unkin/artifactapi
3
0
Fork 0
Code Issues 5 Pull Requests 2 Actions Packages Projects Releases 1 Wiki Activity

fail closed on quarantine misconfig and first-seen errors
ci/woodpecker/pr/pre-commit Pipeline was successful
Details
ci/woodpecker/pr/test Pipeline was successful
Details
ci/woodpecker/pr/build Pipeline was successful
Details

Browse Source 
- backfill quarantine_days<=0 to 3 with migration 0006
- reject quarantine_enabled with quarantine_days<1 on create and update
- cap upstream Last-Modified at now
- answer 503 with Retry-After when the first-seen lookup fails
This commit is contained in:
Unkin Agent
2026-10-25 13:36:00 +11:00
parent 62c009b837
commit 7cd0edf7ff
9 changed files with 136 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/common/caching.md
+3 -1
View File
@@ -62,7 +62,9 @@ was published less than `quarantine_days` ago answers `403` and is not cached:
"published": "2026-10-24T09:00:00Z", "available": "2026-10-27T09:00:00Z"}
```
- The publish time is the upstream `Last-Modified` header, else the first time artifactapi was asked for the path.
- `quarantine_days` must be at least `1` when quarantine is enabled.
- The publish time is the upstream `Last-Modified` header (capped at now), else the first time artifactapi was asked for the path.
- If that first-seen lookup fails, the path answers `503` with `Retry-After` instead.
- Mutable paths (indexes, metadata) are never quarantined.
- Paths already cached keep serving, including ones cached before quarantine was enabled.
- A virtual redirects to the member that owns the path, so its `403` reaches the client. A goproxy virtual probing for an unlisted version skips a quarantining member and only redirects to it when no other member serves the version.