stack
+(built image + Postgres + Redis + MinIO) plus a static mock upstream. Unlike the
+in-process `e2e/` suite (testcontainers, server run in-process), these only speak
+HTTP to the running product, so they exercise the shipped container image.
+
+## Run
+
+```bash
+make docker-e2e          # build image, compose up, run suite, compose down
+```
+
+`scripts/docker-e2e.sh` builds and starts `docker-compose.yml` +
+`docker-compose.e2e.yml`, waits for `/health`, then runs
+`go test -tags=dockere2e ./e2e-docker/...` and tears everything down.
+
+The stack publishes artifactapi on host port **8001** (to avoid colliding with a
+local instance on 8000). Override with `ARTIFACTAPI_URL` to point the tests at an
+already-running stack.
+
+## Coverage
+
+- **Repository lifecycle** — add / change / delete for remote, local and virtual repos.
+- **Caching** — one immutable artifact per remote package type (generic, docker,
+  helm, pypi, npm, rpm, alpine, puppet, terraform, goproxy) proxied through the
+  mock upstream: first fetch `X-Artifact-Source: remote`, second `cache`, bytes
+  verified against the origin fixture.
+- **Local uploads** — generic (upload/download), pypi (wheel + generated `simple/`
+  index), rpm (real package + **automatic repodata** generation).
+- **Virtual repositories** — pypi simple-index merge and helm `index.yaml` merge
+  across two members.
+
+## Fixtures
+
+`fixtures/` is served by the mock upstream at its web root. Paths mirror each
+provider's upstream URL layout (e.g. `v2/...` for docker, `v1/providers/...` for
+terraform). The RPM under `fixtures/rpmrepo/Packages/` is a real package so the
+rpm provider can parse its metadata for repodata generation.
diff --git a/e2e-docker/caching_test.go b/e2e-docker/caching_test.go
new file mode 100644
index 0000000..8f60307
--- /dev/null
+++ b/e2e-docker/caching_test.go
@@ -0,0 +1,76 @@
+//go:build dockere2e
+
+package e2edocker
+
+import (
+	"bytes"
+	"fmt"
+	"net/http"
+	"testing"
+)
+
+// TestCachingPerProvider proxies one immutable artifact for every remote
+// package type through the mock upstream and asserts: first fetch is served
+// from the remote, the second from cache, and the bytes match the origin.
+func TestCachingPerProvider(t *testing.T) {
+	cases := []struct {
+		pkgType string
+		// path is the request path under /api/v1/remote/<name>/. The provider
+		// derives the upstream URL from it (docker prepends /v2/, terraform
+		// prepends /v1/providers/), and the fixture lives at that resolved path.
+		path    string
+		fixture string
+	}{
+		{"generic", "blobs/hello.bin", "blobs/hello.bin"},
+		{"npm", "mypkg/-/mypkg-1.0.0.tgz", "mypkg/-/mypkg-1.0.0.tgz"},
+		{"helm", "charts/mychart-1.0.0.tgz", "charts/mychart-1.0.0.tgz"},
+		{"pypi", "packages/foo-1.0-py3-none-any.whl", "packages/foo-1.0-py3-none-any.whl"},
+		{"rpm", "rpmrepo/Packages/e2e-testpkg-1.0-1.noarch.rpm", "rpmrepo/Packages/e2e-testpkg-1.0-1.noarch.rpm"},
+		{"alpine", "alpine/x86_64/testpkg-1.0-r0.apk", "alpine/x86_64/testpkg-1.0-r0.apk"},
+		{"puppet", "puppet-releases/author-mod-1.0.0.tar.gz", "puppet-releases/author-mod-1.0.0.tar.gz"},
+		{"goproxy", "goproxy/example.com/mod/@v/v1.0.0.zip", "goproxy/example.com/mod/@v/v1.0.0.zip"},
+		{"terraform", "hashicorp/aws/download/pkg.zip", "v1/providers/hashicorp/aws/download/pkg.zip"},
+		{"docker", "library/testimg/blobs/blobdata", "v2/library/testimg/blobs/blobdata"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.pkgType, func(t *testing.T) {
+			name := "cache-" + tc.pkgType
+			createRepo(t, fmt.Sprintf(`{
+				"name": %q,
+				"package_type": %q,
+				"repo_type": "remote",
+				"base_url": %q,
+				"stale_on_error": true
+			}`, name, tc.pkgType, mockUpstream()))
+			defer deleteRepo(t, name)
+
+			want := fixtureBytes(t, tc.fixture)
+			url := api("/api/v1/remote/" + name + "/" + tc.path)
+
+			// First fetch: from remote.
+			resp, body := doRequest(t, http.MethodGet, url, nil, "")
+			if resp.StatusCode != http.StatusOK {
+				t.Fatalf("first fetch: status %d: %s", resp.StatusCode, body)
+			}
+			if src := resp.Header.Get("X-Artifact-Source"); src != "remote" {
+				t.Fatalf("first fetch source = %q, want remote", src)
+			}
+			if !bytes.Equal(body, want) {
+				t.Fatalf("first fetch body mismatch: got %d bytes, want %d", len(body), len(want))
+			}
+
+			// Second fetch: from cache, identical bytes.
+			resp, body = doRequest(t, http.MethodGet, url, nil, "")
+			if resp.StatusCode != http.StatusOK {
+				t.Fatalf("second fetch: status %d: %s", resp.StatusCode, body)
+			}
+			if src := resp.Header.Get("X-Artifact-Source"); src != "cache" {
+				t.Fatalf("second fetch source = %q, want cache", src)
+			}
+			if !bytes.Equal(body, want) {
+				t.Fatalf("cached body mismatch: got %d bytes, want %d", len(body), len(want))
+			}
+		})
+	}
+}
diff --git a/e2e-docker/fixtures/alpine/x86_64/testpkg-1.0-r0.apk b/e2e-docker/fixtures/alpine/x86_64/testpkg-1.0-r0.apk
new file mode 100644
index 0000000000000000000000000000000000000000..9b901a67a3fefa91b09f3b54f5527f724236cdd8
GIT binary patch
literal 3072
zcmV+b4FB^=C^T`6NN512g~-P!zrY;PRa?$FkZ9u+!^D24rlf_z^r=6YhPQ|7R*g0!
zl2;{?l8EL%7JoX<9{H8T-mn(l(0ab7_q8#L!u6`4)v=Tz!BRVPqWgaF)HcTASYIz<
zMhewO0xETI=BGG?C~(z+9|(NBG7pC2S@!eiXZy}PC2Ru7;CjTDHWvjL!<k)eT>6{F
zM&&@YpW@Uy@EqXLZXXe_-R?HPKT6qt@unHiPc7(15D1-Iw?O<!eJs#<oAMeKl7NE0
zNmnxSa%j}A&Nb7&uTZ3=(6MVKtLuq8+3yfzMHT7>A9|Pai;-=;FCEhru_oZnY6ZD_
zBLd8jk=x@@2~U@!<$CO<dI`uu1KRH9ALH>XP5w^gcx_j-vl1Mb`<mz73hlxki+29x
z@-*{S;&Av>=V}6#PF*o0^QJnD^;gGFVc!V2-fh#goU_1JE6Ko!u{@o+Q%OcV!(rXN
z^hb&vIbYzhQvy|5k7IW3G`Mv5D_G#QXYkA~LwFrX(j}0lCXW*12?$@CZ%y?x_TYkb
z_A$`*$%{s6NV6fz0!0qm9e1dj$yLV}7RNK9kc(4nu097W6?ZE&k%*IX5ej$Z!P>;*
z+H!G`@QNJA<Urlhy`kkjv>y1BZZkL27l=Rk63$uG*-iDsWa4N}sp70t{AZmK9T%H6
z+r7LG;hVksa|F*H+uL)v*5te_lORTSg>8G!?b>`2%JT8l>=RSKVW$~g?0-Vcu}tEK
zu)P^BQ3=W#>KH*tBcK1XdXR#(Ke8~h>^K=9!}Q67rSx;<ED2N>MvhO7RMThxN+8%(
zY;O)#tJv_+RBqj8a6#t2-x3-}OD|AhVLi_CkR6wqnT7P~Fbmuu6J#k=@|4wCl%C(Z
zl~b!A$spkq9V1~v$yJ<)6|5)%Qt6IV=O$w-1xgaHh*xI=nrJ-PUr=oZO50cpS?>P#
zg&DyBM|O<x;0>gzUde&R(Wv7Tu-|ZILv!#;H9;NnXRsiOSTAl7F>Q*nwU30@&`l~c
z>d;w*h(gyb^=-ed?~9UH_M(#|i-wg|Y4T(C)zolodv&pjw<3Iw#*~)NKInnqnrA77
z{Fq@PD1ibcrpPtQ*Fs9*&1$>oE(*X52}_#<#VO2LkuAa0Ww;k(QI6Gu(4c39-YZ5S
zAG0evj)93Es*NwW2X{1qlu5@aP3_GDYUzRb!bW`59z684DrA=)O~6-CQaTTM!T<;u
zeML95zDuw&dvevRWz2CqoPk2rIOCd)R-ib9nSoZK#T1Na-9xYFKn?zyr3~Fs1*ho2
zv0b>X$i*jn*Y?x~F_`LB*<X|ajX^N802vljg}RoX*NuX7#Kj`or&P|h#gWBxGv@cP
zT`TY6s2%!rqUKnla*0M<W6BYpAM?Ystg;ZP%(1i>XrKdjTy4n=&|ASePBUZb5e*yQ
z5Bon}ef~tkJo?#Ku+p`H<lt9WlO7)TjzbPEGC;Qv0PQz(uZ_diP{GiVF5|NZus--z
zlc$^{e@_Vve5MSx(V15DUz_G^HZy11r;K1Me)j>xv}a$%y5>swwNR>swi@?!oDMi+
z_JZA_<|NGw)F(&n%;0nca??KT3BU?gd<#*$679cuBzUqN0S4+3kzqx$y(GJABW+hW
z$aH`78jlPt%M*qafkqMz)j83fDFL*NhcK1CG2$Ye@vPDPLwX-CbZ%c8`ldGfeU;Xd
zh~TQXR`Iun<WGw6-s9hgluwy2qZNzMVA_!>rV-dbFFYdq?X?OpWGJqx5xMz13A@;8
zY(L5<6QW`WTx)RIGQDF$OS|0^j(Hm=1rj9%Q1(3nu7naDgnxhJiC&(M<9MF+VU-zi
z!s0APgU=8ekaHE@p*^dN4hBN)zQ1oi_TPenGGyUa85#JEkh=-Q3I6i&IB2oA)|Pze
z3=B$`?M(znebll*Bz+}_t8G@S*{ulBXd=c6`2d`<)H>Q6GI8E;y+`V`=CQ;Sp6Ov$
zp^k@=uk$W)CQoXCBcO$eN{Cf9&qc?o4bLHO+fOtFLZ!xXuHK#c=ZCsgeOFI|3TjO6
z8sR?^!@}UJVn6jf*=%}c18mR-Xd7hJt&zBY)?7-HteH4y2ICq3@Q*BNn+9fj{bmnW
zGC%-+Kjq-<noDY2$(WYq=619RSvkDKvD7WuMrjq;#p*032u(6fD*o%`nB$sN&DRm7
zVA4@XZU>xJAti2d1~wWKy)T4Ycj=&EwXElguENqz{f&ZjudbPo$H%)N2y0}m<K<KV
z9U8iAF94w|Xom^G2nP{3pr^T+H*SB(;j>AXnZ^y_#*ur?LN0!GshG7#xP_&N#i^^_
zf|N@W2abN<_PW2XKeBBjRi+bdG3qtMP`lM#`7s~1wVYI|BpmbPlraBUgXVluz)|)5
z3I60`Rp-efm$)ZHuBA~5Ue770t7N5@d4p~8dD(v>zb$$TfqoVgcmbA^{erUkl9-3U
z=jeCC#>tr_{jQSh<@*uoq_Pspd$pFZV+6sfyjfoUjHfE8F*Jljm@TQ@HTvLADkddj
z7p@7P>N>=wv%hZlqYAXVh%83^Z}{C)j>6|()yxmswxoWU*>xoFn}f<rund<F{s=b$
zU$&#j#*dcgL=Nf0is+CSA)o;@K;S|nnViobl(0O`*X7jBL3$K%Ood{hVYwhVG$Xm*
zv8#|HNB=G)t;FHC8@~B;d&AX?9~%s9t6U054erk&wF~HBi%K;wQLR}j_xKJ;K2Vlj
z7cB+)zY>&nYT6Gxd%vj`D2HLqXK%CNYBGMEbqN4E3Dl2}irP&sPL*oB+;v0!q3nJv
zJe&gYn%1&((Own@;9Mf2M*jE2+>@Cy<q&6;e;+Xo%8&Fs+l4%|0~e%Ky#009BVv#E
zRp|73=KxTN^MQ08Y|0?wNu6uxfYRN>7E+7Tts&Jwgp6wkE>^J@EPKcq)Wdn^)0pXn
z>|Doc>L<vOSez`&fRAHO6rfD>FNkS(7Mlf(Ldj}3GuvZ=aAGd6O<661n{V`BYoZL+
zJdghvyHLjuGMZZ`VISb5kn=goLN7ng{BSOHH>18tVPP88ui1g}#Jjqf0iNLZL%Yeh
zU<Lwedm7Q!PIy#$y&e^)QzPmQYw?6pE{i1$GFI|)%4(}{M#clpwW=D{-$UF*Uq~yL
z+Q?SmRHz>0Y9)3!j@@3)V7)Va`+a>L^J3*+E<I@W`I$vn(Fq<>q{}GdLmOyFjh!Fi
z<O_aKb)?mQHX~|Mlk)RlBhX)Bw2~--b0NJD+-~E^GQabXYH|wKPLrRhUYNVJ#SYyc
z1xbPrk;CZCC*`P>ax2Up8@^T1@;S`Avm~WL*%L$wHUKcIG;HQK;?&IAyPeI^2o7Zc
z`(^4ig8&Y>DI~BVzw1Cl<pWWgC;(MQ6Uja(R_GU5ON0TR$rIfccKMa4mXJiuN@LS%
z;2XTn?x3LuPRd8yT<2R*e)}JskABuNZ7YgkWG`qFi;!;cW!}=m#+)v_Hu5*jdKk6a
z`OhXUJ;=QVvq++c3K7v*@vlJ@hND`TIyRof@e|FB$vib;c;=9w;nINuv~&e<-6*(E
zBnrs7sO@ujX2XwM13?I`@}I4hpUAfNOkb;%M#pcKQqz#Ri#Z;CEm%|{{rdT|eO}>&
zi1d>#cky5~7$e7yIS+dDN*w<OWu_GBO7(Hw`y$9I1>f$KsWBX4?I*MNGwz_aru|w*
zIW2}iH9eOe^+85;!SV7&W|?t4d6Ip2Y6vwLT3sV0w4itNx*015zj#M8)$-z8ans3C
zrvI!`)&mt1IIGDmdkv3mAu9Ea`;*Y)nhh0j87wZwAg-}0oOURDL*Z@J{b(FSJ1(Kn
zOlZ62DLumZuas@Th5rZllbqqpZ?EhiinI4vgO$y{&p`ff)L2IC366%@k_N{T$}h=5
z3kMo@%4OPgur>0-6mV)hc<zyNu@oqERE0lp3d9ekh^%$bYVC^{nUx-0yx&+v<YAZC
z;csrT@`qcff}q$(45tjI!*&h^1&@LOdKUT2n(vcShcV?zvDi)vj0?6jU6$h6dko?I
O!ys^cPWNU8lQZMB{sQg*

literal 0
HcmV?d00001

diff --git a/e2e-docker/fixtures/blobs/hello.bin b/e2e-docker/fixtures/blobs/hello.bin
new file mode 100644
index 0000000..014592c
--- /dev/null
+++ b/e2e-docker/fixtures/blobs/hello.bin
@@ -0,0 +1 @@
+hello artifactapi generic blob
diff --git a/e2e-docker/fixtures/charts/mychart-1.0.0.tgz b/e2e-docker/fixtures/charts/mychart-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..70944328c20f71e13f646c2b246cdef3d1aab2f7
GIT binary patch
literal 8192
zcmV+bAphTL@m^p{3DY(;Az;};$#U+_y~{-+ZE~DYX8vXl;P(ED>+9R3Gaxoiw*VO1
zZ-q_K7KVea5zB{Fa~jLm{+PG(Ow3H;^-U=ZsnQ*&!zv;UwNu}d?=cy3<K-ww5Mc2k
zdJVTl0*eijbGGe((4~cz81GGs(_Jk`xJ4uSqyRKeO(6@z6}D=(2cAzUJhA03?5lKf
zeSvzW4&msNs2+2xX#2P;w71w$Q8Cj`-F3}d1-5c)KJTY-sM@N~==MqWU;A!;Rjj%&
zwwyF?%I+dp-}G9fwIsS1o7k1Eo<PGGUN?d!deJ2tHCn(dU)ZYSH}7fXyZIvi1OdO3
zS`uAY6H!Qq#MGVs-nkVB;V$Ec*iu&B@@qNGa9vxFn4iv`+fYjd1=WFMwr;erv;d3U
zI%a?hNww#G;yp4-%(r*MRetKXAg*~<bQ^KCaB~ozgw7&&DK+}rc>+Uva8&+}{>UbD
z167oAg4O~m&WwZl$z9vK*f5e;`00G8Hi-w!p1~{;hq<sRUOJGjqQb{BN8~VbO_j+h
zFah1R#7zmxY1$$e3v1`@({&uP{3oUPzp{m@%u|>7DM)uPL#eSfDrO@Ingva%ls&gw
zy4Qe?R+bp!^whRh))pjzicXrx_bp$(ax`f9cAh&r@nh*#heXZYsWg>V2wgBltn<y&
zbt^Qp-tbRdG0L?c_PhWwe!xr4jc^VZpLS$DK_;476~DQYXHSUnqGwYE9Lb2W(%CdG
z7wDS8&o=Bi{u<%(FE?S!n)ebJ1E+gzO?neqt;h&W?uE1l2WuiO142O{KP>45dz3<7
zZ97#`AWAsy#ciG9C@O+b4G)gAs=$8mR3?s`V>$BS$)oigg}7h32_lUEU`R=SAJ#Vf
zf2qmsb674t+sas%)+#h><|8kYhWLp$Ir3AZ!T<c`bC}h&;iEvt=5|+ul?Y@77F4hk
zd$PWTAY<RF?(PCk{-IXN%ykKZfvlkQAV>4-_rKVw)afpEy9H;*Faop@pe4~3Axf=x
zS&6VAi`4-fhK5`ZCTMOTaK~r!CQ^8U4PGXI)72cRTzla%;=`oUqHz|Sbj}x<`E&6q
zlAH!+w5k3?pPH>aYI4^Dv!KHr?JhuWUcxgo1#XNygj!<uA{00@QJqW}zIPA^qJ%K3
zx&iLRch0?6ck`%HZ|;{x)3}cP_oicfZ_0l8fD|T9T;xy=K?Ud+HK&Jy-sKT)kIY6b
z%yxC$J;>zggUZoWfj2?+!eNKTaotpzrw;WafC%tuaP&%Qwgy`>YG7{gL8090+--Yn
zu;;<K7tl-uq+tAGj>g&fOx|M(l-&=)J?C*}YVFl^Vmhs6L5cx|Zh$8$gPyU*lrtoC
z-3S$;NMcYljO4bG*~v)P`6y@1QP!dREU}YFO^so?uqY6d2Rzn!o0Ry)#xD;|xBFM%
zFu19)<$8kxtoHFtaA8Ay@=>o`o{lK*i()>V@@J+sM$P5iIAHtIW5RfzM+0*(KRIxp
z^tX<=n|h>isT@USg1w4vn`U<LnNCAw;}se=y6KS57o|4x&_$?j=(K%SAaF^4IxeL^
z86qeQe(({}X^K8gEQdzu{c2x9stFh@?(><B-q2W@&t3m##_mUPL$zvUN?kYzchi|l
z7U}p=bx&QkLCu~kS~p$7OYxicHeChW&(3z`gmsf7)lCw$vMFdf{NwniN|>v&2Pt>O
z4(9Z9aKC#6+vS>^26zzW)c5lT15b&QRtAzsl1Z&h>9$3_+rkz)5m&~hMBEys`W*JF
zm@S$Or=H`31Kp!}rV;u${JD9B{_Z8B;3J;yAr^2DhyyZ9_BR0-Vl5W2n}j6dYD*J0
zo%W))1G8d_>SUfj@?MCqQWhzktW`RTpmY@Y!yf!&9}-1rvVXyx>{#tsGf)KZcZ~(^
zgXRV5&7#=vQE#F~z~~MlRVW+IpB5Od29bh-sQ?Toe>SsIouQG(n0oNi>yKTDBw=~$
z((-oL<G_JT*>@^mE53n>LxL@f7*qvQnU0!kKyt%V4?(LA@8&h7_;W!xpTB+odqp#J
z5ZeUJ&*c85iux&Xw{r+@FeK#4ds|L86A#olyQ@KvR7Kh6?-RJIATE#sI-b{C$}2h@
z-XEK&To-4Q;5Qb<+y<<45fAW6--VW$)&Ll&WBw+`)7uV_LB&kdaG5Y?i?czA<F>QG
z6y+XGd(~xvB|Q<gi7nN@K*cK-AQfL0Dcr-TnqoZ3AhQgm^pAx#B<$M7ntxRbnd_ux
z@pIo<mWtGA_rlGN5Du$r47qjhLydW90sbS!Gtz2wSez&cF(6i?o7q#=vBh!F$H!k)
zn#P?=yNtZpz=Dccd@ZAc-TRoalz!_rn?{}z&5m0+ff$o&*Z98pq4ZWvuvyZ;sW;@=
z%tfEXVWfSnt{&VM)0ld{^*0<m&4I$kXk71YQBVd1V(L(ZRVb{~r}SBcxBI!P&qSKe
zA7vxslqA_Qz8;5CEuSKIRQ;8Gjs+>d+PPCS1_>I0@k(LUEo)f62iOZ!gnhlJ6TwRX
z(7FIo`P3KcAp)D5=7XRXa}yF>dmL-+y4r<`5irJ1f{i72b5OD9*fuS9XVLyavRVRV
z9WyoKkGa<r3%H3x$Zs^PFE(pHP~29^NS<0wcWdn?w37>$6FPcWaG%Z2?xobos!nw=
zEMFBP_~c*EEY1-f+#+**Kgr)YhbkmsDmVcV7Sz3QaBNWv%k));*ut(>GGjGH_%3X;
zkfr7~iwg%`=G_@7gX=RzoN=jc_86A6EIdunpCR0wl3Cp?T)pIoK{5Xvo7M@tN>X{H
zBlI&<d$Ai^`rAbCTfzi_qXNNkKtaru_rQJ6f3REd{#bYNH~?)N*?i(ByBa)-4OEP`
z4uWm#&bmT>pl?H_!}oSX3+uf{@wAlA0qR%8x6*O{`pb~GGTlw8EM}vs<Nnj~S4|eF
zr)F?>%jMp#W;#AXRO~G_Yw$4oA;<RMjoY@9y}e_l8H2k&cdQ4&l6Oi;no1>#!qs)}
z;W=8+k?{{$zlm2TY)v_Ef=V4Ly$WD$S(x(4Ha8d{z&0_jmXDfF*hb;TP|Mg__kmeZ
zEZwwm<Z~r6ulVHz0K@zAa~C3HUlLPk9-C@>=>l6G_A8tEFZ5Lz3|#}1{_G}rnIi<l
z>)(Z-cjl`KbMx>g>-kkVdRc^P5D&YgPM%VFA4=rCPc3O2k(_+C>9a219o)w;8O;n*
z*9-XgdZar&V02G#xnM?p;7>l}ZNI(C1ZnX-x2fK66_9vKGDkKfyaWL-_}<}%k^-;C
z>4jgaHeuJL;&QdsYx-Ub`|QkCv0y810ES{4q9Y64PiVkdT}a=ge8;|fUxbM7Wt0cy
zQRK&p)k`GFw4+#1YyW8av_jwCt7o0}6}_!0bX@)sK}vc#=E4M);*XfFR^XMFM`k2E
zxThN(Mu^jmQd+%|v<U#2qyiYswy&PbY9^476a!WDZguOl5cbfdlhHXo<h_=<!1XH`
zYstA#?Fau?5uCI+gbzN?C!)$bW`P;f=!4w~+kg-?(>8P>yTK1OY4WX?DZ(*>W!u0!
zWrv7KQ+&C=`f3BjvyD^($H8JXFJrf3iGWZ}pdJl)|0MoH%e)7BPQy?gpM9eBPT8Da
z+9KU9J{M!y2AqAU|8tjn6D!KWJ>x-G<5I1nSSi}HyC;$Su1r1OB;-sHNOZT+oaW^k
zN^+mVV;^^&t}|%}0G7Q3SfqpJ`SIHSrZW&KJV@Sb_M!Yh|AqFOKfSEG<{gQc_;4-@
zb?%rW**NLmLF=u2NN@`ZeIef8)gKA*qth`sKPgq8N@BAdJSSF<k8H^RuachrPE{su
z_c(J@=r7$5-06BrFncQs?^-kR*MrF5nNXSR9H%f*FS{e4u)hY&jQ)oqRB^m`f~aOD
zzk0C$l{T&@U4D1-UOiVg*`BCalynd;KO`6%lN!~dkzz4@T5Aq3GdEp(#j{h05C}vT
zPpJ~aXIx<Kci)^QTk<|9WmC?k_(U(myTLLI1|OWN-%s6G`A@0w#@SOv=#Ll|+mXBk
zV6BJT>@W5~v)f_h7aF`*U=)u1?L*-pJRT27`}Fjz=hbq0S|Y2;B6j8VJVZxXgmjFy
zQV2oHf|4e8a3yzXKybvo>oHbh(?cDX`ZfWs-1#egiXI8+)urCkuto0;li-;`Dv!Q`
zI}Ec*p^P1Vr_JPZUi3>TL6ic34BJrCkqwg_K?|6K0v0#h9y6qgY!6+TJ-{}61~Zf+
z-4Uaq`1`9NW#=R~FN2DWUnp^A{0p_>uPZg|gRif}wymFBMEZ{9^>Z{p`W<@dI$p}G
ztCm|m?nLSswN=Cy>wEnOL7+s)$3=zM1E6DN8*PNPC|32%z?`wj35v<eDXQrpsLhkX
ztKR!W^p32Z0`+O$t8x||fL894W1z5p)4jhpi~QVz!~1vOxuPi&oa=X7dzpRO$!hJB
z>16@Nb-Hr}Y5Ja>bb+H=5!y!t7#aJhQu43I3f#Wehc}{eo3cz!I0CPOzyr_?mCkVD
zwkmsSLD<F5*GGEo&+MX753%NHDnot89QDGRZic}5cH!oclF*4h2AXL*J(<4!s$u_+
zU?DAJpz|7n>cgmz8Heh0vj1lfD{!(C|29{mVaPH3+UZ^0p&m1q7=KhpB8%#`pnP3k
zdMTN^O0Z&F^?-n@Qv!*&z?jeOeR~jwK}euxxS_lz*?ZD@<x$1*=;+9@E;L-WGD1{-
zl5;fX&OTdz1s|hh6p}5G6i^8q&asZ5F$kA0P;19zIW$#bEbahS6)TI`y(GJY00Lv+
zo2Rq^hx9T#LP^Ey9i{en@UTe}Nh1sRF)F7g9tTu7tb88b)^AG`m;m%OVkLMQhC?$<
z9A5yPcGgF&dis51GK6$n4$7#bF{+2$+?|TX9!-<kHv64+EH4W1YmW^Op};&;FKRz;
z%B(7GHCa^;7xXJ)WFynecSZF4U_%m?y&vkXJulHU6t_|ey+1z$Ng)~|f4fw3bn3s%
zPsa~&Uo;AI&P`<U-%Zd!bS^&Z4t`brJSb8(WIGSJ1RN%LeR>q-zPICbt4H}o^Tj@D
zP87bzvAPjJ`jDA;grhUp?>~jTJO8S0&7DkW!7v~Xc4X>wO8Ls7b@^)cbl?_I+t)<*
z!MgqjBZgdGxI`WkY0#n^slJb!UqymX)2Fw%c6LN)MBJ7V*gFda_;U_y?%Dl|7r9dH
zlgkrWJaZTeR))JkK(WpBUy##&J6f>KY+>pDmHpJEAZf;zTg8L#umki#o=?L_^Ph7G
zgr&~Mj35x{Zol%8!4@cglT~-LZK{xmJC@P&Qj*Z#-Yqxzo^Q>iYCFe_cXjh|UewKl
zw?WpGn=4gP4Ok``R|zbXRA#il@(Qqo<?EvMp;VqQ^>ef|nyG-R%hj>gR$lBf$;nf=
z4H+U(#poRkX+uL+>UA4XuISp0SGGIn(dPL$Tb(s^u%<k0W^PD%LdbBc_{JE>T9qwW
zE34MO+^e$;%OErfVL>+;sUAia$Lv`08fLzyI59g(fgF~0j5ls)p+z~7+$On|j$5iF
zwJX>B!Mx#t;&+aWukp(kh+WL8YR0Fh9E|kCLAEplPgb`e!W1%H8H|Wp-h!j|0d+FC
z2t56WFQJt&WK^@%LJ{e-$GR^kC{0@%!o2|{x4C>-pKd2@ic1_cEJeRT98{Eub)p)l
ziOtjFEh(}O%sjw3rrsO;=U^(}$>%+%65EPPDEtS=6PZ=1xTtVXzWU8$lyc_NF}JWJ
zXHAsvIm0Zs{&-U2^G(tpCfto^LiU66=?)#bMD$vzGLd|o(y>3hy>2K{_AH2^N0pOK
z`8Y#JTgv(JrE9MuOnY;p|1m>O0`j67nyPUgn4R^OT*r8g;l7%j02~==)7f!L?6zs}
zyF_r}hMnVhr=rN;da$-#Ahmgok3o`V>>cw^UEG^p5ehJNYUVRCV4qXfAAteQl3-`H
z+$f8q9G=xmFAC(?)xRWV>?4QtJ^eR+ViO+J^;esjRDwkZp!~%GHF8^A3;6G@HYBA4
z<%knKYE>WBg&ctc+Buxa*E;QwCDoa){3O#J-W5(tzJe3<@)7gLM2*-al4G-Ww3ol6
z)tdoDdj$yO{sO&VyA{{+ZEi`uy>!3g3x{|QFc?hG6%SAteR(`AwFL1^!%gGTIDGUM
z%bi~gW-U9VJtjfzbP1ep9V1}FoxPG!qAd5m{ee^WurHxPOKOu6W=!eP^ZcP7nN(rn
zfoJwrk%2VPBRt&<LZv;6Xj{Hmt>&ozNdiB3FXst8be@r^)3p%EIz<6GV#Hvn<leZi
zv;;_5778C>^^U@sQ>4da6^H$&J>9w*mZ1CV)OYQ$4FfeX+`wU5at@-KUEC2yk9`b<
zO&2;#V5esPu)AEVzL;dN<^LWj_=4e-HiyveaTnQA<3oiHe|Ng_Ap2!t86M)j<zi`9
z`s3EjpHNtyT2F#Jh0xKMma<+p?vm{A9iAz<uCmS=d-jPO$%vv@YWV}UA@Iw~wx{45
z-1)2((h2ib<W#D3^qvytL+GweUfHk#MqN1Eq@|vMj+BTIY`mJF26@ph$82YuDS>j|
z^h<B86u2)fMG^VE$3s0dtiC=pkWhb)A?G)X3T?V^UT%0gC3S+sHgsI2*KmKdLLXa0
zKamh?-<RL;$^QH6#aFHSZ1KR%f{^)JdZb-<#|_KjRJOx38r<3M`pelfdFS?-Kw&ng
zqDJju(n-`As7YwU%gMsrRu!%DfXpuG+^bw8l*S2KA{qB*Uxd~;l}?N`CtH^_JKG}X
zuwsN(1^%7_n1wWK#PEFF)7@$^_`F0Cz#CbjQ8fF6X|<QIkUEcpQD`f^>pqQuHSO^V
z{u=0#9v=aT1T$Y|@o2wh9uf#1TT<X=LBNkC^o`GKP(1FWs@e$baMT5dWFP@>PJkG>
z_&~QL_NE`V4ar2lxCUY@y7kL?<eUo8KChO-6fJ?n?8uWV$R5C?qNuEpB78M@V%^~F
zW^t?kQr3q&iY>e*&-CWdH@FLk>+54*EC@P}SZo9n=>LhxY4@Z4uxyRG$}stpn2b-K
zdxi$FNHbGUmUw=+b8jMB{jI5Nx9n7Jw&{g}Y;mxqLT?C23e4%{m~SExEcHdNtyh<_
z0w%MLs>wg`+x&vI2*KI`;VEfz>mkP;mk<LPW>IoK<0TVqX$(mH2;i2w^*=kV6F(6-
z><j^%g_GaQ7*2F_l_By4flETK;)dWVHD3u+>DdGn>DrwrZ?r8bJv<h8^#}`oY8B&g
zVE`_?o)Tn#zxVe7{4Ru_`8?z$qtw0TD%$*R=ia9{@&2KA>h&5S={J+8-meAKT6?vf
zPpa<)t6J@tbYs9aB{^9Qn=qrkJ2Xid0wJQ~;-I1$6u_9Nt_*5sbP*0he?1o>O;v0h
zZdiBjr1#y7`5rc{3{fPHW3h*0CVvIFc+G7Vr%fnN5DzBtzEpGmEL24wMx#?@bs#)C
zgQ^BT6#{roDml}Oaf{YJsh2&WWnm>GI|$Ht8_`?mMK%L(mf5fPSQ#jj(0Ir6cX{Lm
zvm&!@+u!(q3B1H7Dwx-m!m<jr@~VFZO|jv|l2ifK0w*;ruQ%mggV&Da7~(7jgioCB
zO}C7gFcQg9j}*Wz6bZQgZ@PR_VvGYZDR@e`x?rmmWls$^ZCTqB5RLGJd|2AG7i^l?
zG`*OV)b(LNaC7Izhg^<uHclCD&)GVqkifj~?!PJZioDVA?~z{h?^V*#C(1BKM<>{~
zwEJ!e`l5PqEf;gwdj@Jw=3EH_r<hThkPu^U@)DOhWdb07#H)m%+<H-ho5(wb10W%`
ztKLD(%!?9Ke4Nk8S<lhIHnn;(LX!v8M{+obHlDfYxF$!W9&-QBRlYyQjpt>BsV-=d
zGB!9dMR*U1dU?`|V!NkTjY}S+C2NXpZog1KS=S$Lx)EjVue;_9BMtibXEldW5T%av
z1;BoZ)TGnZxwt76!B?rnD2_7bw7t>u7oF~`Avd-&Kv1Pk>%1od%MRwR*;$^8vUP!p
zs%hbb+Qn|4MDGtfz8^X4rN_|p?6an5V@=k0%;s$Ok_F^b<XN_T)H#Ha@Gavt{*(34
zMPomj{LyEcM0A?lhK=G24|*elXC&I6T$9oeqhn~-ZfWG7EmRziT{Z9tTH>q&Q6`R~
zdGs%U*5V3f_Y``>v#m(t9JQ^EC2v_vAjmgUq8k{#5N#1WhFq>M58bEQA0A&wtyw6k
zB9dmGZGLz8MPXen4qd!~$$9sP4tl3hgXKiWBw+_U3t7ZsXVzCiOvQDnJ-)%CGmryb
zTWKO0)xKa~u7~Qz+P>Gb{M<F`FcNQW*eUc_%TdeIu|UeDF#O|N-;L~KLJShrI;AL1
zf~P<r%)eEfzLK=)o6sr&e-`U7u@Pq<pW$qQ%heA4QSKJn5r=&@g>J_L`4AR=oxNI*
zEO5x;>O%?SQbx~(?H$cfEyzOLQOS$(w5Mj}NckXX01M77hi!Ris{X4`(5b`{sXbG^
zop!uHcC6Ss4U$>s%`g-Njj0^nOI02aI<~EI{N5kMBjW-qC4)3y-%)JSaY?s^{~4OB
z|0U*Yb4}THCU{m03fk=dC(B4ImU8_gkUXE^g&YMC;qNGMj7vRevY>wQxN^9aVkAwA
z2B11`LsWnKFV$CWxKQc|B~|6r%rud$L;_6(BRWKR=8Ab(A2VQGM)Tq0FnC7;Tnoqk
z<U}D7^r7!(x$pw57V!R&cl91K@8n$R)gShPzdvd$CFjGnUD9#$L3y5|4SnZlqy2^&
z#LKcX!Ykssm0(biCUl;a_K(WnJ%-t(hD%7X8GQhtdxCp1Y>ryzI#xnt$U1GJHD@w5
zI1uD^g)1FP-&Cc?xsA8b?)9%F4Tz8wl8umP)(=DAAF-r#-S;1^SKy@WrB#KUVV<U?
z)XhY5wXtKI0x->HJLxDe4RTIy!y{(yB{aeveK4p!x52Tc5C;<s!i63{2aQ&tg`u+O
z5l<bl!DolaUr?wEXneS*3ln$Bl4wdREn5aKq8Q$K_7vk9MsOf|WynA3A?qjuL=uAg
z^LL@S6sDDr53MO4N1cwS@b#<6GHyuknQLQ^rr5%Ay&Kp(+mM_=$6ky=G&FD?^gy=g
zEuh)+EDd;P=Ua|k8BvB<Tz1K#a_rp>2FS1gY;ZB)QWC|D+>pj~_gmBOyI+2(ii5oB
zW*^87_&R(k<?1#H0Fc6!<kG_2#m>!m-JT5Sgev)n4E~{LIK6J_MLjvxc4ni%F6i=(
zmhlx=8SZDg0gRYL%+TK-Y1VcJdy%z>Z#TvRlo?E6H{|`irrNqYY38!tK3J&DBj}Ro
zWdob!ug1eOiRSe3RTW<yw<ibE;{WBcM_2Z;RFJ`DVwTyGIc8Fk0w4X5G3ev<8wNIL
zxA1>s02JlJx7hKSP+R&Vc}I4^F`n^GO72V()0wd*zR6}OCTtCaTD1;OzI;!wT3y<6
z5l8iz=O37a>c5&SH{S=;phsB#pZ)aPq^(J%OR!V#w@j}-*a>!5S#+Nm`@*is;_w7b
z_E5w%|FYoO@r~1^rT3Bcn4fC|o{(fWCz7EO)KEu20s(A%N8T|8kNi{)3)8yB6Wvij
zN6Hnpj@sLiyAbP^D`41h)N+LN-DA0SF1@Uc7>!UI2K(n^Rl&;d7)ec+vZjzR59m3v
zKwymw>bLsgQAoUAjAPngz=;=5x5eS6eDjh$^|{C#giAMz?Lzqep%*cBq(tp%7SvtQ
z#KPM3vt-F6a%(l0ygeD8=|LG`ywbyyyq2t8CStVYPYRjS5(BT$pV{JigDiyX;|R9<
z(-mF~vdq@9BZN%0dMIEaEm&Ds=Y)`)n(-2Yk{6;@mX9C!aSn1qAClQI`2=>wOXes@
zPXe_;gizt$x?xK5r8^A7uAcqkLVsBgm?k#!oSPp;f6QooU!0dq_dK28Dy|em3iXLK
zi}TGszJ~Lvb+8@LDadvE+REL=L8r8<qT$D@S75o&RzvyQuib<FaetWkFukOONCNP{
zE8c`AG?gIDc-D4U%^Hi$g+tyK3lZJD4+!~TK~n9m6!*>^EJhf{wH%tYjg(4~UJE<H
zhg?8qvlowiUZfS4y?bi?gq6x0FD!D8%Lp}%ku4a{1`1Vi&|r~7i7yQ&SJ09C*<xIi
zik)!<y}PmyPY4SnO6psnj<lSc3xUg~$5fIUd>71Oxi<ecu+|_pE*|ix*;BU`cQ)=H
z;Y9}Jtw;&b$g`A)GsOmgy5~kyi?C%ZcoFO)z~iG)nkfCO`G@T)|8!W{Ay3^jqqobS
zlw0w7=vw?D7>QU!%ko3NAfLjj^?LaTvDJfmp}{U@-qTT{lCC<l=LVV6`2{x>aYCcd
z5tz;c%WkUFY2mBFV<^C&M@FC~;@$O)7Sq$w9{?u9SH_+FhHTgY!w_EA&M>?;Zi4Fz
z@!22QYK=U_Z_)O^9&>T6`BjQC)D!_(AGZ&+TwT_^#Wp8}_UE-b5<OcxKIciI_!BaH
z0s`<!3vQCd{G?F?%*2iZXzG+$*uSb~ke>_yVoE@??Z+$Q2N*%Pgzd4Qor&nt``q|R
z_Z$ht-WS%i!9~WYM+n<l2XKA-;80bJfSNNq*4u4>6HXKM2{=h%m(-Z+EtzrVaCs`Y
z2t6UOc2N`vxYKK%%iWCgJ3^OKygf*Ax>CZpBgA{@p#1}r|3~T1VEYYHlI~gtn@Qf`
zNOjZS&R*s^hY0o@vj8iAsPsyPEjaiXOC41VB~vqrY*)1&Jh@296zvl|@^L4M@cnAL
myB^mz=m_!WXx2mdS}36~u={9FGWeeCVUL=^D(Oxmm7D`<x&p5N

literal 0
HcmV?d00001

diff --git a/e2e-docker/fixtures/goproxy/example.com/mod/@v/v1.0.0.zip b/e2e-docker/fixtures/goproxy/example.com/mod/@v/v1.0.0.zip
new file mode 100644
index 0000000000000000000000000000000000000000..2c07b151113901e05f8595a2a62906db7782edc5
GIT binary patch
literal 4096
zcmV+b5dZIWq-`8W(f+<%h-V2p4zMA7s#*F_*VNCy9aFA`+NJ>Cz+y7++ErY9W!MhL
zX5n3xt}ilzTPrRhi(s}DqzK>%BSrTE&<u<&ts_Meepos>gRvBQ<<GM8-F1fphJ>a)
zirLpI!Y)tv%4c!%1awfmO_#NvRg$aEk?y`WZ-i}s#=R4;#u4ekzN?IY+)H_gLo(dI
zrdQ6h`IEcu6Hi2L8Q*DsUC(fqM3tO=h>;IQw<VVYuN0;qE|)PKR|BM2$pwU~1-Blf
z04|8`?K@-28i~mT<1LN2=(|AO$Y+QoV&^V-6Wye3YE*KI!#$Kd5Jk87d{UbTGg#GA
zRn-2I*bhVrHk=0k6nfFUI{PBA{REb9>32FD*duT4b>!K&jl|e|AJn(TXzm4~O8ljt
zB0J*l)ij}voNcR@fHL9~k#v)C-N4f=)}x@le9OrYx4t2G6_1uvos`SkE8KBled1)K
zaTu;#-9`aPxce-<xfRN>AQ(6PL&^54YfK90vbCX>yxlqv9sg&4!wdNe^mxG0b=VG+
z&H`nnB$u9kZN=VT2L@fDIi#o>3X(~K3Ol=RiYF`r6Zap*tGY7syf|el)NoFsr^V{e
zmXthcB=I_EcCGj{?FFXH+2LDeXa6uVJI|L>*ia{Bc_0Ora5aGqjPvq7t=(w<>;H`H
zq_)jAz&IB_%iH{2$%e6|TT<DJC2QdtkkE+zg?T%5LZ^{Iq8cWpP>c&Aa(01?8n}yN
zT>!jZ{!ti=ZzTS2wjC^MIwOqwqCwKU3pmJYTq@f+Ne!Np#gnwXqD*|mS}R~D(7#Oa
zzjS!VtNQZp1t=!$x-Xcb)Gyebu@J!14S02@{r=(AsFz2kGB_vTF`r(?hBp@u1%@u7
zcW=(VPcQU8EH8_#M~}AiMM<zoB4rF9XYi|jRs|NJ_Tt9t-Lkgp%*42`bX;}>I$mKa
zX}rg*gP-e~_pKZ<mYh~!6momj(oGj3F9XUIj9u!v?V*lN7Y2xP%p06pBPDHGyq#Il
zcd&{+U(iMi;jsDpe65{6e>A7Ps2NVB%gLRNM*_ZJ$bUY2D5nz5I0gEP=|V)(+2i_l
zNt2?coBdlO>rao)=TC%f6#5t|Cfgj(hgY3d6qTD+78&Z7Hppk_Y6)p-C#XVls>7jJ
zzMziac}qUFw#h6|C(#>ucE0dan(={Zc7x*P_7R&se507^!@8EWFZr{5d4X7I405{c
zDtZlz*@}ts!(C0NGNqgkqJhw)jew{!pmF%kGZ-n4$?W<d%O=urA`{ti<OO(;%CxJp
zjRhJG=n$fhd;VO31VvU6!0gEwgu{3>i0_?HAd+T6osGj`%!+_)SreY6q0$deC1=i8
z>y|^2wf3U}NgeB-UNGVU;Ot*-?k#JiCwrL#Avr%`!g-m<5k8$2G*WZmG6Jcl|6)2m
zEgo7~ElzZ2QycrVJQ*}6uN+`5oVa!{uo@1W$-=WQ3)2`=yF{V89J>~OPxp*ZYzZ17
zowy9MKd^|y{YC1W0fLuxRHk<npF_|NkFSFK0tpL3&j4E5nRFU2s#<KgvtcIhuB6j9
z?QZbaY^&-86MUQzEi`Q;I!_<*J>*{Cw7iyC#16V3082_dj}@@$)JY4_A>^^Q4N@NG
z;80H**;Mi*VTDxp4<-oS4Gv?bqnIVal~tziqL3SMvWH~#(!@MDAb1<SQRviCDEeK|
zD|?QwUR;{m+jLBd^Ixv!i7iX=c5iA;8ULBFJ0f|72<o}z9>mw3kxWP8o9{<$$?j^n
zhZ+No`c-dTokdfxXvX<6g<pq($dIiE^<U{7y*XO8WRasbSAQ(%1F2_503Sw^TPy;B
zt=B*ts->kQb<1ZkKtWjnrnmhYzp2!)0gAznFfcvnT}-)WKOy!tyQGTG?wKfIabdOd
z9tashpw0$53n4}wlcow@6Ziepc3uOV*b-yc;=lbq(h-P|#B#>`WdN`<<m6h}(s95z
zUm0qsi?E@=E>Qb9m<07f$aHjXj3_%~18TsAve+zI{kQ*kmlBr9L9fg2=$P{jUG-5G
zxmItozJ%i!_D$cC0@9fJNmU|_&cI0Lg5iNKE`3wRaxz#SgWK|luvX$mxgd*3C)0I;
z9VY7+MTdMwEuj){6xQEL4d0|8K5Y1LJPSGAfwfcbbPn?>nfjuSHF)6cKh9;jh;z78
zhBD3aR6OT6HPZbJ7LY=Y<~$MS@Lv^Y_a4N!MfJfO0XXC<!2wZ88Dw!%`GGVIF_cy|
zocndq>Q1PR0K6l$i1jSl&i`0rUEwD>S2MCQjS%5Ws;3wthn@q50kD#RXedo0VX@+M
zRC1Qf_4uzq?6L3M$whBA1~0w0W-tmYT9myBU>1mq_?vnIpaVFoXDIlLFm%Q~gtfRT
zJXrhPQ?ZVLjg~Sk<Sq+Vz7u7a3hHflfOC4wf%!ZV6ib#Pc80W?rB4lcFDKVP01VDD
z?%`IRkOczk_z@{wE}44PouPPqJS)BaYMGZu$uK@hOmKlmIZcbGXlY&+)U#E%T$Mx-
z1+zy&#9}Og-3Xr)MJLCTAFNBl>&2e{1~B2F)OiZp!-$i{Dw2YxJDhcUYyE$AJiCvE
zI!z72B*s~Q&&+RILorB;#-9B^wFQSx`OY0J-k_ZItgd;`qL8+rp+uM_W$mhaD;dE_
zZ-z<enaCLGHQ(?Ord1O|I{|(;6ZPeRNm<s4gL=kg!M%Ff+LPiObC0`*uO9HaESrZP
zW(jAoT~?I*0y~joyLEDeOOD}3+^>@{Ru<#(D*ep>GD76lkjYBT-_g8SZH8dh#|2I<
z9<TP6BpIQv(LZ|(cCWJ$y3PgtmL{5B75_ydYl7Kg30;;JBLAtRQ>)DYUybmqd;or_
z@`QuGu5PGXHGxTR%d9W9or%3g`W@VRS0yPe#0QUlsaNbpBZ%~c^qXk>GCaqUIJORR
zM1f78G5Q_tadlffGDC-Bt_vyUbAMuUcg>KyPLirWe<lb`ldJ?HJLy%GtG88Lwo9Lw
zcg+q>uF}?QOT&{)6NC~BysRUrYw?%FfxYEVn5#8+nOTmHuy!N*4M$L46bJ}|c94rt
zW;efzFKOQq^&u!aL*fX*3nM9efyR}6fH}RiC@1Wsa^9Md6&8nKHj}q(fRzq4s%?oJ
z*FD*IEWHCHc2*C}eWmFC4Oc4K2uOPW3At%+@eW%=35hRZm><}%yRg^<$q>>6r$Glp
zKPBtlw~rcdR;j4>-aGfePxBRaW@%)zvmps6y|RB@yxL2UpX*kfA|%Y1-JOmYQTUgl
z@QGv0lG-}Vgzv#}TuP99%u|HyvD?MT`#mv1|IlVk!N^4>TboVc_r1#a6w_vlRQ^rt
z7w9L2OLG3(I%?Wh{7j*Qii6+^n<;-&ZvS!1F>>WEXi#>NsWhN9kSc<A^|&=a7Olwh
zZV)31g?A^l8Q!vb42pqhpAnT_>9mi>_$$*xGa;xa4~V=88$@Ds;b>=+YYhtETHny)
z^t4L%hCWj*K^F@+nNX00+zfQ#qy~V&H44>|qU4T_imTGl>zLa7Nne-z%74(|wld66
znQw~K9^;7o-$tddk@Kgi%>{T6Cn*ZVoJqUx3_&Anf??fd`r{BjIJZAgC6Z92%h@B<
z_pw36<gEQ=oLY-gOM*2=Dt@PtX@AeQ<QFikx`M|vS_tF(Ox7aa|CXh#81!wf2L9AJ
zGF(IRy}f>((?u|>&FR@%|1AbtJYwaH_jm~fNjBaFt6-m?hD3Y#Tpo-;vAioLszkN~
zUNN6a--Z%o)ezke$pLu@&0senxBYUY=$ELl%3!<%U$Nf|9a1_#@0+xdT&g%EjWjJ5
z)-*^24p5lvzMavL+cy>Gb%Ip2b=Gn!1dmY|13ve@vt@xYc(4Ci@cxT)2&GnQN0&tT
zqemVI&I6fbBq8|=l`f;5C8Y1->FmrfVUqD4GZnua8m|sy;I{nOW^kU?zoS>=WO4b0
zCg2+}fN0Z{S=y&v#*Gt-xp&qIm$bBddKtpIUv@Z_tS0cV@C!%lsfw=aKLd%GRcRk>
zy2a1gDB(jK-L)b<A!D+tR~M=oh2%Nz^BNCJ(t1k)t{ZznEp&*^qW_8-6g>=!S;GV^
z83{xg(`zCg4VcJ)e?e5F{QFgr-QIg;P0-wU)gb;HZ6kuyQbY~|xGo4uKWG)x^;owT
zB;pM8x^VoQZmX}r@%-H-KbaKK+~g>}c&pCs)(zN=$qlF7d@GR-nYLA`3r`z;b*5~v
zcAOp8Zw7!oRDT!L7H2t7(TisDBa;n{K;3G5_Cn$Ce6h3uu32M_K-@r!_-?3&egl)Z
z18ZIEPu3-?*-em3GZ?8`s;h`~)QhTeDc*QU<!x<a4Hj$YqzP+;HzL`Prk;cqNNZiJ
zlf}KJ3f1VGZE>aD%J|pTr^7^3IqKcA41OsFGxNPE=kxQVfnlqR5L(>R^Wn<I!ZJdh
z_z&Z__qfOSm{npLX!{a(ary_;iCghJ6QacC(koM^ejIBh+!yGwu;SiT(fz_z3c1eQ
z2^O+))<M;a1@bdS0Lh-4WzTXYxkt6>Qn5Q1gj1ku{s#{#62v0W(~gE92bwgPMA^a(
zSGIh8!Dvj53CH^+TmA7cG=k5b{jDn@M5cYMJE<#jV{Ta(Db*o2SNVC3rgQ<tX&Okv
z7A;bOzhVS5o&>^h=2qxH8tLn6SqX={OpMJ4yR2R$ZRM<iNHoeP{YfqCXfgV?GV?3@
zLQwl*Yh8@3pS%MkZxbiDn}2B(#@VUU>(H^RUdH#L%Nbw{)`kSQDX%_ZF|S=Taat?>
zyrV3!mnd_6+9cmerm_0_eVMuO@F>WTLxDxEIn5itgpW*Z(D#~RC0|q<9rp}mhhF)%
z$DpU9C_iRtenoxHG32v!_l}o9Anq{=&BIg5+C&9GZCl24F8Ho2X~^e{RN8XQAW-fG
zPmx7}U_@aK(<K$81h@-OhI<UCZX0)^rK=T#kWGX`!qx@{WKXTuLE$bWV|foGLbt7r
ztn<19B%ssijtztq*J8V|Xv9NdbqU`@IKGIOrVtqOjJ7F^2AI;#v^*)Qsge7+0chd<
zh5#^~a;Z#wbs2>cJX)+$1Zo$0dh1eY4s>N6^#hY=Fxh%6H;%rE<rN1q9{>BKH@mF3
zDrlguJ7zFfkKoOAP^AMfl{R|OE)gQ7puJ|gKP3<P(QLzW$a>0aj#_ZOE>>}2^C!CO
zN29R5R0==L$$-;d@~yExU)8Ju$St%=;rC48@rkZGDcJ?w<O^mVRWfg~{v<SHkTNSY
zG(2oVRRHEidQs-F_ZV^@(Du*{Y@oY_Fg~J22u?)i-4y3{MurBJ{SPY%BAge>khH+M
yCg&Zo!Ipcq!r5jOK%h93EwUXp_-QDqpXhe8T_eC_{bYdbpY@x@*Bs&_Ot~9uG2cG`

literal 0
HcmV?d00001

diff --git a/e2e-docker/fixtures/helm-a/index.yaml b/e2e-docker/fixtures/helm-a/index.yaml
new file mode 100644
index 0000000..79c1f28
--- /dev/null
+++ b/e2e-docker/fixtures/helm-a/index.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+entries:
+  alpha:
+    - name: alpha
+      version: 1.0.0
+      urls:
+        - charts/alpha-1.0.0.tgz
+generated: "2026-01-01T00:00:00Z"
diff --git a/e2e-docker/fixtures/helm-b/index.yaml b/e2e-docker/fixtures/helm-b/index.yaml
new file mode 100644
index 0000000..7d0c06b
--- /dev/null
+++ b/e2e-docker/fixtures/helm-b/index.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+entries:
+  beta:
+    - name: beta
+      version: 2.0.0
+      urls:
+        - charts/beta-2.0.0.tgz
+generated: "2026-01-01T00:00:00Z"
diff --git a/e2e-docker/fixtures/mypkg/-/mypkg-1.0.0.tgz b/e2e-docker/fixtures/mypkg/-/mypkg-1.0.0.tgz
new file mode 100644
index 0000000000000000000000000000000000000000..be1df0161c669a41460215598e089a13a6b93df1
GIT binary patch
literal 4096
zcmV+b5dZJv1te}rFz%ldx?c=+)7?X*$UPD#DRx9wEWyJ!*uIoRiF~?}`g$Q%uy^l}
z;s}rW0wlg+dPGyQfhKyZ7bfESY6b~VPfT<n#YK-EAQ~bx;F;ZBlP^ESG1jz9QJK3r
z-`$62*QlE0fU%@>>9XJG9hNQo-UC8mVY8Y$+%&tA@1rvqwuZCgE96}LoY4K$g4EVw
z=})f7w?Iu*I9uJz@5Lt>^$$i+WsiXdKbETJb<Xv>mTw`0;EMdviGpsB&X8m5q$)Oe
zDjMIC1~iBL8vR*lNQEw`HNU2)@fs$1RZ2zr@Ep&sT`_dNBaAf#g`Z6hSC$V%E$kKD
zGT8n30wnZQx3h`p=lKewgqu4Eq3&S!q*cI%+%MsB4Tk)zP%oXv8eHFQk*)~4O@l)s
zN#}%4wPh-sd+qgi!%UG>ai+=@g5|0e1WQb^Y8x8XA^5S;Hhj_e_eLXY937D$K28H+
z5lh&&D(Dh1dtk=y)%@sC&tb+G|JSqwWmgH2A=*}GXqJY0E#`jX9J5v{qyjN`#D8=J
z>Qn0m&~-D^N57NtMi<piQvVYtJn_z(SlJ1&>Hb|*VGzxjE1Mb?u&lPDNj|4dSr#E2
zY6B9%mi1Fg|M~Xa(ne45m$(@E2f#9pBw71=U@C8H?p1bDt3>yxaCY?{3U9k|4EwiV
z_}1qBK+SH3Nw`E_ya6CN^b>Zn7!g}LE>{4Fz9YlhYH3UX&VbM02gJqAFHm=xY+h{D
zlKac^s)_Oq$U<y_m$znDAHWZFV4w{o<Z@rJ-9S6B3%AzgURbf9uu)N0)Up^4n((qN
zEfo}fH64TR{tduCh$SR&@RLC+{%*E`?Ht;&p>r>F=oRI^;B*q;6lN@Wli}bn;J$is
z5mhTR1W~UHW`tpw5oIjA(MEd9=aFkAI@bx2z3n<Ebgsw^H~9Ot{`Wu@t@MF&pMSZl
z)nifI1L6T$zo4YPy#A48`2vi?!;&Q^R;~1kLezV`(yZ?Rt*k|%d+z^qYD|s$Q@l`&
z3UQ#~fbe$sU<ND%eDpPdBE=8JOo>;J`BafJ3ghfl5S4M1=k}G>NI`E?u-N5dTFo2_
zuXWlVg`d>jpx7ge3hP|3_B%f!Ls3PI>OzAABa@IQM$PI2@t#5h@xxAdpI|b@X@DE1
zhpmE{n5Krxf-gk`OKrIHMQKfmqx5m`hVRH-%<7wc?6uAq{g~t9haApR($#H*tG3cO
z%^j$FEZ0u>I^GlV&-4x3aKInZxa_wHFHa3H2WT93@4d1m%K6cW#dRuZBEY5z+78?R
zd7gR(X|v3q#yc8XBoB~~vKo|jh$^iPIpD&D7cSvITVqD=>TV|SPSu_T+|U&;MFxr<
zXxxaxNip3+<)`F6{W>B;F$}4j$J^Xkl`cKy&Z@BxZzco_pG+d+>}JW<YM(em^5P)e
zb^o;Sz_!e6qut_V@~kDn`vSV~or)mn9(INd<AExGcVLW<_$|GGH5bneT&|fPLv&WV
zb0SBa%TFvHqv*kB3DA7RFShE@siLBn!{(c-<|0UBddFIGr6gV1Eg!8i2IP$IJHYx(
z`+~Miq<(v5=e0^?1a)h6(v=ZVEaT3!hs*|eALHpRmSUke$~`((Ofl5T?rTYr)lvkn
zq7?Zd^C`9{jL%jkwY#FgkAV8SRYz-O-}bfj*-1~FAw(#%&AMHq!Gc9;pduN!EczOv
zg2#QvlDn>Mhul)l()p}cIcKP*kosyL1eD4V)Tkl=e)PpKgUkZE8tCzd_@MO0jM*a;
zd7b{eF9*lw28hS(mUlB_CT;Ls$L3N9Q-nC^+n?|hS!YD1z7q!OxCwI8o{xL!Oz9-&
z=A7rnGhIS{YLBX-->7N`{}ScQR~-Gn2I3@W4QgXLiNi^8cQF0|JAmSE5f$<S28J{J
zd`zj7faOIFxr-cUiD9PEWz+^}d`9Ei(CC|mU_Z7ge`D$*@r4-7GLOmHjmcW=NDmrd
zKk!PnSKVTYb%hFMd;-?=cymO0ix()u5wMd&ES``p=&8>1@jQQI;vWL3$h6{WW3_nJ
z#O805<fzIf&2O?ZK%0LeHl<OVJw=t1vPznhox~j4{}R0egJ)t>;*Nz_@MTgH+uHq1
zNAT>sH#@ww1NO@cj|H>IDiC`k97*y(l|7#>$e8AQ8;$b2=x95s)GfJ1f0j1SzYzWn
zKOTjC!o2HaoEyi<F#s8RFc|21P{%r%|2_a_TkfV+DNuLe3Np+NEn<=O&+`{35~LA5
zOpZg{>;_OBb~kyN1kMpqb!rVnM>gKk!kSern)#viEett;YmwM`54bToVQUcl=?NC-
zzDTHd6nhWYKekr8K;}E>rqV#KJb-`USJ8Pa2f@f%2f1)Ev}Ih126T8(>4!66>r;nO
zY1J0<p@v)rPV0;+a3{=IYCm>`;|ESW6j1E9pf(?s2n5=oDdi}Q=;?XcmFse0N)~)t
z)!h+M3{!4w8&fL}E#8<kMN>towboe_o}_?QhxdPkk#cfy`?|jvTF2cs!Q{`sCfAIt
z4%DQdB8KCKn5|u^#j!FdmU%Yq|5}X`rRL!DQNdcA5WW6(Poc^^Am`Vn1iXXy0+hw2
zf^RoKaJ8Wl5sPx;nVFqYsyFm%*jdAIN|pGEh@D@VsTL&;{zpBtM*O<c5wUK|F(tCE
zx0M&k_eG_xK?0juy+8{FR92`rls?=ovmv!%t6<f&ka|EG_I0fUsZn>K^nBij;Wd&T
zgaL>@P4L||tmA_;9)CH05+Zwvr@W>}C1h*--)k}3HdK78;I>dOAkTtqu6}o@M)o*U
z{QTzj8V#;+U%j%Bz4C7*Fh(9I(N0ziZ!fe?(oH=}M%)!8GQE4kz^FT2XLJAGEt@0Q
z5hp0K--WVC+WVt)f{03m5|zskDa!?<Bc4u(&sH|TGzPaM#0CIHFV3jerAP4Xjh`3c
ztPXBZ_OvU)ih>%(B0SWw<Zas64}R5N`9BB8v<?rTHVBlU+TsB1tRfWcI#z5i((@63
ziuS&wSs<XJxK=b23^iF^23_iTzwQxLC0}Us7}(Wz0upW^+54hGyM!Huv1rN>m72uq
zSUD5&GmL@Mh3lr#A=ofGJJC?_8D8L-oO>$rxc7TChp#3r9+MWC2u->OQt-e`W{L#%
z4(?_D2-4mBL4qrao1fw7VSze^k2%*o^8}Kg5+Z`;b4W#~wQ=0l{g@4j?EbH0py9sh
z>aW*Ec_l+V`$uN-ryZGt5a6esT=GLvHlhO4j2J-i7{)l>J~1$Y&bhVG5Ru+z4PrX3
z7<h^FUniD*%E$bGs#vr1lz~Isd4ee3<#~%@YGP4yJf+iGbT;o6U_<Bdg&65kc-{tv
zEW0uAy{dnrzgXDeFf&<6F1G>1`*vpE5#ed)u9jahb3$&;k<%vFpdtC!n5}_dOcW0Z
zAkY7F0ABw;;Nk8tTMQ!u&=!kqK9mIv2rauZG&~O_=lvz&5J<>C6AIY?+KLUfOY@|L
zgZEpGe_@dHNa(gt^nIM=ma=Wox(qc&0NS5rtC?dG>8knC_J%|P0m$iGO<=Jq76eBG
zr2XJwfj+nGCo)D&r|<34ZkykSP*v9oMH@<k*l|@pix;RTa04^WiolUwKvPrdg;~Y#
zSIZ~vI-Aa^E^GU^W*^p;^gp=Q!u1L{(A|&_FZTE~l>O0;^|6;u`0uXQv}*}#;rb%?
zb|g<_Z0Bjjsj$eHD6wyYRY?cyjAxd2_OVDb5n6;dD#CZFWEG<KF?;QmPVol&SL95R
zfnIvvCY4-e4NknP5i*9Cg1bEvxkXw>9r5{!Y`P@2z!lrGyCC<Hq>eUO__2u$87Vg#
zB8aWCykKCnUfb|drmP5gP<DyB3zjs+snN+is<_Qy2(`$<8WuR!i7cR<vW|~6GbvL@
z8X=LBrfwPza}FX6s*5}QW8#%?r(k|k+mG!c`H^pLdDn+5iod}q3c^uKLpm{UctW!U
zr8MYYa)dlpqrLl8x^0B?5GZA=80c>>d$`J*+!{~8SW*mr_RzrZSH&)Ky}@redmD^?
zjmHqJZr&;x<m1AYb}&8C{@^W&@KuaGkj1gk5o6{)y6`Og{*H3ISgo!BMIM@|0>wmY
z)+sfM5;Ul9a+7y3di>zjxH&R5biE4gz<yG5O<%?O1}`snX}_E{zIY(0%ekSB&{{>y
z<~3j0xM}qjKBxL?`pbbQo4%B|dx_Y0v<B4SXk2zix*_FZu|nF!fzf#qK%9^2r-dQ#
zcpu-RGWiCn7`A;#0S$Wc7e>+LMx}qY)dTWg+wi!`sIA|U4|#gM9O6c`1W!_*))@;E
zreD21Z*|s5R!|HQ9gum)p&BKVaC6BpVHwD+J8(~l(=|F7Vssrs^VBWpJ-5SpbGCNQ
z?6yH|P%@7zC^dQU)yF<F$clqys`^-1`!WI6(*i1h2Tt^_>p^}4ycf-=NUmN_A<8<c
zV*Fe9B8YxX|9rMhODF~+0OxvQOraQ7#9LuL`63OVIp;4K+7?`+jM--5o)n(XwcCB|
zlvg5*V}{<npDF9<S&x-T(9Q^uiU>$iSl~`a-EcQyGjfJyGnqIhA{QrMxBe7}CE@qz
zT04I$vQ~4is#%%ARbw)<YQ4%oGsivhfZ7%*<SW5>Jp?fTUTh~gttSEbXoZrX6J+@<
z^!rYVJLv8ODuRs*Mp>|D6rtjW^}esbY%|+JJ^Ukqz2HSXH;1<@bgD2QS|bsk^5Sm9
zS!{gI@!0#GIPfC$h2+b;cnWDG)+0{l9I5x*kDE-swf&R)Nx&bxLl|S1&5QS&(i7G*
z;--?swX*C0hRQN*ajXFgHz7>|t^)KUwGR+i<By>Dry*>dv9E_cNGjvL`m<(!FDb@5
z38ll-<M?=@?>3*yyVn~UviEQmdec(UfC_i(n9Ie)SA}f^)#R&DIImKbGyPh}b9u;t
zIf+m51I?J*7)4E`ilb1xp|n5MUg^_VA=l&=Cujp0=Wd@8aUiW}XS!WoAU?2u5HZ;Y
zxWE&E)(MIEGQ~(9KYXOS(F#|7F(jEu+f0>zVMft!-^)j$5^8+n(@ikNP`}bc>-g&y
zh4hmoy6023fHfo{ybIxA?1ZOj)<w0k)$${o;%@E7A38ao172@|B&<w^#*OUmLQaGG
zt`r7F`+f5e#-T7v7nz(yAO781TcfmHx6)Dri}cU0JWg<8Rkou3Af+sTa)_elf*L(>
z9+Y2cR-g!mqL3k8E=ho7w*rk3Nhp_jELV5Ow1jcrCtd`T1<ON!5ii@5gQfAI=UKi~
zp7_+6c&@kBuDjC7jQqt-tQ`HCtOZu>>!tw3mRKe-?BdBmkt~TErD~cFv9slRXERR~
ys%TS}Ynma@81b(7D?6{FJyEh3<sh>Uf4F|ffG~4756u%<KNwoU=!#P5^C{GU4ga42

literal 0
HcmV?d00001

diff --git a/e2e-docker/fixtures/packages/foo-1.0-py3-none-any.whl b/e2e-docker/fixtures/packages/foo-1.0-py3-none-any.whl
new file mode 100644
index 0000000000000000000000000000000000000000..ce06330be66c9265c443dc739be610057a2b6b88
GIT binary patch
literal 2048
zcmV+b2><tN<DOaY!CZ^g;tAjVtF`P8NJy=5t1Gp}oR3%7nq_DOUyyQ~7+U7Am&yGY
zZOG`zs*dm@I3U`^QPXF!QoFS!I}I=yI%Y<QHa^AMUsqZ;gI8IYgP8nW+D8_SKKhVN
zbXj6S0P|3um|<}JUOr%5q)Z<`1ShPCV@6SM=0!ILSw+DVD1h+?n#smZ2Fr6suCwsy
z<lnF2qb1+aT-*M<D6_Op3q$K69x#gW!HBLS!?+`HO%Cod$kMAIh&gg7BMh_OK$<Ci
z1dCA_!gHuFH8Ah&52z>G#fsZ@<ZAami_GZEMdNvrHIH(Ord94=ks4a7{l=oKD7Ym6
zn~#?JQk&3rjpaf#klojZrZ@T(j*ZpVeZU_(!b>R;$Gd?<)~jf3maWVwg+^I#+7NjQ
zb;o32Gc>Q5XRkTY-xFQcJM;}<J&}S5#+$u}b5TjDV;08rH#q5v+}5tR9@a_}z@Ice
zbAAxPAVhtC4Lua=FFx>p3Ut;Xy6=XK#W*V4N+4nsMzi`Q%_rOlo6P`&x=DLOXUHl8
zwZNH^C#7J0CQZ*r(RTX0Jg~`^Am+^Xwa<Q-K$dnDi>3}0=PS7xxE63Z)S&3K5^asR
zoBA43C^aq-v)w_*G^Cf}I;WYE-FGku2Pcv*bRpdyu}De`mNh7m$;iZ%6^opIn{Zrx
zHMxeuexkYLP_KFI#MX+mEg$<8A)b_I_O8yr7LAz)(O;|6rB`iW-D8luy5F&E9BVgj
zX{-cDlln`=Z$n)P6C;Tu-*<O<y9iTrGMF|$I!$rz8|20#cIPUReFfz4ey)MxxjuG`
z;pC-mrFYFC)7Az$SnEcKvlvSqQ)=6fU4l)~<LpzLwF}kyUt}`1nY?C~Bv%9UkeU51
z_!mms$;oR{RdCdX1Qp{wBoe0rq%id*U#TbyV66V%fUU*#wb7}2TP!sKVHWWvGdpt=
zqF){7<jaL8aQJ%F@O6$8%wyJdRFsRyI;Z-4xJ`lkYK~l-S`Q+YaWV2a5@()g2v5=9
zioZ03OL3IJ8bk*)+CcGE00L%^a;Zi`ndx9L3kDN-SRi_|NBT|rCV#NKjy61SoTNBM
zRo%$e=3q;@q67DHcZ&LP^L19OR5tR_iZG;O6boXR_ZNZIXBpy}WOen2s?YQlYD0c7
zLz_=FNyLndQ7s!!3jfThtmf}OA*dtc<u8jj&(0=i!m5(+_}x`-j3E3ce@u9ZIFF&7
zJIS<VYPTm*wC<v=6!#JC#rPv&871Lccd07T_juTi$P1oAzTPgTWgAHa4+1spzUS$c
zTSDQP&y>aVi$RTSJH&g2J3Sc!|7UQd_!a7F0b%<;n<EG;252coF2{(9Ck(CN6M0*Z
zxV86>8n&|<$*ZsK?mln;q-7hKl?HM0^l3SRYoU=A37DPo`kpnEL7JwaIzkD>i3JU3
zI0tIUXzS6*?1bvnGxN#%ei|JXn1!NOn?V!;LMOqyPJ*)c-1oP>Qp5smu_`C!%g4?i
zD8Zw5e~^8+ivViM?CGI-9!3RmKD+Oz;uEb&-c<1kqOu+SgDuaF^;LKgp?=N|UGQ7D
zR(CwNM`zDLPnDNSiyMM$w<9+dZP%GN64`0rUds}G*`%k;f~<j#DoYRk3)dQekS0Z3
z-YY{Rq?42Ux$7AE%@!|iJTzHqqhq0RmDo}#10DEB>?Rv>r#pz_49FtpmtQyEA=7$J
zl1;fOTIY2`4QA%B{Z?|h5@Kj4XQ{l}?clkN_*B4aie>)>+Jj?&XaDhq>vW<-@&Bg=
z;~|*EkK2bayNjDXQrtKH`sN8?TR)kjiY;5PQ~)u0Ziee!O3Aj_=APSx{!3deNj=DT
zOOn&ADo|P;+h7N>d7bUf?7vf@Ed0KmW+9ltcQ{nF+0~1K$g!ZY+`v4>mj<nB>dd_3
zxfHTf`l|_KEvCF+N}I(gc_7_Uc70hf{Wa3Q90B?w`K0$68h0Q~$@l7SXLH@zGF1t1
za-x@=Ga2I~XjsGYFI^qy1PDTUHg?MAdF|SQVG|}|J8vQt`s}$2-<n7M_baD;v|5XD
z{!fJ%j@t+;up!W!u8;<(D7Pa6(Y(@d01COMPsK(KpJJg{mxYfj1VF)vqyA5TUR{D&
zqFc6??}S&qiZ^Zs3|c@TJ2r|KX0EY;^a#H3%_hqVmMFkVSE<##e+_%nJ?0OdJN?1T
z66CQJuYF9n_ThHzr^9Sz26UZ93Ab=j(sG|j=-TVoUd#yS$!yW=w>CiLx~j{PCm_!`
zM?(K69e_6rh633Owpc4fq8|W*YdhFJzD1vmLsr8`-9>ySeonbW#x*f)T*KhCyX|^L
z6vWY<Xg>&jnoi0Dhdj;5qKY#K1<g_!^o4?alOKqiMC3lSpzT;m9)mw0#8cZLcZw;c
zapS!yf1zA9nrGvF#Yk@(0bq5$$;HY$n!;|I+6pl7yBq^AzDtI3%Mg4)aN#59O+G10
zyO)OdZ3rFjlIaO_67`lKDNCwyyA^pIJKL+9ry-u0f{b7b<Lhan`Al`gy}9Ei_gVF>
z<Y8r63Rh^UE)J1hV4d&|GJS0SpgQqf_aX)<Ly_12&h=>d`aT=efjAYgnptO}d`9J9
z_**%OkrO=2Hli3f0oHhl?BH+UPEdYqS<^Ofj3pKpU?D4$^r`WcLex=3Fc;I3Ykak%
e+;Onqm@ES{-dF_->V7$HQO^x>#I;se$xc+L&GZTY

literal 0
HcmV?d00001

diff --git a/e2e-docker/fixtures/puppet-releases/author-mod-1.0.0.tar.gz b/e2e-docker/fixtures/puppet-releases/author-mod-1.0.0.tar.gz
new file mode 100644
index 0000000000000000000000000000000000000000..46abd920d147c015a6792dce38ecf25197902db6
GIT binary patch
literal 5120
zcmV+b6#wfxJp+3IOf5+!X1x60{b~XzZ2c>>@QK59zF3tqOS5=$dB3Rex?6LurMuxa
zmt`(Zxk?glz`1$fyXjYi5xpWCiEu>P@fm3pM8HvzuM({~;F*_ogat9Frr3F5_Dmr$
z<XRUUp&ZlA45q}l%p;}_3g$0t#rAt51N=8GA?t3A2d}j?LhXNA+wG{EtN&-Urj7R5
z`N8IJb!{jHPbmy-t|B`bjiKca1qa%_Ho?_9nwWI~0@=bZ$e0r-6;EO*Fj8dt+}HZE
zyqipF_D#~y$lV1nf4A(@uCGae$0v~glxJb)o1L*xEWwUXRSh%quzoMx<T#FN{dmKv
zK+Cs=+PWC?GqcXAU8bLg^aU^)r&c}(I*e96`Ug4~(1YGNF^^5t01tCZ7CJ!``R6^B
z>;UHwDEgN~qeLhf$RCN2gP4fy<<FqThc`L-yCzWrVPKN?apAmd`Uee<Kj>WqURfMq
zEExwUB-~Fa;gp@Z)aJPYO^r;tY_&*vGQ1Q-xb8(j&~=+n>?K7yj<k&Bpc)!HV@n;N
zLb5V`N5;5X$O!3VlxUF0d*U@CgY)`?hsA*X@&kqAGJ2XvND@T^=)}c*fQ>CDn_?}~
z0*A9uDL)^&RV9uXi*4EtM2T`B7#rTH3H&S+*)YsFP(%T?(Rvj|PwhcK%j0jN2ey-i
zrS;H_3^?F@im9B0Uch*nXS|g;%idAj3A%muYC?;zTH$n>GNjkQxa`OT2ixxM*x%_^
zDD!y=c#sU0>j{T}W!QMF*B*!`3r^U|rUF;CGnB3V_k3d2mN0VR+6W10D!FO$*yoDD
zBjKzGXUX(j@kG1}-75Z?-pWY7EuMIPsY-mH50g&q8y&x7=+s*Ug<Wwy<VRRzA4DTR
zRdz-Af=vbOo(z3UT&(R{GXWE8dzS&0Kf;@0OW%8%f(j4^Xk0T%LXRx&ApUKH#1NhJ
z;hP#JT+sPeVLL|m1PMMO)IkiNOvUsz%tUO6(uvK1Ft3>;DevC=>Mf{m#Pa(}IgTJ^
z+QUa`#<p#hq~NTs+?VpVGp7)o*?;7G69u=5jw)aKsjGu58{_Wv1qzTm9nOwU@pwyg
z(+%>m$FT@G-?p$GhM+hL+^F{^%`^asGliyCAsAs|do@j7Xtyvg$CKk>jg0*pq2WFu
zt7S#U0^wP!!@0XGWYnC$YqlDSkTw?<uXHdFm!3D0@?)zK9lR*{<@K*k1#cIEhLp#4
z<-&<3#>ouX`%6yx7{wOlJB(@Qp6GSvakUL9a#*yk=pYwj7Ojk=8@kPb6D;D<S5$`I
z%M&~in0$a$;#7P$lQ+5fL{0HAA>=SCtE_+Y(`5bj5@hJG5wS^*L~5mQx`OkfPHDRZ
zRe%F<;<_QinJ4zs(fmlEAe<`W#N5YQbji9*gD-81rO<Z|I{r3lBGAS7U{c{JpfCES
z8#nD{X23#BK>ef9c@=*U3CWMO9!RVU{7~LxyD)g@Cx?7pi*%8NP9f-Z^*7Qr0&sZG
zf}?SaKB;Sb#Lu+JJYyCw@QWv}qNHJ<)&Jv+XUIi?<8~=rKuL*=%*b1EgY&gNj=6*0
zTxUA5X~mpb3cge}prXAS&@!f+unv##_b<Tp7++$SA6f=AYs$8NUxpmflGJfj$*D|%
zhz}of`?}hkq<|S`7u~VXm&sY1nr43Vi0PvGM{+&QgjC^ZU8=U4GSj=T{fyT?)Sd#D
zAYry4n&o9oC_K=nY5|{(Y2e@2ZV7(!?{&ug#50(5^)o?qCsSq@)ctubXCg!<#;R(t
zG-p9tv34!nYCIm9+JWL*cczY427kZfLyG#yRV#+B3=`tCpEWqK=Tul*QZgaK)(~xo
zJDj40=zhTjES1_DNerX^$@S-cp0wX2*>TVQslLT7^K8P@6I{@x809L&RVQ701*nTo
zPnKEcwC*V;=28n~nfa{wuO=Cx;j=cJ=f<PmjM@4$0}(P7Y?Q-I(k2#MjnR95|6jUX
z^Vy^NhtYZIoyJlzT2iiu@mu6%zDGrnJlfkUO}cRsdxjp(Mv4+}wn91W{BH&4RD$=L
zcXBQh80sIMH}KB1I=(tyV|?M-U;-vJ2h6)&OM-w*sn43hg7b{y0*%zcwOwX#fbx&W
zL<Sh$S1Ce1vBwAHVDiXWs$9(^p5W@(0tsA#*jY?SUFzY}WUqMlr@s<2Bob^-0?TyG
zF6i^tg#U`ksZXB=IsP5M*kO+Y_pw}UnLrV@XCHAV9NCPe>KN)rMg#K995A|*%apAC
z*PLc^GSx;^RJEcU3W{k?w$PLtg0jKhlbK##om|dL`LuRBch7(+St$=|fpr2^wmu(T
z!Cj0l1c*Lt2^3ccYgSB`0&i1_M*E>B1LffYU#8ntAMj4z5j?BOL;9E9&M(90l_4_L
zX-_Q>c_F00;)StBAswmys4VWL_>=FB)1(z<Y-Y_c7ejMQ!z?xDwRb|y?s)}p1GPIx
z<uZk%K74^q4O91Abq92gMS<E-#k(`+*2ZMRzJsVY?4qYkhhO&#QU~AjgziCORE5zg
z4z!(yqP{ZBDIBmL&kj_hgtwgUGyY13F%H;T*FhGL%fZsu8D`y|^SUC0`xGpA#4PR0
ztWJYcCXrIO+Xij{6h}cN)^G0PcAZxH*z$$Ucq|#dh~*q-6PzrzHFT#`P6r|RX=eZW
z$3IgdcZg4bLnrsBJxBuj0VU!XY$BDLV6()=O`0s^Oscyn9=<d8iA~WxIj+>G<jfXZ
zen>d$%%bq0;M_qym4BiI`GuXsri{ja)`;{>9PyoD51n}P9zhXT7YV1vz39%fD2q1N
z0W2wJ>!VvQi$6>D4Me{DQEO^76ZU?8lQz?xEhA-_BzVNGK?#qA)uZ}pgKq7d5*|5Z
zD(Fc#e8jQ1-EJ^=ED#>zXvCU!F>q>q(Z@V-;4iK*c<f7m-@Yh?lxOf7!7ZLESJrSN
z37}J4R+FubWA^|8=W*N`o?Mk30;OQcGLRb}Wo-C2`x|CCwB`WUs|rkf6zbs8lqD&%
z_^V@Otk<p*2+duk1BX0;wAOg1%Jt#L)hDKe?0t5N=EuT??>JKj<xe;4?L&I+I-uI>
zwC1_3efDl8ppk{puLhE<@GIJi(9=V~bjo4V5CX<~95O@!((5HD%pqgB+RyPmfqmKd
zJ}PT6KEn3pC)N(i;_TAW%827q@iC5Iz)UdMBBbd5rSC<k`M9#NF@OPYKcmQNUNFQr
z<fh@jOXm3!Ano6b2uQXtr4v?q$LH_!hM)=ku);NlKoh`EKNTC;<lEkPU~t&>bnnt^
z(yk%K^n~MoD;E;eI}<;B<H&p{DpeT-e}+-0A4`0w7sMCoffvJ77#GAXc=V%FxAXi-
z5M{Q%eD>pDXq)M3gn|pUUN1ep5(1VVHw-CKd%4|_f;$f+9zf+Qmh!idDPP`HW@&qV
z5fS?8c1NiovaLw+U@f78JOGeyQfPdNm1*wzD7fxfEFuDr-Te>m@=SEWMiMWD=!VXa
z(FmH3BanyA^&25?LBRsm4Iqny1CVX6RP^GD?C0C8BRvn6@_MV$gIDgoW|8nA>r#{X
zy!k3M+gBaFFIlttkTI#l7WO`{3+Omn%%-V)aDE;{+$iAIHhLWAp#mu*_%|5MO6<b1
z7rDV}F`|cFx$Al2a36urBf}+?gAE_<l2B>P_W*<QfR;|kGtAVq>bM?$Zp`P=u3oQP
zm-spO$Zvp`WHYwcWg&2W;-bQ~6N|i~R({ZP^=HK~Njh9lP2qBmwLZr3b;o}A5^ShC
z6hv5M$?L7L$1i`<90{D5tc68647S;G6T#BHJN1mVc4eQ^GL9B^fJx!n8D@884}}#V
z&}yg-p*X|3IY{1`%?eAw(4Wr_>u%_aliNhFc@wVa`k^{7u5GCvVsh1pO2sD)>7yeL
z$5{h@P^IoIN!l>*LXTa2WKugNA<gP=S2A9WF$+&&R!NXTp#gvH%J?2;cc=@fV5Id6
zYE6%ew*NedU=7s(?d4o~CQvd<3}vJ10M3^D^<CXj(S&c*l5*7&>pz7S;<>o)7_%jr
zaEqUV00_a%9Niq?9h+Hw4;7EmyD_Plnp-5+Rjv_cl5;`F?me4EmoaJ7+;Ak9+$tk4
z+r{GND18kpxgNADHhQ{em}ehV6qvurDyWSXEO7N}4(lp+5t~4aI2e>2Pt0X8;EDOQ
ztn6i?&XxribdhlXNV_8O(+}}qI}^dYhM7K(8t5D8PM$$*tEIo5xx?gATgtz^N7C~w
zaFOZ>g7;SGy0gl&Ct?%*p<gM&sETt^;sK(0_4s@D!MkGxkD{J1qaxgYcbph<4ey6=
zS+2bY8s54j=V4L`aBOWz+h^)kfWoj@y|LOCvY>O73mNV$RBo{RCUN>L%s<XOo(2eC
zxwe&1+pXFM+*h(^*eCY@%2|$ODsyyRW``j>_CrP1?%2sf>#wo*KGtMwmq|rsxAwV}
zsZAb0cJPQzJAioLH2~#QD0~r{u^u|wD|S0f#eDuS5w>o88W+N(qZk}3H!&|ee{a<e
z**Bp&3A(@zx_K*xg%dj)Fc1Xv^U)F){jBnU0IjT`Apnv3Ky#Y_*oK5UkZMI*72>tJ
zI`e#x)3SyGw1q=8E8mpGF~R#XlkSk^VMNd;aPk6NV)ntBMDbZo^@t4=-kLSlxYB8^
z1@GptyDe5MwoNzu%!z8^J+HNbmN1e0bX_12iRrm3^#@2mQP<b${fszQx+j`#-#V|3
zIsa5oO165RlFzpU+)qLpv<uCeU&uW(|J#KzG43f9BUsnX%G?84)BjIUt8!^FAs-&;
zI(k*-?{TJ8nf<o1*u|_(Q094FpIzuu7}?0EdY(`}7SS63o!H~6{Szgo=uUh4rvL@g
zKqAT*9EvkSJ^z16zJSe&Ryg+HqUv5HjA<nELIV^nuE-p|RQv^(_B+O1Onz-qU7Fmd
z!^f}iMleF~&^a4F1H_ankFMj%_3|L|jp+y4r}1n@Hr%|zi%rX+7KVZ(8ib(u>Rlk^
zPH(^Jiv=GlLfXOA>?H7TRcV+6pg7zg)8zk1ihhVo?%3*!Mo+VT0Z4fba1(8t@-ajy
zm~ITiq0&1cTA|Gr&hWZ}&YaeKklfI`kcWfRMmvzVPZ<Naz@=3PiFL$#R$tinm-jH$
z7n9F*T|y|dfE?2aAJUz0#6k*tWtdV+8vSkhy7Ky0WRt_=fKyf0acm9{Y?$l%XAMzk
zf%&E;aPq95)xXgDUY#{UZY*+p)D3wvauNu*@HNW9XIS3MArT74<&6{xIr19T6l@w(
z<=)xaaB-QAmwvxqfMzC8DC(URFlK0=T|FKhFlPFAT`TLx{rkTMd^|+tNIMYoWfmCp
zSN9tmwtpwHXpcXaoycuV5mXGfvU#^^*Y8Hr=FVYufRh#M`1dmHHdmK&7E=|9GQy$e
zE|<uE?!c#9TvB*kj8KliXgF#e7F_mKjcu=piNlb6&4&zMBgLJ!k!;_5uANiNu3C@`
z0jp}$T2#jaN{Wvl#Z)4<gkFUPHjLy@h=y!;zJ0wK*M)S4{-p1&x=UpdEN@pEQT`xI
zA&iD7@%<YKijfa{MyEp?Jewi`oG@hBcPrJ6%Ev6PB~bbnnPkY-1#q<=uK0+pGx}TX
zA<8R)YMf%ag+=(2Y7~;wl6lN?IBa@saR5X}w8uFDI&9_HPGZc8LTpB=s>IfLNR@_M
z{IpP}OpVC0@qeKzuW`ms1p-SXLX5rZE!l|n^E2j5$bhTf?PKz+HerVRE;zvfefU?3
zgHA+|2IwzgeIUrq7L{e|Z$p8}*Ixuxr+Av~@{f4IaE^R{rl2b`+`RbzpPkz^?tKC2
z_M}mkK9O%8cErF#@!@tY=MD!jKY~CKYl;_o<nWvwdaCK!KhmqEc~0g<yC$@ZHLgE0
zOO9POj=IH`XUMHQO>sWeF!gxfpXvt8k+d>VvuL$DUTcVvO-V^Zl8Kk7MkIZpmj4%Z
zq_bAMnf#NZpnL9s@Fi*RoTVsmO?AY-arJ=(?x-$>^XVNFex<Kai5XbW8IYwyt?V^^
z+h#PYjvI2-kCtv$c<VjsWxT0cufV6@`dXgRqbE;QR;95GMOxHQekgWtH+t<GA<eT8
zVLOFpJwl!F<{5CMGV48@>luM^^t}uq2m>+5Qh=<Z$$qy;&zwz2zo)K_7=hs*F|EGR
zIN4Sg;2cm5A{$DZR$gC?YnFalTGiQ5B^TiewI>!cqp@}%N!`3Ve-_0b;P>7g0Ob?a
zfl$Ftyr}C}<JrkY!{rd8VbWg%8Z(kITu?^9_xI!9&uf?R@=r|<vhFP@yV}D36RF9^
z6|?@TPU643)lBW{l_y0j3d0g2(*J=dO7TwsVuvulXA0%mdNJ2$4~%nz&k0H*y<Fu-
z`tX}gmNT{*#?HZ_3Y{x!p=pf2LhhTdci1--CvhEY<qx%pBY=QDo{$USYtH@9h0Uov
z5jIg=0c_Ca@fMTHGs-5#{4^i6!f54zVN;z<<D;RHHI$4P*n|R&+ZyP^#U|tn60Y}c
zBKVK40b0+xu?K^*^+9aM9|0Pj&9qFxFBuBGAXdA&V=JXd{f=TJ`tLsD!Vbo&m_mW&
z$WbNuc;iX-u_hQ7ha&X#l1S@Cj?r%?)|;{;lzec<hdeVHC@sTK*eGngRmcjsKF0bx
zf?HuF0$Ke$HmFuD&w1;uN4W#j=BJwr^iiXA;favYzc-Ssiq(bNm*J9_zTzV|sl@gW
i@33emO&fOEO~$%@BKpFtW)Opul_c8uX-`AwM!phH%L<MF

literal 0
HcmV?d00001

diff --git a/e2e-docker/fixtures/rpmrepo/Packages/e2e-testpkg-1.0-1.noarch.rpm b/e2e-docker/fixtures/rpmrepo/Packages/e2e-testpkg-1.0-1.noarch.rpm
new file mode 100644
index 0000000000000000000000000000000000000000..1977530453b8eab78a6c875b8f82a512a20eb059
GIT binary patch
literal 6838
zcmeI1TZkM*6ozZElZ%Na8)MLjNP~!3NzL|c`XX-3x|d|4n=IMHMA5|R>Z+a2_H;Mh
zJ=t9`5<$=h5haKU5@Hk)R1hx^(Fc7{^g-VQLD2|`iFid35#xH!Ohwl`>H9QWedeoE
zb^6p_)x&b;yXU|Eq>sS0AWT6^QIy%tG&O2EHL&;pT@|wQ{0R@ec)FtcmJ`zdDtz7y
z4L?5vwx5v7MPQdf!wbe%)`CSI=yKm_uvKWW;%~vie3C(f`F%ftMgI|KFu(6du;{-J
z+?weJ+%|kEgzgxQ>G;fd99O!5VR@m$UFqAp?^`|zT|?Gw)6*R{@N6lay5zcFH$&;@
zZs-^`H$z8Sy0kd6J#N@x-Euv{()G}>Ezwo$f-B2+-yT@|b#3$PZ^O47y!)P6Na+g5
zrFZod=qb=spr=4jft~_A1$qkf6zD0?Q=q3nPl28SJq0>7k%fhYhd~OcX%MogZsHKK
z)Q7Gcpg~<@Db_`BObBfSG`z6xfprqBn=Da$M)7LJ-zdIVG1gHofOd)E?-XMx1LJ)U
z7V9d{DaJYr#(zQaPhioHH60xPD_HcORQwxQjQ^(MvtZHxp5i|hf7s<J#=`coVjPR5
zsZSMSEacA=uLO(ZPbppn7WMd2@r7NkT&)=EOfbH(QSln(-=r8dh4~e={wnGMIaEM@
zTwirPSe!qp_)@Sqez)Swl>g4It!@B|{!H=Zia%0}d0_lsz+!x_+h6%ZG446c$L;L+
zuTy-b;;mpIpCz{9ZHh4t#%qAZ`PVDnr~F$K-wGD}ql#|_i}7w&e24O%Tkn3wdzC)`
z3;8ce6^C7};y8T1P|Oue#ZASr;u*yySa^Q*KE-Xt4=6qa7V@n=*yVLcmH%<Y?}CMV
zs!uBZ5-g5Cq4+DX7$5r~zjbGn|1|OlSycZdQ2!(b8P3Z{GF}c(HZ<^RSRK_e#%I{H
zAQMp%wOD+PwRRywEtuEJrqC8o3{yTM^3MFC9hDFz)x@00c~l5(*W|>?IOPx~7g<_F
zWtvB#&{z_7Izm=5ZCWHEXJwQoHAwW}`2K;GC|Qus0g?WR#%{7FDKfz$8Htd@QPQ3x
zNy>8G!~t;i-}?;A8{K!rb1f-#S8%9z3a8Gb@I7vamf@LtopIs0Ec8R^xxN*;OmfS&
z49m1FlY6!a713@uLh>{%ySGJ}b!*18BImU{YZ3S^TU=2_!B;MBFeZ+IjU#C*%S8d&
zjYqNA!CImiAj*e5qtP^o{!iZ|n~zi08C+~*hs0zqWHk5p6y<Idw-seLK&+Zxv!Re}
z*PKp4+wR=!HM?eboo-XF!P|attg;37_j<T(5p%4S#iGX3)@F@r-AXvsV7JQ%_6f(q
z6U%mv#~YW`Y4~}?;;Q+svEk8)F*4XL^1-6Xaxu6_t3g6{ni`dHnGUfw90)2UD=8pN
zgM)&X1@wqHE;8J9fNA*41yA#kPIFF+*{I}AI4CrWGNIAEERNxxq!hBwViqNIHcyjj
z8nXnZ?iG2S=0h^gTkw=Z@OB=R^U$AdqI(XE@7%S!F@EcTshxXvjf`!gqv!PuS>2JN
z2e#haxN&6Pz5~NkQ)4h^=Z-0j;>jz9I?IIp9E7bK%thE_r7{%O9>NI@Ddz^Pswm<8
zp;?}mu*@{4MTv?2hd3-r(f}5QVKmxuY`EbeADZ(V+M%+Yh@sBg5^;DEE9Mj4gy?Cz
zpzUNfN<s?nO^mXsG<eL4=DB1*X>f4)FK(4_K||Ph$aZKtY2&Ve%xNnssm$TH(kzXV
z5?*lHI@ccyCjaduJd09t7o16A`0C}PU72X-g{2T0k5Km-o*HR1;M-;nzY*bFwM$7o
zVoBS!JYiU&?r_cmgS)l}eMi`iVYxy#O~-+sFI>i%2^lzbNBYwCrEdm2G#GvhLoBE6
zO6Ga4kb&g|x~>OdAOkyupEUv&>K>P-DO}UE1L;V?JsBE?4?l<qi@{GNbsd9r{t;PN
z_~STy?%(*@;91fXeI$Qp-DO8U=-a(~?Ill7JbeFC!O_FZp4imBcGdkiRo-}G`@n`r
z`nHQNmK{4x8v8e-$FDoggSR$5wyyE$J?oF1{r$|EJC5#{IrZ%4SKapWiPz_ENDh7L
ht<ok3&DAT6Ykpld{!07Q%kQt*wz9T;;^a$f{{m)7J}v+N

literal 0
HcmV?d00001

diff --git a/e2e-docker/fixtures/v1/providers/hashicorp/aws/download/pkg.zip b/e2e-docker/fixtures/v1/providers/hashicorp/aws/download/pkg.zip
new file mode 100644
index 0000000000000000000000000000000000000000..1834c3004ff26f183afffb4a8149e1576927970d
GIT binary patch
literal 6144
zcmV+b82{&(?V;$4;lZ8O5_7U^VgG;Ao_fA4V=6yNm!JruB}l30L?P8T9voEUb-T<9
zg>Aot?vD?Aiaopq&l%u3&4(zZobxH7kA@x^u4_I(vKZ`G8pCK=K3sH|!AKe~S_Js*
z_gf=JZU4p3!_&<HZ3zTviM^r8r>R3KbD50*1rIOsBT4c$nB=ZD)q(6eP`q>Xtelx5
z=7+slLSVyUWyEyjpic$ZM-yAnBwrQR4n>MeGY1z?6^%mE7ZeT!?80m*U}pzHkWU9f
znby@wbG`g@2L^LR=?gNdYU=C;5Tq~%f0Y?9L&`@Bt<%z>aU}47_^^1*$0;)`IjaBa
zU~~k#8D#LF`4_RMO4_<I0+gk|FZ^JK{YA6#tDUiO%w>$k<LOgA3v8JP-^y3_0Y~p4
zE*oPHNe54jlCI~IO1oFTPn^-g&Z`UO?q#7>wEEb~cjJ-DiT(E0TySXPx$VEvn0U<8
z22^UWBEzG}$fl}&-U%5V`@*kvEDmfJ>tcI&Sn4>H<A+Hhy!4Nk3Qk3b73;<qj@f|+
zVH@*#;tV`_vM84<OhL9})2x?Q6>0DeggB%Av&RrA*Ze>d7DLO>M#YYWCNPEk;B!)G
zAyhL_t4NesKXA{aHUs`vZWLSM?Bs)tu@0RU(R;ZaNp)K3PUIB<cvNVwoYvW}a6q0%
z_?5Md4+klvb!MG+mC6kWDZM{7wN>jguGG67RUJd{3BJ9SzTUhDDwm&jV^@x`A?G>T
zzOR&C$@2p;3mSM6&gCfAy|p#&5Bbx3JWKen7e{Ddm)D#cO?To-ONTEFNqw%f=#;Q^
zXk|}L9#a+_UzruZpc0(_d_$kG`C#de<nFVjp3HO?m+@c~lCw3xbsqMhYny#JX!RW&
zt<!%e+Y&^q21AK(CKCixJ6yx}#6=sw5c$In?V$denL6e_Lh#ci$s-9)dA^2BaDAC}
zCB-D)g(!`~OYyBP4q}cpK}B}j{@X$W8cFO-DyI*Kwt@nJZeui7Yq|1tcS^Ff6IP6{
z5(2cft)OX$Sy^B0Ud0u$^tp>Fd|r}WS{q%N5MDy|CS-;aj4F6nhPDwvK1Nh(*OCc@
zKb3f7R?+S4@1VD#0-$+(gr?e!@8;qx1h;SY@9+lhbAmCX`Rb(_3>{z4?ve*sN&8uX
zEJtx)iNp?ky>63Dt?s^c5=2kjDUzdXXh5Oyw+c?L;eFMzD(v%J8>_`@r`RKxseY3+
zeNWS6;pwZA!+Fg$8YgxD_xWr;dXpr@dnC*5JN1ZY`&>er7;d#A2ZR8>bc{K*DaOV>
z;1<ziLQ)QjiHK`=nG}Arg$QdGBd17#kNS;4za%8I&G`m0EbCMTfRKme=qPq2QWd04
z2my$jQCvGz!>+=|MEeSnM#Kt+inxwVBl!Zb4j?_E|8jhWkn;15ODd0ErPV?8=+6bH
zHH`YReeTj!xZn4xo_EpG6~~`0D32u$eH^8lZ%$U&7)I|xgT2z@-Yk_hhV0J*EzkV0
zfm5OCww0b9{}rYco!xlk%T}*Py=lfrXfuh*6Bs3q%x3E1y#x9_#KDR)VF|rt5dA1U
zuZ1~Qxfd!3S0I!l4k%4g{DaVo1GbjUIqcRv>NQtleZBWPQ`{zM*-((+L!(2wMWqMo
z5jItQeKAOBZHZ}3=Xk`P`gDMZ?>CZ}K@7EtH56jky?$|Api|dK6WP}a%cIa!eZs`V
zC8A<h*BzSbOTk>FGYH?ZUBCUF{#>u#2%GtP!|SM81AAVa+#`~9DG^xZvNj~94_Ac#
zhQi6tXd(*~Tl|O#H+9ArC+6zJ5Go}C<HExm-X!t@7(pP^_myCp)@psiXF3n6_vx3y
z0E#seH@cx^5#gemiVt65Ct)iS=Q_yU3xVL1SmPzLh%?<3!jBSQ>=>^s{E#|F+gLa;
zAm}4T1Sm;7wI9~<;MFXnxN;;8V+y;E0@N&_$q6lF%oZb7su2WYVIyx--_D%(@phwz
z`DMXujqc?;%*cKII4`9-4D!}EnzV$RBS*Bc<Ik{%d6ZAMQ3nStmwAoD$<9Ot^zQ(w
z*+)HxtaEoU_t|+ats?x=flH5CcJ8%te$)orv|~&vUVfIvNc!;Bx;M;UGoShx&D)oj
zJXx#l<ayfyE(;ndk$n?8E>`XXxz-X%fDeKzh8nns*h*kAvT@3B?xgt*pCQ$1$ULJ&
z9v6?ghFTE%gO{)z%Pp}oo5^Aw2BwbV;?o+&^<(?BUH=&I?L6ai;R^jbtnWz4_Jn?|
zjEq`kKyG1(+1soND~FcJV@<6hW81e6vRN);Z)%`bKt+W{_sjeCzO4UrVMf)8lfz=a
zQ`MpUd$R$2aB-b>xTKEK$`m*dJ#WM5Yp7*r?tUx64h+_h46)c;^mZP{Q3imDE)QQz
zfTUag%$h{@P}I&twu)$o6Sy^qZ=JIH1i1lRYCD)Fevy`72E$j1$ONUb`kb-k#c+m<
z(=7>$z`0#ob7u5$eyF$l^i(w<gGMVNCnstZRjw?ylpqkh@ys4qw;tev0^~7xS}W8%
zP5SHUyj)o*=;$Ojxttf9BOp;G9v6_<@w1y?a$cgxUqQ_X<IQd!DU&1TD_=5El1f^;
zmJu`OHsynD@%bXLkP7eB|2LVs-ODLIdYQO<<=N(9NCPa5>jIK+1=(b28s3T0=w(<)
z&+I>zY8&zPK8FH#q#darD$tZp4SIiCGnUFjrQi|Ea28<))pa|tkez_G$*z-Z2eU6A
z=w8D-bnLtqE<<8TCmL+gP{Q1-zlpggVUvD2k*tX?Q`ZeukGa<hrGM_rib!t>Wk{fx
znDLzTXjQCV;F4@6pE?=k#U>I;8_-Ew(6hc_%fxCv@?Q(Ho|y-@6E9i7@8uMrL`G4m
zkDqAOUs$maCF)lRFz*(<N+VQqQ`1uQ(p;}w>!=sKgFT6qz^VRl{*<!HBtdY?&d$=A
zl({^7itr^Re-J87tz&bT#bx{charfFW1;ww@?VaCq5rzte(@al(pxF>yyWDHbI)*w
zk4HS!zA)Mt_Ndtx0>)zO(4W8#dI8*D?Tr2ni~)Wc(tY<YfG+&bTNsCQwrTV2N?r_q
z?C=}Tj#<_#2rgUZe#(!(@Bt-qF1YkdD96i~>5;Wr5WMnW1`mE=cV%?#OeDB?>*;=}
zTTy)ZZ2dJh%G*tvJ5&7d^}A9f%lt?l5VFI;qef-pqQCeaRkf3!261!9cEtL5|LLeP
zsbk-VwS0&)<b)?_(rK-WRRe0n$o&`WsAXZP)9tILrSi}ynN(Zj6X)n*9+mRGEAj-|
z3WDS95^6@F*ptA&j08QznGjKo7?Z0-TcBQlGj#@|zU1bpN8QQIeg7R;*5u**0X*)T
z#oQ{@CM=~}H=?4BJJvkBNULWUh&r?888=&%s&}jkZfB;ny1hvT(N}bsw&@1GC$v32
z;JrH0`F;GzU`uOdf%SN{u=B*b6r2MBkFV&FCQ)0!f$p9??D{~NKw_*koYdNb(InkY
z<!9=W*AwvQ*N?}=wUK^aiLM);haC8P4`r}1(aoX3nqHG{axxF|==-&1ynvA;{c>`W
zJmiqq|I04ESBFIaOo6~*3P7l12%bk*8yp5pai<=TXv-DBLGs1X&hy9mCMDqcxT+Q@
zT|q;z<#Fy`X%IDFjW_76lDn=j=pnUA2=UmGbxo?&6cm9c?g?M!pt(UK#k9Yvj7vnq
ze33U@$9Vf21p5A-v#_8u+3&S#kOm>1%cMOqwjelB=~+MGlv`|%{J7wFu2_%x+mnpL
z1_+5apbH?YU<+$K&;&s6K<j<LXu@ZVG+s4;sJ)+vNhQTfD(=U0%NJf<(*^<`-Q86(
z?5fc-zIAZbQ<6Q8kgQ7=9j)D%;X53*{)ex<INhX;S0dJEnaOsi@%QrbD|K^eHtIK{
zr^pkXJI7qDiY*x5JmIi4rHdzN&ldkTQ*Eah^=e$++jg9!VNr;bNU~v3AKvso!!A<a
zrPR`Jm`uuguGa(xA<Sw{@^a2;2jAwuN=i{(3Gf76>pB80#+jf7MgohnybMA9sl_6$
zQ~}E1!&+qZh;xLk2duim0qT=3MYx37D78vVl-{lY!maadd6>qoDuqLdg4PSKb48bp
zNPcLJ5vnr{iDr?sd7p9?7yJ9c!Z+hx{2eOu<O{$U=4_u_H)^;$1^GOh^g5ozSuAs|
z4y4sGx#ha-F--TA`Aj?HUr$OM+CKC!=Mp|Gia7*%AqEGo-4r)uVz`ZnV-{OV<kj%x
zRv~MmyRm%<21p~?AnU-DB}n$K&%oIPsY%@JY-;6mt?}<xtvU>dzTz$A3^u`<K>QgJ
zTYjvTy<bXvmh;$8ih8*yKx}(Al|`j7dxoBFiRN~<$Te^A&MxZtTl9$MAlfNiewcYO
zdfBgWvLSPeu{B>_&<NiDFzxf9FkyCf;@Y?%r2ZPcQ01sjYS4&_UIz|)3EGmzd}t^*
zrvu<Bk0Q*GK0`@1A8|4sa4&r+)W(Le6r0`X&V%{0<vV{k5@Rv0ZI8eoCq*{cDs*2X
zbow}HUsDHKqFK6hq4O%yznqu|V%%@@+O_1bn{la7Q7Z{6R{Vzy-op(S0oAw=PZPO9
zuv3FFa*G6SK;0tJO!u0nmaeb$`*ipWZQsvYQF|B&i*(zI#DDY3UZ-`Ig&`-vvdV(x
zJ2q*VFftgcb<~3?b?e{K?uFNwk(!v8<_Gi3-g~a(Q4ab2pwt~|(X?X0`~AWj!E3}a
zA|75gljYHNwPYf|m|jNRrFXC3F5I6&c(dK|2WMub_`{}A^qf&Qry`~BNV9P@Oysg`
zx1Nf6MbsOJjw!zdzRlYV`$}U_ie<BAq540f=TS2|hP5LR=Isl79^2OS>#v$T$B8b)
z^Q(a^G%W~5BZ%;|xs2j~f6a`0@Y$$pK1403U0OP`-2nc>R*;laz6E*O7;gK{-dAV?
zE*n;hwB?$3Tk4q&EuMccQ@b&9$Sy$=;yX;IQYsEq?51)!nE-5RUfkE13()y-y@bsZ
z)g`d>()u#T3Eaz%fT715)b`_5dDcLp@x_XbopKi3)e_n|9>>0t-56gJDatlFCE&g1
z2W^wvUa|6)>9kpV2`~<by5^HWbrl`f5_*@SUnU4KF@5YIB1IR#YBek#HX~p3H}69W
z$#bKP_&#!)LDc(0D3W^qTtl~;8qmcHF20ERj*8IV!!S_^O-J%Pzdlk=O2w-|5R1Eo
z!!S9-TwHwq@xj*G5D7^^E+UfDz!_{Ig`9?rODbWt%+BfC9h;-aPR%igDA!GruE^=L
zE0gF)2wIiYmL{=(K&1HTYZ4#Fz{MY9r6lFOaDG;L440cDlhQ^rpq!jz{cP3Ng{P3J
zQ18!am&0(%tcT)aFA(X-!MMU{T2`TlTL`X6>s;jdt>jsi!mlwJbF})&7>Nig|JJdj
zRAv*V%|N)y6scs~)mJeG>XiFrS7W0=du!G}ok-msGoO?wy!*_!ZDF14oAB$a`&=%D
zTPJAq@N!J&-mqM3YRWr;q%)n6C=#x`v9SgOmKFi*ftlLa(?kzW(o6-!W<_P(*NJ~U
zF(hR|H%VizW_jBtK{L>iJFTSNd1(w=0T81)0}>oA8w5i?iPkaG^SDw=-%;2rkffyV
z9;5FU@*2UpoEO3^^g9yk)JL28IiMKdp4Gjn!+XHuK^^55F+*@>%6hr1E{*vz=dTS$
zz0OeGNsiZk*5HC-52-p2)(Z$Ce?fYi6SFIhRLD?LQ*&@zG5TQkv4#In6RKl=*6;2q
zC+=-D!3lx`B%gX$T`r?a>;u)zAvXIAtl)stkEHYJoi*pp^eqB4X8$?n00<Kp@MA2r
z>075&)Sdu6=smr_B5H=+Foq8KKxrWEdjy&BqT0vmK5{WKA$7Y(eyv5A;IGA{Ghpb)
z1l_L@g6D5DtL-~!6%A;5gv`3g^t_F-V)9lI?p3lr!=0{P|65-BhLE8-4-Fb*C7|m|
zeBSzkno6V~HPZA>Nd9-#E=!#ASN=a2G~E$B45z0?H$&Zb%NpEcx2^@`$<(Qb{IUr4
z2m=ti8^t6pMT{XR2s5bReNs}7<F}loMH)3E|9n8+HSr_~cx&_Ib2{+p@uh(N`Slsn
z%wlh~H34iuieGXS?Zqr?-y!q6Qex&JDPk}{xU~1|MSH0SXAgw5+&+Wo*e(PUd-8Ej
z&X3oiN_pPX^O{e=z9hiAs9W}M+o1}S&tchTNmXdoh04GOBov(Z>Q1egvD>4e5W9Df
zYWI*hEO6BDaBbpD4K_eSsUD-Q&<08~&?>0rVMJS~jqv~6Kj?}&#3j62lLv?7fR@W|
z=8XJdSRbjy=iLVc%;ef;-i@Y(bM>Rx1;V#~RrQH?;F)3zHmARl)OFNbaT!_vD*HT)
zOA|$)5(1tbpd{X?T@!g*3Bd+S5m(0E!&Q!8ZB*70UkIUO`MW(Fe5U<YB+wK2Jvj69
zO?QsdLm-3C!OdJfDhiJ<_U~2XyN}p7Yfcb@eB17|OA|2Bdy+Po@HzgpN*;-KuEf0A
zz`s54!&_grV?ooY0xPIXjqib78K1cQ1a)Y30!k<+YNXSe&2*b>-*sx(M&h8qXhQzU
z3Jk{@r&|zoL65+|9}5CiH=4=Z_b&d)xd>Ve{JBQ0gr-Lv)x7VOj^8zYUm6qRm3fqp
zKH3ru3Md;-j}mYVY}b!o_&5w)kR?_`FyArQUosozQ=0xG1SiAZ7XR8p8Qm#6T*+^;
zYs+JN=fUm!846xQf=&&m<3J6|OB>lttX!}sxsdga3h!?`T6qtGFA8B~KD}e)R0<o%
zs46R%a4{3!Z)G#ZH`0()2MhRsEO&7cTlTs)lAD$nYpS9!Pb#_yJbwi?oL!W;z#z)(
z(G$y%f=)8<8AjS2Nfn^au3-`K`+w_?8crBmO!#9@E}}D#M~ymYd&s2CuAj`dtpiCB
z2Yoh)M#BTYlbo}C{};^B1WyMf4&;3Y&FnUeZ((L-FiQSArII-xs;W%gDcK1eG}$jK
zBovB!YP8|67J4PjREpyoUT#|GCKn_#J!7s~#?8EepG}>{J26n%1x|z<T#`ep4ZohM
z-9Kafl#i)x*7=UkJ{{A^5%Wa0y;hFnc+7|5tYCqG3mprYK6TlEv4xFA>yF?<Q+pO}
za=Z!sv_9MqMMtrZkGk5SfU`sLSY56t@QOT`97W@TJ;|>F?Q+~lsTX)srBk_Ti-YFL
zMcW9YBQrrDJQXWveG+^MH;c;OinN2D#cet#%c_YSRMcCNs1n6S*cR5kg-lo11A?&u
z+?D(YKk9ek3ywoP^=4Ulen8`%Dng^4G9LIQ)V|CQ5Ye+X$-RnCM1$Rg54tP7&VM2_
zca)9}y*%*{iV@#-d=T^6k<d7XoYXF>y^Ho>??kOZz@y^Ndu&J4t;)(m%pqNt^9XhM
z)soG8CfcK{LpnF5=gm@aCOC8zfh|jUr#AVaswDf9!-$43Y<13?((7SLl`P@g7)s0T
z1_g6qIG@^>K-g9UF9sDK(W_}+QPM)nF1Ty(B($+4p*cw5!W{$17$J5l{vv+-9T!b+
z<(MU3;yK$~*lO7Pz^!R?rua;=EL^xJMjMB}#})dbekbz~hb*xj*kOp`GoGfI+Bzq4
z8{^vVd5`iX2AvPpZ1cJxaHG6f9;!AlcT@!UXEHt115}MNq1%=DZ<EAE3=&u7|I|~7
z`jRu!{;^I{3Xx|MWO&jlNj3wF#kxSl7VUJ8`x*nynT*^Bqez7Nzl(rF*n^v4?j7dO
zH4x34eZ6jwTIiPKm69Agg3M*<TCKHOU*{G9Qx~rjAye{vVht?rNQb_<p#}weHJNl)
zwsZVJ$CKkyy5VO*t=&V*Xbgo1TZ}TulR!w5h<DkfOVb?&<J9p%BL5UXx9;rMF$e3q
zU-yqk({eU_3Hz<rn69+j<UhU(s_uG_f`u*5R*EjynR#L4Z<q;YuxIkz1Q;z7Jouc(
zu-}8R`--MpFjf@0c!!AGB{^mfpdM^n1fRPpwU#fE0+U6op<unRy}BJ?YVQ-hz$MH1
z_^<tYHNzd^K@?&MhNqAe7s-$b&C~ZY5$^)>)Qp-Om4frU0jU>%xQlnTBfwOIlHLzs
SW8{-ZWYbB~@K?={ACD6f_Xhs}

literal 0
HcmV?d00001

diff --git a/e2e-docker/fixtures/v2/library/testimg/blobs/blobdata b/e2e-docker/fixtures/v2/library/testimg/blobs/blobdata
new file mode 100644
index 0000000000000000000000000000000000000000..ed84624e30c344a6d62dd655c8c6ca81ae65377f
GIT binary patch
literal 7168
zcmV+b9RK5TdSUDPL_@9c(9{-#qYn-KmGQ|q90`9=YK>jVUzPR_4DYx+fM8o6x2J1t
z*_bY!%M8>0PNaf~>`$K668jwY3QX&w_g5>7n1UkbsKpv`!)Qnyx9bVM_%R0#rz(WU
zCI0aZj(lG)J~pfdJu5@2uP)Fvy@s1g6W!7&tHbkWi)-hm>Oc|S*S#7isi3)+HbYsH
zaJJLJ#ji+ROw5d8$er9ZiP3JElW{FD4S&agJoXkkV4^C8P=ONuTU^)Ist%_S%4aqH
z5Sv&%=$)X~$Me~MBFg63lX%|y*%q~Rlp8;a%4{*?VA3=nZ19t6g<A6X(H|gn5_f`u
zZs%@7{=?%fUjz!;5Ls{sFff~i<wVQ$Yp7*xtbI3NCKZF|?a#4jmZwHH1SWTiOZJ=;
z(|@ZS2hpOJj#f%l)-}y7L;yF?XT1Cac{dty4{lBP*mq9v8hDj8&YF&me6#EZln=F1
z=6_|+FPlLzOWCajKuzeAx@F9}vnvB%0PG!fGzcnz+Y^$|#jQJ5-2l{%=LbeX<3Yly
z4lY3%Fuu^$dzdYt7I~;tHt|FdFKDU@^<X8c@6|{wcTPBfYxUA}yFQOa9pJpV!6f(u
zVo`AC(dp9|U&^AR=*3qrri7TMy{4Xd<J|RF)<b%Mg}a^&6H#E9a*(Hyzc$~BI#!O~
z&?&UWvFrqwyZ+mE3Qvg|y`gw@VbzFElX7}QjN#ag5NaK#X2F`|2nwF5&k`C&kb8?)
z#;f|fY7;RvvU~OIQ&0-y#s5Of1RCq@V`Qfh`GIc<cap$vLzT-u-u-u2nt4Wc{PXQ3
z|0}`iV*qyKoYDntKj$%TiB-n3nw1&f1C{!mFG^Nq{-9)L_%DH|XAj3lnB|w`P&;$6
zDE=IW6j4-qF8dPJ$|Aoiv!C)3w+o;T7U$mOaY__hh)PSm_BwycsH^u#qT(PW>_045
z$jOm}wJeQh5r3DA6Luv!DEZdnn{zN$5<@~mm>`+E5FQ|b-9^j#Q?#xR8Hq5i#X3RV
zOE(5vJkhqtIx%5j?inC<0ll<4CU-ii@SQu54a_d}aHgXkx^qU#eUKIDmf&=G2VWy!
z`P3I;>EB2k;HIPIPyJUe*}Wh8V$Bz4i2x*yjhPfT^t_2@vtUX*#4^zto(ucAgzWRa
zQuVTOaV-+p)=(Xom>%^Fe_nmTVYJFG>fPe=knW{#=MHY|fX;T23=n7x$<N+>ssD`r
zU0rqUQ_7`7;y|;noe6bg(1w9b0C(Vao-v0I{FrlMJ5+MI(9~6ncSovMex=>Lz-U+b
z*qF0Cm^R_djyjhvBMWLM-ob%CZgZcwZ<eL~yI<KV)|o>D*PK#J_!3SOOny`smZbpQ
zM=I`7xk^Dysx~pCWk>9A-_RX|#WNLv0OZyiw=RSs#xCP0BNYwL%YV_(2w@SmtSN#a
zcW238vD;R{6!f%nViRoa9KCYoGjZIDoxJ+bt|w`O7?KF2r)6O(Z5Oj`G7x0r=b;;;
zsO70;D2D_QkGjcwJHc#xBG23!5d;we(<>#b?W8}tcT*A>WV2|MvCU)NLc_&>L}E@&
z_u^(m0bp8Qy1KOmHjT__A8>yDv$0`VugBmw_8ofE3Wh7W)bTnNP-g*_kZ9iyJY;NV
zE=%ffDmcYDEcGwS5}{_P&YuQ6i{KHPq=bDsjO%v`gnB!9uO6bbW)Xc%HrRuo-snF&
zY_0r?PGDSjVUVv$-c90@!-O(4B`b~;A^o$@({g?FKKEmH&1U;lKW)8UJ?}+7an^*N
z{w?7KG=dJt8E{7M;u1k~n4>(JdKs@I!`5dLsL?R4Nzmu-FSAnia=+}<*>y|6?(Y+c
zfC(N2R}y#c<$B0x5GfjNQv$$>Wpn)qvIUT8>Mm=mc>(3!jq1J{7k1{DY(qtg`<U4<
zDc4z8o5mndb)e$I82=oD7?H-y$nTJXpp7xh;t;T}Y@A2H-Nn>m)MNIO6=URb|7k8G
zvrKy4%Yi8<`;mZGaK1@85Csjbx-rPf%_$Ei-b`T>^^XYha$w5C63C~J0#LADOnp20
zfD`jN*f%fu!_>LSkW<F8ZB|au*ag~2X;h8~SV^LB%%4?wYKof5D(?D7wutsRU=12@
zIL&<%9}!kUMPw^uZf!Ee=QzT)eB=4=+o9}tBSm-$1T1g%1?LWQ&g5y89E|eULz&)r
zZJjK5Ef3{ig#Zl179OVE-q-eTeOlrNjWay(ExMl5q0jXK{^}BYX{AmxRU5(d8<H=F
zia3+5)lwAS<@P1I@E_~nqNM=2L*%d7Ti1)LI(f5yf2Pr2txQsg)W33h`%cyWhRgjN
zO|My$g4~R~?zEB{`!Vyczr{cB7l(!9GsH-4c1UW^c8CI7C#pyK@wNejaUC_#RMteB
z*Z8*PdL-nTVx}33sU`<Oim;t^Q?8@(55NJ;8dK(D?ltYO=RRhwo1OG6F>FVhi>VJ1
z56myK_cPXcZ1vD+6FycvXS><|ZDYu$wjxJiHT6F3YGoI!PSO`~)!Web{v|o}Td+kH
zJY=s>%<)56_eZ^>iekF2R80DKnh<Gg>C0Eym8(Ni;^bF1I`LX?I)}Nhnd7e2>-zvV
zd&akCMjMX!m@#y1Me<qA&Gx45&>h2zr9b99MbAF%u&vIM^yLERxT0moz+e+ZaJ^>w
z*?ISU?g$ZvPYU!41v%X^!qq5dyp(bOE&&hre9hf>@_qwEQADUc@9Uvt0lXkmhW|Vf
zWD$}p!WX{{7XV&g+YXdy4MyRhADQ=fBK0}oefQ2EEz=J*LmO74lz6#}iH1SofHGfY
zCW);xAn^hNUe&0AzhFVwI>g+xsbe>CDC1jD=kXgf8H-$JbA7z9C|q-ly<AV{Uui?5
zJqYh#%&je{M&nQx(^E=MRTjxJL(K$zZ7x`=s02Px0Ww)HkV|9ySVqr{c`&WOXOdN~
z{5Fl<`niu3uiM$03<g!}tJ&0|b}FySK$zSo0G|@!@4!8&Dem82TFI0(stcyv`8DCb
zR8LavcxDz*p$(03o)rcdWN0(dF-}i%XhDC2;M}(h_%2r-e7h_Ew|!AgOymydOUmdi
z@g;ZO`G~|XiR89CJX~7#nmty%O7O1DPmZX&12?fKFUW?`E%?`3;`x}cEa@0*bw4f^
z(l*kgb?i9qpOJyIrtsc~5k)_X1+UD_qX2vwZ{N4(b~R;b-Z3;Yu80er?t&w#ZRnHD
zHlU;k<144Kmtyeq*s)yCP0AuzQ@wqBzHdMiTKq<dG~>mZ;BwwsWIxzrB<-_W>^0Q>
z=#BU4+7Nw_tTP7Ty+GbN4+K?tfP;Lid5`wx*c9?S`l1IhXrW7FZ<R%)RrW}Sx^K{#
zj$EPnJ{8kz{y`UN{jCroi$&PoRH-t5=h|K^<(T&dyu}5X=ZGL-^>$5?TapxSv~ZUT
z{9yCXgfrx>!a7_CMgMe6dArtW7X*_nbi?T~eH|K!w7ukk?DKF|+rx?P9aW<T94aHK
zQE>GuXGAi>baPhX%?ADGYrZnoVBrcQ54FtzjJoNjY7B)D#Pvx{&4|&qFS9QEF(Qfe
zv>9gCS~@)B_^#Br*o^m<H+lbVM<I=}NGXF?mmckJfW0l(c{B>+Ye99i%#1vpi1HHe
zhIZg&cjEwaPNEb(!SN4|R5Yn0pP<KjapOlh*CivIVwB|Xj^c^VvU$F&^v?<f+{Fv)
z5U9@aITQRMl=a*q@V}54L-}qSo#kKZC6RLgc*1fkJ)OyOE?gYO)>5jK#p3ePGi@3d
zH+|Mmhi>Uoz5NfaJgWrVUy%!5&7L(4u80K1@MG%{;Pr8RRezjinNKzKuQ2_7+;||~
z5FAG=KHKZvG1!(aGjWRS6ss&6<P2(j%bR&{VDDg&<*gSYj}_w*LauEf#ar;ZJ5Mwg
zFR;0qI)<%^i8pDFnV@EP<g}CFzc<hfY5#&Kb-U8!&F6q&n}try<=t~3O^{Z}q~#bK
zol&hjzMhSF7r}YGoH7=vA&^gD1>K~q4c&}g7rPH?-vfNV!iX}TVfn>O{4r+j96`V8
zviI1&mWvdAxb%S|RO-oM=5~pcU38eB=<?b{-QWmWq|CSyLls&=g+lQ0R2$zjV68M-
z>ve0t5`GTW?_xHEhkvYJh{|-<Go!b>n2dLICFat##9<jYP=6;k$u0-Non?g+-pM3g
zJ(4OqAqmThl!$^}NtY0RmJ&3qJwzonq3X8+)I2$?{aE})#PZFa`xvWoE?6&^Gn6#-
zolqI=<NJTv5bUoQ!%U3UOVBlVRc(D5Bez$SLm^O4XH+Y<=xm>TB^no{KxN{f&Fg=+
z3on&E)(?$G;bV~(^a^cZm0(Z`Pp5yJS3K54g+C8;fs(g!q{$k?Zms9w?&ZJ_lLwOP
z836mYrEEYROwerbn76GTAdAK|XhDC2SEa1*v3xEN+r^OwAV)WUVsyG6{joF3J0+uV
znPfNi2(xNS6DRkYy1wlDsXCQ_oD6kknUX|)u~bQ;m~-@r6;!_aQ42=exE`Q5TSgnv
zjy~0<S33+~H=^TzvbcBv2JwwZ-&CtHKHTLXq8iBI%b7&QM{mBDG2vWkV^ionIMant
zyeRQRuB9(rkw|JyE8$$5dawTZK}cDnQXBe<>?(Zi{GbrM|4A@6RCYN&p1X>EcunsS
z3BJ9A9?A@09|Y7!>uFSEt-pe5Y9VrnKddH!<+7(cJN{J4r6`L0hHdtRlI+@NDWUyL
zs||I%gI*T-yXi-W8nS)?%fq~;8ElkrKdm>;kF^-)0u!A#TH4D8p5W9KQ37{xUj8aS
zZ=tXD){}mVvwBAVe%*ArvT=1*|JOPyxUR3j_*&2C@1+Q&Ul=U_uBG2`i=bD(djQ4o
zJ_3W-n_i%8Lyp_X{hi9SLS#0GQ=j1G{vl)Z#LFh2O`ohXMs{qHZ6L;y3LD#<IMh};
zxKgKI#u`mBK3%N_8c|vL&p|$ZrBiB7N*{}?-;%x{OMIr7hkJ|WNC^i#o^c=PW<;0T
z6({$8w&ohzwq<BRp-Ahl40o7jD2s6o_?1-U`_m==NL1L>m6z?>Viu5g&=-EP%oi|=
zPONJ*;KaMC43Z@0MDU-*0k5OIR-vNgdY77D7U`-mv<uK*NOD5($pnw?hq-zPG8=a8
z`bx<C{{cCP?yDbz5~Dq-<N9`is$)uT4+89A)_W%3J(<kH!S0~$6mQXfR@tC81mvkB
zx$22=Eqfa@yc;`Z_`whE(ixW&zy4W<{}r}0B=u>}Iye!np6!jZP6+r$32IkP$YXD~
zYdu<TY1$Hc-fp#ot)^dX)b{mTC~Zb!Ir+z{{V`@UUZG6<SAL6Dg<;+6v%`{yn{~{V
zZY*?W2~r7D5vPYLQ1^SKklb6GxLi@p?m0gFJF|N`y^^-G=Ws9#@9asHrSVSo8sdEw
zSlJ*Jxx1(`bdyVeQ_K0@Q0V_{hN&j$F?Sip0Ou#z@z+F4*`_)t&<Pt4-+#JpXq~7~
zrxX`j{e>kfvAleNU1fA_dE`nT&8INHWi{o0+~z|dC}aRh>)LZPqfc>w<BI&uyuQ5H
z)*lk<<<H`c$O?}#30Lzo&Wl_ikNnY|>$0w5%wD(TRc(M^CV9n}z3nCQS3-*2FJqpT
zx!T-vj`SC$q0%J5bEiUnx>CaV*gEAt46Lsd1h<9@m9Db8fj=F;&B7T=dr2>q!SrPh
zuHPrXjk|l*8JwcBV<kcFX22TFk<-A|^WIThrbj+H)ZJc^1)t!9^B4?jlK#efvaIJx
z8T2-8+<N%4!HHraL+WLkn@IGLEN$Z73Wf%1NVOt__*7n%q`@3Z*i$Dfjt?yTP|jzM
zMvgxV%zCI$H;V=Q<Or&%B#GWD+FvaIiHXezQSZ#(Effcj0VY&sQ)dbf_ci~GnIP7g
zsGc|6b7+ZzWVTSWzPUn!Y{6BwPP4MaaS<QIHG9rL)WygSCf?=m627rqL~_Gr8RAe6
z>_Qd$3*k2?cLD*zReg&lm*+o6m?h{5tm}t7bE+0_TO<x5n7S&Woc|9)<p-SA8Oqh*
zWZjcC`SH9)sS5QcDThd)%@C!@<n-WnGEAEs%&>Ks2~=ShXmx@PzWbx~$Mo7q@8X>j
z_#y2(;F2Qe0xJ15t=T0nrnsf?(aM|kLqxt03&!<7d<T%4oZ2mm(lGPlqqz-o^_(cr
zT=f5a>E+MA33mFT{Q*`KWiuN(FD-dq5ZGHz=FvS>{hvT-l`g{u=XHuq>vzvzIaHwA
zKWr@-SsONeMltw<23^HzDu97Noyl;(TyK!)3r^(c;)l@l0wM8C;N+kWcd89MaJ<Oe
z?0U5L5a31|O^Obh@IN&eeK@iB;S@kmU=fSlaaS=;pfIKCPRv*3D;gyl-ZiuZe5QOP
z%c`46rN?Q!KP?WSyQ+E1Qbq~)u7ny;1FMDhRdJ3hbhHP3Og}GDyV1p)khq(Qr+zJW
z%KY3h5xJX97aVZ)1@?2nFx6I^7wBPiy_b1`pI*}z#N&<1-6kqfM~EJ5IrkbMft#F8
zq_OG;i_+t&bd=i+x$UF0zt8G|UEhZZ|17<`jR_n~!v!1ETgOU+yJM=HiO*CPiX&&0
zrP;&ibM$RLUpf3NnIH@ecb)oeQbZ}QO)}aFPLKT!rPEKE7>g&F6T|FQT%}z3tjUk;
zDzS+{dX$#KNm=Gcm0NRPC`CQ6iCZb~<pLI1L9q{-E{pu5gv(c8r02zP<iZ>qylRbB
zg>(GF$uucq`or$-N_Fm3)3vhqu0DM1pDCp@ny)!11K>FlU=2uE5r)XBF4Lr)^FA{B
z^rE*YRC!^teWQN2*6;CtRNtQ2WOt}J*S}-(ui--2V&!c}x+MGvZJ}-!XYO<<0u1cc
z;V*jtJzfW^JWmA3Qk=@>DK>_P(npt9+PNKk)zpo1gy}I3cB2bOy|ew&mk`B+%>e^+
z(W+~sG#nX5EJmzusn}{a`RUHqj(|e~7v-wdXP%ng1qqf4dQ`qj!c=Cu?;ilkcn#Gd
z(i_EUTtr$b)-^VY%U3_hu<pbzRI>JOli0Z8b`=u%s}%n+)r#OT0$(wcW_pH`sRD@i
zq>&h*Webj^$pr)V8OQTeu7@8_LP7)b>QmTZ@dw6~&O@R6I*t&n{U6t)eQ=SVPVMr?
zAxnIDNUA{a(!H&8jA5hx<{Ux3kp2ZWHx_ANy21>lDZvHkqE;a{RSv^2DYwNmzCNyQ
zSVqDw@=Ihuzwf!hfeoLOpMc;MNKKL!Ju@*}?XW!8nR`+rWQ+*;qs>I>PObboL4FlF
zM(K?_n{741AHI&7cKQG_CD@RbqB&8e;gm2_sjMrhZLgAJ%Z3%bcZVd&6$EX#Z~{8G
ze)}SlKBPJoprJb=J<PFc-YCAFOz59}%%wUaY5ae>Y8}r&NoZ~<y6*{eyCLvCoZo8K
zE{cW>k%&ovcF#A)e|_%Rm4_Wv1C23cWSe&0Q*fisr<VcO^!IL4nu0fd7|T3SENj`d
zOQe_K+`(g2>t#aaCa=EZt&mpsb~^zuUcD{Moo9A3B?!Jw1TIXYOic&}(B;ZCW?Y5w
z2~_btnu)iE{(PfeSHCs(za`gtu~-&od7HW$6wFX66>T#66E03r&sMg5vDi^#;<P!P
z?sOyrZZgJ+)saf0fA@%sx4qv+|G||*oUKii&m{HI$WgNdytl{_RsSV<w7UyW;97FL
z;61DzFrxYCc4jiogN{n~7JpqLb{F=t$|tW768*drX6>OO>E^0`Y`xRG<6&PI*<jcp
z(IyR1z%#pb*Qk!Zq}u_$$D`x589Tntm?L|lMs?zw+3|Thf}muyz03uP*vA{5yrVgg
zuQ(TC)Ftx0JWr3zkx8v{fAXk9s8YFYv)wJ)X+%`}eV@n67bEuG@s|sl<Yf)k+7oxD
zOG``a8@qKC^F<=LJ@D^w^c&0d;4oIYd&)&3I72Amqe|4fQg53Ti$S|>1eW#jR&BZq
z*jaIM-Z9jAO2EcKn9k3W>&=U@HW^-OEuzmD*{jVy+jyc&D@y&JJugniOuP;S7IsZ9
zF~HBj#+MZa?tOjji^H9fCuoY{E=2tJB$@ah4RH=yfzYaJYx1`1^11+%*I;8{@`Tij
znsg%ZdQPtq&vXG)$LI`KIYu}_7W7d+tV1{l7qHSfRL&!D-p!ywaA*h-%=W3l;$R80
z``8y0YPS)3NxZ8MnOjjnSwg?ZgmH(&rX~OkvnGo|XFLDrkl-f+GtfNAtheHS&*ZzR
zK-+}s=%sfwhsO?;iO;LA02yG`4Uds`QI7B@IV1>1@?96I+rL5>!wscc&O)j}_IYlU
zY6Wb(7=cbPH5);%Lpzo7NjHJ4hPw$TfwI^*a-5mzR59IC;xPIsJ-{`Q9~TMn+kpZN
zTqB1&f-`s(yczNKws@kxf~%d=zJdN~knNg#KNz-p)i4=oeBL7?!V_5r9=8gk`Bwwz
z%F`X=b_JAuv)}}DP0;4w;*lmhj^1JVB^XIQ#$M5O`at04G_aFX%g;Uo2~=2t0>Tqy
z0=5RkheZ9r>z1`E$u;jT*hK60k6Ff8NUbWGCNJWth<GZ7ru8*)GE;77*udD+bk0Q#
zVWR4a9E~7jT$;)=nc6P`I9kx<m7Loi*Ch<`3)7_RIsp#-5#h)?ZacMuV+Mz4ZEsCQ
zX+B7+Ygx1|i3cdc2Bp0u*%sU6<6rGrpKsYAu@gom&t^OID}h+bK}L6DKLAU++97bi
z>69oy$}AxR5>q@5Hwa-y^lRiM8-eV!G1`~<kAaLUJr@0~X)pLp0C+N!&OzD&G$LNb
z3S+ry$gaz<1k^RoV3ZQJ&itAr^+57bo<FKF2|uY|hSPqUD2`noGA`ESEPn#FU_T7p
zr#<!Z$FC7x*T7ny&h4`P`~D9&BS?|LX14ethS~_Bwtk#1dmIkim06&gs!bG*p<#J`
z;b)jA8o8ZYC5e81(TqmARS;0zQGOjuraTiGVV;lO5HGNyMNT+@dS~l_sv#NjPsZ8-
zLFDx-aQnbzVgNVlCi&P>q8%=Q$1DoNgliT6e+8r-nXm!NoM}=aWQx?#vZ#93)X^BV
z%8d*XDbdg9Us_`MV|Ghk`z!s}`oMeb-}r}c?|E-Yk_gNdF)hsG_|X5k*v40%8~VIK
z?g%nRq9#C=r<s@JZo)%iZ!-csq55@ofy_E-p!F?0MBNZfO@%&}IsQdt{0y|H<ts&N
z5;mj&maSR+I(e$#rG^%wMWP&^A$a>oppmD-gq){0fjcW#rDP|rjfCdQnEhe&h&HT)
zH>s9PvDw1rwXPfzI6j~A&=B%zb5>%^=9x!zNq|ZlhyU(pb7Z4;l2*oj1@#E*Qc0C@
z)9h?K*8i4Cgjhc@y$A0IP+D{*n*?ZSiDQePOp3~f0-!c6NyI8)u>ZdLDy6XkWOZl}
zEfg6qouIMo43-9a-#Lw9&d~{<-D1roG-<X7i4Z<+7OgxZL@SIgXhY}1Tg@v0<xku*
C2M0v}

literal 0
HcmV?d00001

diff --git a/e2e-docker/helpers_test.go b/e2e-docker/helpers_test.go
new file mode 100644
index 0000000..c9bea92
--- /dev/null
+++ b/e2e-docker/helpers_test.go
@@ -0,0 +1,108 @@
+//go:build dockere2e
+
+// Package e2edocker holds the black-box end-to-end suite that runs against a
+// fully dockerised artifactapi stack (see scripts/docker-e2e.sh). Unlike the
+// in-process e2e suite, these tests only speak HTTP to the running container.
+package e2edocker
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func baseURL() string {
+	if v := os.Getenv("ARTIFACTAPI_URL"); v != "" {
+		return strings.TrimRight(v, "/")
+	}
+	return "http://localhost:8000"
+}
+
+// mockUpstream is the base URL the artifactapi *container* uses to reach the
+// static mock upstream. It is resolved on the compose network, not the host.
+func mockUpstream() string {
+	if v := os.Getenv("MOCK_UPSTREAM_INTERNAL"); v != "" {
+		return strings.TrimRight(v, "/")
+	}
+	return "http://mockupstream"
+}
+
+func api(path string) string { return baseURL() + path }
+
+func fixtureBytes(t *testing.T, rel string) []byte {
+	t.Helper()
+	b, err := os.ReadFile(filepath.Join("fixtures", rel))
+	if err != nil {
+		t.Fatalf("read fixture %s: %v", rel, err)
+	}
+	return b
+}
+
+func doRequest(t *testing.T, method, url string, body []byte, contentType string) (*http.Response, []byte) {
+	t.Helper()
+	var r io.Reader
+	if body != nil {
+		r = bytes.NewReader(body)
+	}
+	req, err := http.NewRequest(method, url, r)
+	if err != nil {
+		t.Fatalf("%s %s: %v", method, url, err)
+	}
+	if contentType != "" {
+		req.Header.Set("Content-Type", contentType)
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("%s %s: %v", method, url, err)
+	}
+	defer resp.Body.Close()
+	respBody, _ := io.ReadAll(resp.Body)
+	return resp, respBody
+}
+
+func createRepo(t *testing.T, jsonBody string) {
+	t.Helper()
+	resp, body := doRequest(t, http.MethodPost, api("/api/v2/remotes"), []byte(jsonBody), "application/json")
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("create repo: status %d: %s", resp.StatusCode, body)
+	}
+}
+
+func deleteRepo(t *testing.T, name string) {
+	t.Helper()
+	doRequest(t, http.MethodDelete, api("/api/v2/remotes/"+name), nil, "")
+}
+
+func createVirtual(t *testing.T, jsonBody string) {
+	t.Helper()
+	resp, body := doRequest(t, http.MethodPost, api("/api/v2/virtuals"), []byte(jsonBody), "application/json")
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("create virtual: status %d: %s", resp.StatusCode, body)
+	}
+}
+
+func deleteVirtual(t *testing.T, name string) {
+	t.Helper()
+	doRequest(t, http.MethodDelete, api("/api/v2/virtuals/"+name), nil, "")
+}
+
+// getEventually retries a GET until it returns 200 or the deadline passes. Used
+// for asynchronously-generated artifacts (e.g. rpm repodata after upload).
+func getEventually(t *testing.T, url string, timeout time.Duration) (*http.Response, []byte) {
+	t.Helper()
+	deadline := time.Now().Add(timeout)
+	var resp *http.Response
+	var body []byte
+	for {
+		resp, body = doRequest(t, http.MethodGet, url, nil, "")
+		if resp.StatusCode == http.StatusOK || time.Now().After(deadline) {
+			return resp, body
+		}
+		time.Sleep(250 * time.Millisecond)
+	}
+}
diff --git a/e2e-docker/local_test.go b/e2e-docker/local_test.go
new file mode 100644
index 0000000..013faad
--- /dev/null
+++ b/e2e-docker/local_test.go
@@ -0,0 +1,93 @@
+//go:build dockere2e
+
+package e2edocker
+
+import (
+	"bytes"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+)
+
+func uploadFile(t *testing.T, repo, filePath string, body []byte, contentType string) {
+	t.Helper()
+	url := api("/api/v2/remotes/" + repo + "/files/" + filePath)
+	resp, respBody := doRequest(t, http.MethodPut, url, body, contentType)
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("upload %s: status %d: %s", filePath, resp.StatusCode, respBody)
+	}
+}
+
+// TestLocalGenericUpload uploads a generic file and downloads it back.
+func TestLocalGenericUpload(t *testing.T) {
+	createRepo(t, `{"name":"local-generic","package_type":"generic","repo_type":"local"}`)
+	defer deleteRepo(t, "local-generic")
+
+	content := []byte("artifactapi local generic upload payload")
+	uploadFile(t, "local-generic", "data/hello.bin", content, "application/octet-stream")
+
+	resp, body := doRequest(t, http.MethodGet, api("/api/v1/local/local-generic/data/hello.bin"), nil, "")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("download: status %d: %s", resp.StatusCode, body)
+	}
+	if !bytes.Equal(body, content) {
+		t.Fatalf("downloaded content mismatch")
+	}
+}
+
+// TestLocalPyPIUpload uploads a wheel and validates the generated simple index.
+func TestLocalPyPIUpload(t *testing.T) {
+	createRepo(t, `{"name":"local-pypi","package_type":"pypi","repo_type":"local"}`)
+	defer deleteRepo(t, "local-pypi")
+
+	wheel := fixtureBytes(t, "packages/foo-1.0-py3-none-any.whl")
+	uploadFile(t, "local-pypi", "foo-1.0-py3-none-any.whl", wheel, "application/zip")
+
+	// Root index lists the package.
+	resp, body := doRequest(t, http.MethodGet, api("/api/v1/local/local-pypi/simple/"), nil, "")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("simple index: status %d: %s", resp.StatusCode, body)
+	}
+	if !strings.Contains(string(body), "foo") {
+		t.Fatalf("simple index missing package 'foo': %s", body)
+	}
+
+	// Per-package index lists the wheel file.
+	resp, body = doRequest(t, http.MethodGet, api("/api/v1/local/local-pypi/simple/foo/"), nil, "")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("package index: status %d: %s", resp.StatusCode, body)
+	}
+	if !strings.Contains(string(body), "foo-1.0-py3-none-any.whl") {
+		t.Fatalf("package index missing wheel: %s", body)
+	}
+
+	// The wheel downloads back byte-identical.
+	resp, body = doRequest(t, http.MethodGet, api("/api/v1/local/local-pypi/foo/foo-1.0-py3-none-any.whl"), nil, "")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("download wheel: status %d: %s", resp.StatusCode, body)
+	}
+	if !bytes.Equal(body, wheel) {
+		t.Fatalf("wheel content mismatch")
+	}
+}
+
+// TestLocalRPMRepodata uploads a real RPM and validates that repodata is
+// generated automatically (the special rpm-local feature).
+func TestLocalRPMRepodata(t *testing.T) {
+	createRepo(t, `{"name":"local-rpm","package_type":"rpm","repo_type":"local"}`)
+	defer deleteRepo(t, "local-rpm")
+
+	rpm := fixtureBytes(t, "rpmrepo/Packages/e2e-testpkg-1.0-1.noarch.rpm")
+	uploadFile(t, "local-rpm", "e2e-testpkg-1.0-1.noarch.rpm", rpm, "application/x-rpm")
+
+	// repodata is generated asynchronously after upload; poll for it.
+	resp, body := getEventually(t, api("/api/v1/local/local-rpm/repodata/repomd.xml"), 15*time.Second)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("repomd.xml: status %d: %s", resp.StatusCode, body)
+	}
+	s := string(body)
+	if !strings.Contains(s, "<repomd") || !strings.Contains(s, "primary") {
+		t.Fatalf("repomd.xml not a valid repodata document: %s", s)
+	}
+}
diff --git a/e2e-docker/repos_test.go b/e2e-docker/repos_test.go
new file mode 100644
index 0000000..9c057d5
--- /dev/null
+++ b/e2e-docker/repos_test.go
@@ -0,0 +1,134 @@
+//go:build dockere2e
+
+package e2edocker
+
+import (
+	"encoding/json"
+	"net/http"
+	"testing"
+)
+
+func TestHealth(t *testing.T) {
+	resp, body := doRequest(t, http.MethodGet, api("/health"), nil, "")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("health: status %d: %s", resp.StatusCode, body)
+	}
+}
+
+// TestRemoteLifecycle covers add/change/delete for a remote repository.
+func TestRemoteLifecycle(t *testing.T) {
+	createRepo(t, `{
+		"name": "crud-remote",
+		"package_type": "generic",
+		"repo_type": "remote",
+		"base_url": "https://example.com",
+		"mutable_ttl": 600,
+		"stale_on_error": true
+	}`)
+	defer deleteRepo(t, "crud-remote")
+
+	got := getRepo(t, "crud-remote")
+	if got["base_url"] != "https://example.com" || got["mutable_ttl"].(float64) != 600 {
+		t.Fatalf("unexpected created remote: %v", got)
+	}
+
+	// change
+	resp, body := doRequest(t, http.MethodPut, api("/api/v2/remotes/crud-remote"), []byte(`{
+		"package_type": "generic",
+		"base_url": "https://updated.example.com",
+		"mutable_ttl": 120,
+		"stale_on_error": true
+	}`), "application/json")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("update remote: status %d: %s", resp.StatusCode, body)
+	}
+	got = getRepo(t, "crud-remote")
+	if got["base_url"] != "https://updated.example.com" || got["mutable_ttl"].(float64) != 120 {
+		t.Fatalf("update not applied: %v", got)
+	}
+
+	// delete
+	resp, _ = doRequest(t, http.MethodDelete, api("/api/v2/remotes/crud-remote"), nil, "")
+	if resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("delete remote: status %d", resp.StatusCode)
+	}
+	resp, _ = doRequest(t, http.MethodGet, api("/api/v2/remotes/crud-remote"), nil, "")
+	if resp.StatusCode != http.StatusNotFound {
+		t.Fatalf("expected 404 after delete, got %d", resp.StatusCode)
+	}
+}
+
+// TestLocalLifecycle covers add/delete for a local repository.
+func TestLocalLifecycle(t *testing.T) {
+	createRepo(t, `{
+		"name": "crud-local",
+		"package_type": "generic",
+		"repo_type": "local"
+	}`)
+	defer deleteRepo(t, "crud-local")
+
+	got := getRepo(t, "crud-local")
+	if got["repo_type"] != "local" {
+		t.Fatalf("expected repo_type local, got %v", got["repo_type"])
+	}
+
+	resp, _ := doRequest(t, http.MethodDelete, api("/api/v2/remotes/crud-local"), nil, "")
+	if resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("delete local: status %d", resp.StatusCode)
+	}
+}
+
+// TestVirtualLifecycle covers add/change/delete for a virtual repository.
+func TestVirtualLifecycle(t *testing.T) {
+	createRepo(t, `{"name":"vmem-a","package_type":"helm","repo_type":"remote","base_url":"https://a.example.com","stale_on_error":true}`)
+	createRepo(t, `{"name":"vmem-b","package_type":"helm","repo_type":"remote","base_url":"https://b.example.com","stale_on_error":true}`)
+	defer deleteRepo(t, "vmem-a")
+	defer deleteRepo(t, "vmem-b")
+
+	createVirtual(t, `{
+		"name": "crud-virtual",
+		"package_type": "helm",
+		"members": ["vmem-a"]
+	}`)
+	defer deleteVirtual(t, "crud-virtual")
+
+	// change members
+	resp, body := doRequest(t, http.MethodPut, api("/api/v2/virtuals/crud-virtual"), []byte(`{
+		"package_type": "helm",
+		"members": ["vmem-a", "vmem-b"]
+	}`), "application/json")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("update virtual: status %d: %s", resp.StatusCode, body)
+	}
+
+	resp, body = doRequest(t, http.MethodGet, api("/api/v2/virtuals/crud-virtual"), nil, "")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("get virtual: status %d: %s", resp.StatusCode, body)
+	}
+	var v map[string]any
+	if err := json.Unmarshal(body, &v); err != nil {
+		t.Fatalf("decode virtual: %v", err)
+	}
+	members, _ := v["members"].([]any)
+	if len(members) != 2 {
+		t.Fatalf("expected 2 members after update, got %v", v["members"])
+	}
+
+	resp, _ = doRequest(t, http.MethodDelete, api("/api/v2/virtuals/crud-virtual"), nil, "")
+	if resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("delete virtual: status %d", resp.StatusCode)
+	}
+}
+
+func getRepo(t *testing.T, name string) map[string]any {
+	t.Helper()
+	resp, body := doRequest(t, http.MethodGet, api("/api/v2/remotes/"+name), nil, "")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("get remote %s: status %d: %s", name, resp.StatusCode, body)
+	}
+	var m map[string]any
+	if err := json.Unmarshal(body, &m); err != nil {
+		t.Fatalf("decode remote %s: %v", name, err)
+	}
+	return m
+}
diff --git a/e2e-docker/virtual_test.go b/e2e-docker/virtual_test.go
new file mode 100644
index 0000000..42796cc
--- /dev/null
+++ b/e2e-docker/virtual_test.go
@@ -0,0 +1,54 @@
+//go:build dockere2e
+
+package e2edocker
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+)
+
+// TestVirtualPyPIMerge uploads different packages to two pypi locals and
+// checks that a virtual over them serves a merged simple index.
+func TestVirtualPyPIMerge(t *testing.T) {
+	createRepo(t, `{"name":"pmerge-a","package_type":"pypi","repo_type":"local"}`)
+	createRepo(t, `{"name":"pmerge-b","package_type":"pypi","repo_type":"local"}`)
+	defer deleteRepo(t, "pmerge-a")
+	defer deleteRepo(t, "pmerge-b")
+
+	uploadFile(t, "pmerge-a", "foo-1.0-py3-none-any.whl", fixtureBytes(t, "packages/foo-1.0-py3-none-any.whl"), "application/zip")
+	uploadFile(t, "pmerge-b", "bar-2.0-py3-none-any.whl", []byte("bar wheel payload"), "application/zip")
+
+	createVirtual(t, `{"name":"pmerge-v","package_type":"pypi","members":["pmerge-a","pmerge-b"]}`)
+	defer deleteVirtual(t, "pmerge-v")
+
+	resp, body := doRequest(t, http.MethodGet, api("/api/v1/virtual/pmerge-v/simple/"), nil, "")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("virtual simple index: status %d: %s", resp.StatusCode, body)
+	}
+	s := string(body)
+	if !strings.Contains(s, "foo") || !strings.Contains(s, "bar") {
+		t.Fatalf("merged index missing a member package (want foo and bar): %s", s)
+	}
+}
+
+// TestVirtualHelmMerge points two helm remotes at mock index.yaml documents
+// with distinct charts and checks the virtual merges both into one index.
+func TestVirtualHelmMerge(t *testing.T) {
+	createRepo(t, `{"name":"hmerge-a","package_type":"helm","repo_type":"remote","base_url":"`+mockUpstream()+`/helm-a","stale_on_error":true}`)
+	createRepo(t, `{"name":"hmerge-b","package_type":"helm","repo_type":"remote","base_url":"`+mockUpstream()+`/helm-b","stale_on_error":true}`)
+	defer deleteRepo(t, "hmerge-a")
+	defer deleteRepo(t, "hmerge-b")
+
+	createVirtual(t, `{"name":"hmerge-v","package_type":"helm","members":["hmerge-a","hmerge-b"]}`)
+	defer deleteVirtual(t, "hmerge-v")
+
+	resp, body := doRequest(t, http.MethodGet, api("/api/v1/virtual/hmerge-v/index.yaml"), nil, "")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("virtual index.yaml: status %d: %s", resp.StatusCode, body)
+	}
+	s := string(body)
+	if !strings.Contains(s, "alpha") || !strings.Contains(s, "beta") {
+		t.Fatalf("merged helm index missing a member chart (want alpha and beta): %s", s)
+	}
+}
diff --git a/scripts/docker-e2e.sh b/scripts/docker-e2e.sh
new file mode 100755
index 0000000..80c4f15
--- /dev/null
+++ b/scripts/docker-e2e.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+# Build the artifactapi container, bring up the full stack (postgres, redis,
+# minio, artifactapi) plus a static mock upstream, and run the dockerised e2e
+# suite against the running product over HTTP. Tears everything down on exit.
+set -euo pipefail
+
+cd "$(dirname "$0")/.."
+
+# Publish artifactapi on 8001 to avoid colliding with a local instance on 8000.
+export ARTIFACTAPI_PORT="${ARTIFACTAPI_PORT:-8001}"
+COMPOSE=(docker compose -f docker-compose.yml -f docker-compose.e2e.yml)
+API_URL="${ARTIFACTAPI_URL:-http://localhost:${ARTIFACTAPI_PORT}}"
+
+cleanup() {
+  echo "==> tearing down stack"
+  "${COMPOSE[@]}" down -v --remove-orphans >/dev/null 2>&1 || true
+}
+trap cleanup EXIT
+
+echo "==> building and starting stack (postgres, redis, minio, mockupstream, artifactapi)"
+"${COMPOSE[@]}" up -d --build postgres redis minio mockupstream artifactapi
+
+echo "==> waiting for artifactapi health at ${API_URL}"
+for i in $(seq 1 60); do
+  if curl -fsS "${API_URL}/health" >/dev/null 2>&1; then
+    echo "    healthy after ${i}s"
+    break
+  fi
+  if [ "$i" -eq 60 ]; then
+    echo "!!! artifactapi did not become healthy in time; recent logs:"
+    "${COMPOSE[@]}" logs --tail=50 artifactapi
+    exit 1
+  fi
+  sleep 1
+done
+
+echo "==> running dockerised e2e suite"
+ARTIFACTAPI_URL="${API_URL}" \
+MOCK_UPSTREAM_INTERNAL="${MOCK_UPSTREAM_INTERNAL:-http://mockupstream}" \
+  go test -tags=dockere2e -count=1 -timeout=10m -v ./e2e-docker/...