Add goproxy local repositories for private Go modules

Remote and virtual configuration writes are unauthenticated, so anything that can reach the API can repoint or delete repos. Vault identity OIDC tokens give callers a verifiable identity.

- add `ARTIFACTAPI_OIDC_ISSUER`/`ARTIFACTAPI_OIDC_AUDIENCE`; unset issuer keeps auth off
- require a JWKS-verified bearer token on POST/PUT/DELETE of `/api/v2/remotes` and `/api/v2/virtuals`, 401 otherwise
- leave uploads, object deletes, probe, reads and `/v2` open
- discover the issuer lazily with a 10s client timeout; fail fast with 503 for 15s after a failed discovery
- log the verified `sub`; allow `Authorization` in CORS

Reviewed-on: #136
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

README.md

@@ -261,6 +261,27 @@ there's nothing to provision. To bring your own key instead, point
 `TF_SIGNING_KEY_PASSPHRASE`), which takes precedence over the generated one.
 `TF_PROVIDER_PROTOCOLS` (default `5.0,6.0`) sets the advertised plugin protocols.
 
+### Local Go module proxy
+
+A local `goproxy` repo serves private modules over the GOPROXY protocol
+(`@v/list`, `@latest`, `@v/<ver>.info|.mod|.zip`). Publish a version by
+uploading its files under the case-encoded module path (uppercase as `!lower`):
+
+```sh
+for ext in zip mod info; do
+  curl -fsSL --upload-file v0.1.0.$ext \
+    https://artifactapi.k8s.syd1.au.unkin.net/api/v2/remotes/go-internal/files/example.unkin.net/hello/@v/v0.1.0.$ext
+done
+GOPROXY=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/local/go-internal,https://proxy.golang.org,direct \
+GONOSUMDB=example.unkin.net go get example.unkin.net/hello@latest
+```
+
+Build the zip with `golang.org/x/mod/zip` or reuse the files `go mod download`
+leaves in `$(go env GOMODCACHE)/cache/download`. Uploads are validated: zips must
+pass `zip.CheckZip` (every file under `module@version/`), `.mod` must declare the
+module, and `.info` must match the version. `.info` is optional; it is
+synthesized from the version when absent. `@v/list` lists versions with a `.mod`.
+
 ### Local docker registry
 
 A local `docker` repo is a real container registry, not a mirror: it serves the
@@ -371,6 +392,8 @@ additive and idempotent for the same reason; a test enforces it.
 | `GITHUB_APP_INSTALLATION_ID` | | GitHub App installation id |
 | `GITHUB_APP_PRIVATE_KEY` | | GitHub App private key, inline PEM |
 | `GITHUB_APP_PRIVATE_KEY_PATH` | | GitHub App private key, file path (alternative to inline PEM) |
+| `ARTIFACTAPI_OIDC_ISSUER` | | OIDC issuer URL (e.g. Vault `https://vault.service.consul:8200/v1/identity/oidc`). When set, `POST /api/v2/remotes`, `POST /api/v2/virtuals` and `PUT`/`DELETE` on `/api/v2/{remotes,virtuals}/{name}` require `Authorization: Bearer <jwt>` verified against the issuer's JWKS. Uploads, object/file deletes, probe, reads and `/v2` stay open. Unset = no auth |
+| `ARTIFACTAPI_OIDC_AUDIENCE` | | Comma-separated allowed `aud` values (e.g. the Vault OIDC role's client_id). Required when `ARTIFACTAPI_OIDC_ISSUER` is set |
 
 ## Development
 

e2e-docker/goproxy_local_test.go

@@ -0,0 +1,57 @@
+//go:build dockere2e
+
+package e2edocker
+
+import (
+	"bytes"
+	"net/http"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"golang.org/x/mod/module"
+	modzip "golang.org/x/mod/zip"
+)
+
+// TestLocalGoProxy publishes two module versions and reads them back over the
+// GOPROXY protocol.
+func TestLocalGoProxy(t *testing.T) {
+	createRepo(t, `{"name":"local-go","package_type":"goproxy","repo_type":"local"}`)
+	defer deleteRepo(t, "local-go")
+
+	const mod = "example.unkin.net/!hello"
+	gomod := []byte("module example.unkin.net/Hello\n\ngo 1.25\n")
+	var zip010 []byte
+	for _, ver := range []string{"v0.1.0", "v0.2.0"} {
+		dir := t.TempDir()
+		os.WriteFile(filepath.Join(dir, "go.mod"), gomod, 0o600)
+		os.WriteFile(filepath.Join(dir, "hello.go"), []byte("package hello\n"), 0o600)
+		var buf bytes.Buffer
+		if err := modzip.CreateFromDir(&buf, module.Version{Path: "example.unkin.net/Hello", Version: ver}, dir); err != nil {
+			t.Fatal(err)
+		}
+		if ver == "v0.1.0" {
+			zip010 = buf.Bytes()
+		}
+		uploadFile(t, "local-go", mod+"/@v/"+ver+".zip", buf.Bytes(), "application/zip")
+		uploadFile(t, "local-go", mod+"/@v/"+ver+".mod", gomod, "text/plain")
+	}
+
+	resp, body := doRequest(t, http.MethodPut, api("/api/v2/remotes/local-go/files/"+mod+"/@v/v0.3.0.zip"), []byte("junk"), "application/zip")
+	if resp.StatusCode != http.StatusBadRequest {
+		t.Fatalf("invalid zip: status %d: %s", resp.StatusCode, body)
+	}
+
+	for path, want := range map[string]string{
+		"/@v/list":        "v0.1.0\nv0.2.0\n",
+		"/@latest":        `{"Version":"v0.2.0"}`,
+		"/@v/v0.1.0.info": `{"Version":"v0.1.0"}`,
+		"/@v/v0.1.0.mod":  string(gomod),
+		"/@v/v0.1.0.zip":  string(zip010),
+	} {
+		resp, body := doRequest(t, http.MethodGet, api("/api/v1/local/local-go/"+mod+path), nil, "")
+		if resp.StatusCode != http.StatusOK || string(body) != want {
+			t.Errorf("%s: status %d body %q", path, resp.StatusCode, body)
+		}
+	}
+}

go.mod

@@ -7,7 +7,9 @@ require (
 	github.com/cavaliergopher/rpm v1.3.0
 	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/charmbracelet/lipgloss v1.1.0
+	github.com/coreos/go-oidc/v3 v3.21.0
 	github.com/go-chi/chi/v5 v5.3.0
+	github.com/go-jose/go-jose/v4 v4.1.4
 	github.com/google/uuid v1.6.0
 	github.com/jackc/pgx/v5 v5.10.0
 	github.com/klauspost/compress v1.19.2
@@ -18,6 +20,7 @@ require (
 	github.com/testcontainers/testcontainers-go/modules/redis v0.42.0
 	github.com/ulikunitz/xz v0.5.16
 	golang.org/x/crypto v0.54.0
+	golang.org/x/mod v0.37.0
 	golang.org/x/sync v0.22.0
 	golang.org/x/time v0.15.0
 	gopkg.in/yaml.v3 v3.0.1
@@ -102,6 +105,7 @@ require (
 	go.uber.org/atomic v1.11.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
 	golang.org/x/text v0.40.0 // indirect
 	gopkg.in/ini.v1 v1.67.2 // indirect

go.sum

@@ -44,6 +44,8 @@ github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
 github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A=
 github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
+github.com/coreos/go-oidc/v3 v3.21.0 h1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=
+github.com/coreos/go-oidc/v3 v3.21.0/go.mod h1:DYCf24+ncYi+XkIH97GY1+dqoRlbaSI26KVTCI9SrY4=
 github.com/cpuguy83/dockercfg v0.3.2 h1:DlJTyZGBDlXqUZ2Dk2Q3xHs/FtnooJJVaad2S9GKorA=
 github.com/cpuguy83/dockercfg v0.3.2/go.mod h1:sugsbF4//dDlL/i+S+rtpIWp+5h0BHJHfjj5/jFyUJc=
 github.com/creack/pty v1.1.24 h1:bJrF4RRfyJnbTJqzRLHzcGaZK1NeM5kTC9jGgovnR1s=
@@ -67,6 +69,8 @@ github.com/felixge/httpsnoop v1.1.0 h1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeO
 github.com/felixge/httpsnoop v1.1.0/go.mod h1:Zqxgdd+1Rkcz8euOqdr7lqgCRJztwr5hp9vDSi5UZCE=
 github.com/go-chi/chi/v5 v5.3.0 h1:halUjDxhshgXHMrao5bB8eNBXo/rnzwr8m5m36glehM=
 github.com/go-chi/chi/v5 v5.3.0/go.mod h1:R+tYY2hNuVUUjxoPtqUdgBqevM9s9njzkTLutVsOCto=
+github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=
+github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-logr/logr v1.2.2/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
 github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
 github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
@@ -223,8 +227,12 @@ golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
 golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d h1:jtJma62tbqLibJ5sFQz8bKtEM8rJBtfilJ2qTU199MI=
 golang.org/x/exp v0.0.0-20231006140011-7918f672742d/go.mod h1:ldy0pHrwJyGW56pPQzzkH36rKxoZW1tw7ZJpeKx+hdo=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
 golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
 golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
 golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@@ -241,6 +249,8 @@ golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
 golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=

internal/api/v2/local.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"os"
 
 	"github.com/go-chi/chi/v5"
 
@@ -83,7 +84,22 @@ func (h *LocalHandler) uploadValidated(w http.ResponseWriter, r *http.Request, r
 		return
 	}
 
-	result, err := h.cas.Store(r.Context(), r.Body, contentType)
+	var body io.Reader = r.Body
+	if cv, ok := prov.(provider.ContentValidator); ok {
+		f, err := spoolBody(r.Body)
+		if err != nil {
+			http.Error(w, fmt.Sprintf("read upload: %v", err), http.StatusInternalServerError)
+			return
+		}
+		defer discard(f)
+		if err := cv.ValidateContent(storagePath, f.Name()); err != nil {
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+		body = f
+	}
+
+	result, err := h.cas.Store(r.Context(), body, contentType)
 	if err != nil {
 		http.Error(w, fmt.Sprintf("store failed: %v", err), http.StatusInternalServerError)
 		return
@@ -110,6 +126,27 @@ func (h *LocalHandler) uploadValidated(w http.ResponseWriter, r *http.Request, r
 	writeJSON(w, http.StatusCreated, uploader.UploadResponse(storagePath, result.ContentHash, result.SizeBytes))
 }
 
+func spoolBody(r io.Reader) (*os.File, error) {
+	f, err := os.CreateTemp("", "artifactapi-upload-*")
+	if err != nil {
+		return nil, err
+	}
+	if _, err := io.Copy(f, r); err != nil {
+		discard(f)
+		return nil, err
+	}
+	if _, err := f.Seek(0, io.SeekStart); err != nil {
+		discard(f)
+		return nil, err
+	}
+	return f, nil
+}
+
+func discard(f *os.File) {
+	_ = f.Close()
+	_ = os.Remove(f.Name())
+}
+
 func (h *LocalHandler) uploadGeneric(w http.ResponseWriter, r *http.Request, remote *models.Remote, filePath string) {
 	existing, err := h.db.GetLocalFile(r.Context(), remote.Name, filePath)
 	if err != nil {

internal/api/v2/local_validate_test.go

@@ -0,0 +1,55 @@
+package v2
+
+import (
+	"context"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+
+	"git.unkin.net/unkin/artifactapi/internal/database"
+	_ "git.unkin.net/unkin/artifactapi/internal/provider/goproxy"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+// TestLocalUploadContentRejected verifies a ContentValidator provider rejects
+// bad bytes with 400 before anything is stored.
+func TestLocalUploadContentRejected(t *testing.T) {
+	if testDSN == "" {
+		t.Skip("Docker unavailable")
+	}
+	ctx := context.Background()
+	db, err := database.New(testDSN)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+
+	const repo = "go-local-validate"
+	if err := db.CreateRemote(ctx, &models.Remote{Name: repo, PackageType: models.PackageGoProxy, RepoType: models.RepoTypeLocal}); err != nil {
+		t.Fatal(err)
+	}
+
+	router := chi.NewRouter()
+	router.Route("/remotes/{name}/files", func(r chi.Router) {
+		r.Put("/*", NewLocalHandler(db, nil).Routes().ServeHTTP)
+	})
+
+	cases := map[string]string{
+		"example.unkin.net/hello/@v/v0.1.0.zip":  "not a zip",
+		"example.unkin.net/hello/@v/v0.1.0.mod":  "module example.unkin.net/other\n",
+		"example.unkin.net/hello/@v/v0.1.0.info": `{"Version":"v9.9.9"}`,
+		"example.unkin.net/Hello/@v/v0.1.0.mod":  "module example.unkin.net/Hello\n",
+	}
+	for path, body := range cases {
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, httptest.NewRequest("PUT", "/remotes/"+repo+"/files/"+path, strings.NewReader(body)))
+		if w.Code != 400 {
+			t.Errorf("%s: status %d, want 400 (%s)", path, w.Code, w.Body.String())
+		}
+		if f, _ := db.GetLocalFile(ctx, repo, path); f != nil {
+			t.Errorf("%s: rejected upload was recorded", path)
+		}
+	}
+}

internal/auth/oidc.go

@@ -0,0 +1,158 @@
+package auth
+
+import (
+	"context"
+	"errors"
+	"log/slog"
+	"net/http"
+	"slices"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+)
+
+// BearerOIDC verifies `Authorization: Bearer <jwt>` against an OIDC issuer's
+// JWKS. Discovery is lazy so startup never depends on the issuer being
+// reachable; a failed discovery is not retried until the backoff elapses.
+type BearerOIDC struct {
+	issuer    string
+	audiences []string
+	timeout   time.Duration
+	backoff   time.Duration
+	discover  func(context.Context, string) (*oidc.Provider, error)
+
+	mu       sync.Mutex
+	verifier *oidc.IDTokenVerifier
+	inflight chan struct{}
+	failedAt time.Time
+}
+
+var errIssuerUnavailable = errors.New("oidc issuer unavailable")
+
+// NewBearerOIDC returns nil when issuer is empty, meaning auth is disabled.
+func NewBearerOIDC(issuer string, audiences []string) *BearerOIDC {
+	if issuer == "" {
+		return nil
+	}
+	return &BearerOIDC{issuer: issuer, audiences: audiences, timeout: 10 * time.Second, backoff: 15 * time.Second, discover: oidc.NewProvider}
+}
+
+// getVerifier runs at most one discovery at a time without holding the lock
+// across network I/O; concurrent callers wait for it, and only callers within
+// the post-failure backoff fail fast.
+func (b *BearerOIDC) getVerifier(ctx context.Context) (*oidc.IDTokenVerifier, error) {
+	b.mu.Lock()
+	if v := b.verifier; v != nil {
+		b.mu.Unlock()
+		return v, nil
+	}
+	if done := b.inflight; done != nil {
+		b.mu.Unlock()
+		select {
+		case <-done:
+		case <-ctx.Done():
+			return nil, ctx.Err()
+		}
+		b.mu.Lock()
+		defer b.mu.Unlock()
+		if b.verifier == nil {
+			return nil, errIssuerUnavailable
+		}
+		return b.verifier, nil
+	}
+	if time.Since(b.failedAt) < b.backoff {
+		b.mu.Unlock()
+		return nil, errIssuerUnavailable
+	}
+	done := make(chan struct{})
+	b.inflight = done
+	b.mu.Unlock()
+
+	v, err := b.discoverOnce(done)
+	if err != nil {
+		slog.Error("oidc discovery failed", "issuer", b.issuer, "error", err)
+		return nil, err
+	}
+	return v, nil
+}
+
+// discoverOnce releases inflight and waiters on every exit, a panic included,
+// recording failedAt unless discovery succeeded.
+func (b *BearerOIDC) discoverOnce(done chan struct{}) (v *oidc.IDTokenVerifier, err error) {
+	defer func() {
+		b.mu.Lock()
+		b.inflight = nil
+		if v == nil {
+			b.failedAt = time.Now()
+		}
+		b.verifier = v
+		b.mu.Unlock()
+		close(done)
+	}()
+	// The provider keeps this context and client for JWKS refreshes, so the
+	// deadline lives on the client rather than the context.
+	client := &http.Client{Timeout: b.timeout}
+	p, err := b.discover(oidc.ClientContext(context.Background(), client), b.issuer)
+	if err != nil {
+		return nil, err
+	}
+	return p.Verifier(&oidc.Config{SkipClientIDCheck: true}), nil
+}
+
+// Require gates every request through next on a valid token. A nil receiver
+// passes everything through.
+func (b *BearerOIDC) Require(next http.Handler) http.Handler {
+	if b == nil {
+		return next
+	}
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		scheme, raw, _ := strings.Cut(strings.TrimSpace(r.Header.Get("Authorization")), " ")
+		raw = strings.TrimSpace(raw)
+		if !strings.EqualFold(scheme, "Bearer") || raw == "" {
+			unauthorized(w, "missing bearer token")
+			return
+		}
+		v, err := b.getVerifier(r.Context())
+		if err != nil {
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusServiceUnavailable)
+			_, _ = w.Write([]byte(`{"error":"token issuer unavailable"}`))
+			return
+		}
+		tok, err := v.Verify(r.Context(), raw)
+		if err != nil {
+			slog.Info("bearer token rejected", "error", err)
+			unauthorized(w, "invalid token")
+			return
+		}
+		if len(b.audiences) > 0 && !slices.ContainsFunc(tok.Audience, func(a string) bool { return slices.Contains(b.audiences, a) }) {
+			slog.Info("bearer token rejected", "error", "audience not allowed", "aud", tok.Audience)
+			unauthorized(w, "invalid token")
+			return
+		}
+		slog.Info("bearer token accepted", "sub", tok.Subject, "method", r.Method, "path", r.URL.Path)
+		next.ServeHTTP(w, r)
+	})
+}
+
+// RequireWrites gates only mutating methods.
+func (b *BearerOIDC) RequireWrites(next http.Handler) http.Handler {
+	gated := b.Require(next)
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch r.Method {
+		case http.MethodGet, http.MethodHead, http.MethodOptions:
+			next.ServeHTTP(w, r)
+		default:
+			gated.ServeHTTP(w, r)
+		}
+	})
+}
+
+func unauthorized(w http.ResponseWriter, msg string) {
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("WWW-Authenticate", "Bearer")
+	w.WriteHeader(http.StatusUnauthorized)
+	_, _ = w.Write([]byte(`{"error":"` + msg + `"}`))
+}

internal/auth/oidc_test.go

@@ -0,0 +1,255 @@
+package auth
+
+import (
+	"context"
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/base64"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"sync"
+	"sync/atomic"
+	"testing"
+	"time"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	"github.com/go-jose/go-jose/v4"
+	"github.com/go-jose/go-jose/v4/jwt"
+
+	"git.unkin.net/unkin/artifactapi/internal/testsupport"
+)
+
+func serve(h http.Handler, method, token string) int {
+	if token == "" {
+		return serveAuth(h, method, "")
+	}
+	return serveAuth(h, method, "Bearer "+token)
+}
+
+func serveAuth(h http.Handler, method, authz string) int {
+	r := httptest.NewRequest(method, "/x", nil)
+	if authz != "" {
+		r.Header.Set("Authorization", authz)
+	}
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, r)
+	return w.Code
+}
+
+func claims(iss string) jwt.Claims {
+	now := time.Now()
+	return jwt.Claims{
+		Issuer:   iss,
+		Subject:  "ci",
+		Audience: jwt.Audience{"artifactapi"},
+		IssuedAt: jwt.NewNumericDate(now.Add(-time.Minute)),
+		Expiry:   jwt.NewNumericDate(now.Add(time.Hour)),
+	}
+}
+
+func hs256Token(t *testing.T, c jwt.Claims) string {
+	sig, err := jose.NewSigner(jose.SigningKey{Algorithm: jose.HS256, Key: []byte("0123456789abcdef0123456789abcdef")},
+		(&jose.SignerOptions{}).WithType("JWT").WithHeader("kid", "k1"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	tok, err := jwt.Signed(sig).Claims(c).Serialize()
+	if err != nil {
+		t.Fatal(err)
+	}
+	return tok
+}
+
+func noneToken(iss string) string {
+	enc := base64.RawURLEncoding.EncodeToString
+	return enc([]byte(`{"alg":"none","typ":"JWT","kid":"k1"}`)) + "." +
+		enc([]byte(`{"iss":"`+iss+`","sub":"ci","aud":"artifactapi","exp":`+strconv.FormatInt(time.Now().Add(time.Hour).Unix(), 10)+`}`)) + "."
+}
+
+var ok = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(http.StatusNoContent) })
+
+func TestBearerOIDC(t *testing.T) {
+	iss := testsupport.NewOIDCIssuer()
+	defer iss.Close()
+	h := NewBearerOIDC(iss.URL, []string{"other", "artifactapi"}).Require(ok)
+
+	otherKey, _ := rsa.GenerateKey(rand.Reader, 2048)
+	cases := []struct {
+		name  string
+		token string
+		want  int
+	}{
+		{"valid", iss.Token(nil, "artifactapi", "ci", time.Hour), http.StatusNoContent},
+		{"missing", "", http.StatusUnauthorized},
+		{"garbage", "not.a.jwt", http.StatusUnauthorized},
+		{"bad signature", iss.Token(otherKey, "artifactapi", "ci", time.Hour), http.StatusUnauthorized},
+		{"wrong aud", iss.Token(nil, "nope", "ci", time.Hour), http.StatusUnauthorized},
+		{"expired", iss.Token(nil, "artifactapi", "ci", -time.Hour), http.StatusUnauthorized},
+		{"wrong iss", iss.Sign(nil, claims("https://evil.example")), http.StatusUnauthorized},
+		{"hs256", hs256Token(t, claims(iss.URL)), http.StatusUnauthorized},
+		{"alg none", noneToken(iss.URL), http.StatusUnauthorized},
+	}
+	for _, c := range cases {
+		if got := serve(h, http.MethodPost, c.token); got != c.want {
+			t.Errorf("%s: status %d, want %d", c.name, got, c.want)
+		}
+	}
+
+	valid := iss.Token(nil, "artifactapi", "ci", time.Hour)
+	headers := []struct {
+		name  string
+		authz string
+		want  int
+	}{
+		{"lowercase scheme", "bearer " + valid, http.StatusNoContent},
+		{"extra whitespace", "  Bearer   " + valid + " ", http.StatusNoContent},
+		{"empty value", "Bearer ", http.StatusUnauthorized},
+		{"scheme only", "Bearer", http.StatusUnauthorized},
+		{"basic scheme", "Basic " + valid, http.StatusUnauthorized},
+	}
+	for _, c := range headers {
+		if got := serveAuth(h, http.MethodPost, c.authz); got != c.want {
+			t.Errorf("%s: status %d, want %d", c.name, got, c.want)
+		}
+	}
+}
+
+func TestBearerOIDCHangingIssuerBacksOff(t *testing.T) {
+	var hits atomic.Int32
+	release := make(chan struct{})
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		hits.Add(1)
+		select {
+		case <-r.Context().Done():
+		case <-release:
+		}
+	}))
+	defer srv.Close()
+	defer close(release)
+
+	b := NewBearerOIDC(srv.URL, nil)
+	b.timeout = 100 * time.Millisecond
+	b.backoff = time.Hour
+	h := b.Require(ok)
+
+	start := time.Now()
+	if got := serve(h, http.MethodPost, "x.y.z"); got != http.StatusServiceUnavailable {
+		t.Fatalf("hanging issuer: status %d, want 503", got)
+	}
+	if d := time.Since(start); d > 2*time.Second {
+		t.Fatalf("hanging issuer: took %s, timeout not applied", d)
+	}
+	if got := serve(h, http.MethodPost, "x.y.z"); got != http.StatusServiceUnavailable {
+		t.Fatalf("during backoff: status %d, want 503", got)
+	}
+	if n := hits.Load(); n != 1 {
+		t.Fatalf("issuer hit %d times, want 1", n)
+	}
+}
+
+func TestBearerOIDCPanickingDiscoveryBacksOff(t *testing.T) {
+	b := NewBearerOIDC("http://issuer.invalid", nil)
+	b.backoff = time.Hour
+	b.discover = func(context.Context, string) (*oidc.Provider, error) { panic("boom") }
+	h := b.Require(ok)
+
+	func() {
+		defer func() { _ = recover() }()
+		serve(h, http.MethodPost, "x.y.z")
+	}()
+
+	got := make(chan int, 1)
+	go func() { got <- serve(h, http.MethodPost, "x.y.z") }()
+	select {
+	case code := <-got:
+		if code != http.StatusServiceUnavailable {
+			t.Fatalf("after panic: status %d, want 503", code)
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("after panic: request hung on stale inflight discovery")
+	}
+}
+
+func TestBearerOIDCConcurrentFirstRequestsWaitForDiscovery(t *testing.T) {
+	iss := testsupport.NewOIDCIssuer()
+	defer iss.Close()
+	var hits atomic.Int32
+	inner := iss.Config.Handler
+	iss.Config.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/.well-known/openid-configuration" {
+			hits.Add(1)
+			time.Sleep(200 * time.Millisecond)
+		}
+		inner.ServeHTTP(w, r)
+	})
+
+	h := NewBearerOIDC(iss.URL, nil).Require(ok)
+	tok := iss.Token(nil, "artifactapi", "ci", time.Hour)
+	var wg sync.WaitGroup
+	codes := make([]int, 20)
+	for i := range codes {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			codes[i] = serve(h, http.MethodPost, tok)
+		}()
+	}
+	wg.Wait()
+	for i, c := range codes {
+		if c != http.StatusNoContent {
+			t.Errorf("request %d: status %d, want 204", i, c)
+		}
+	}
+	if n := hits.Load(); n != 1 {
+		t.Fatalf("discovery hit %d times, want 1", n)
+	}
+}
+
+func TestBearerOIDCRetriesAfterBackoff(t *testing.T) {
+	iss := testsupport.NewOIDCIssuer()
+	defer iss.Close()
+	b := NewBearerOIDC(iss.URL, nil)
+	b.failedAt = time.Now()
+	b.backoff = 50 * time.Millisecond
+	tok := iss.Token(nil, "artifactapi", "ci", time.Hour)
+	if got := serve(b.Require(ok), http.MethodPost, tok); got != http.StatusServiceUnavailable {
+		t.Fatalf("within backoff: status %d, want 503", got)
+	}
+	time.Sleep(60 * time.Millisecond)
+	if got := serve(b.Require(ok), http.MethodPost, tok); got != http.StatusNoContent {
+		t.Fatalf("after backoff: status %d, want 204", got)
+	}
+}
+
+func TestBearerOIDCIssuerDown(t *testing.T) {
+	iss := testsupport.NewOIDCIssuer()
+	b := NewBearerOIDC(iss.URL, []string{"artifactapi"})
+	tok := iss.Token(nil, "artifactapi", "ci", time.Hour)
+	iss.Close()
+	if got := serve(b.Require(ok), http.MethodPost, tok); got != http.StatusServiceUnavailable {
+		t.Errorf("issuer down: status %d, want 503", got)
+	}
+}
+
+func TestBearerOIDCDisabled(t *testing.T) {
+	if got := serve(NewBearerOIDC("", nil).RequireWrites(ok), http.MethodDelete, ""); got != http.StatusNoContent {
+		t.Errorf("disabled: status %d, want 204", got)
+	}
+}
+
+func TestRequireWritesLeavesReadsOpen(t *testing.T) {
+	iss := testsupport.NewOIDCIssuer()
+	defer iss.Close()
+	h := NewBearerOIDC(iss.URL, []string{"artifactapi"}).RequireWrites(ok)
+	for _, m := range []string{http.MethodGet, http.MethodHead, http.MethodOptions} {
+		if got := serve(h, m, ""); got != http.StatusNoContent {
+			t.Errorf("%s: status %d, want 204", m, got)
+		}
+	}
+	for _, m := range []string{http.MethodPost, http.MethodPut, http.MethodDelete} {
+		if got := serve(h, m, ""); got != http.StatusUnauthorized {
+			t.Errorf("%s: status %d, want 401", m, got)
+		}
+	}
+}

internal/config/env.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"os"
 	"strconv"
+	"strings"
 )
 
 type Config struct {
@@ -56,6 +57,10 @@ type Config struct {
 	GitHubAppInstallationID string
 	GitHubAppPrivateKey     string
 	GitHubAppPrivateKeyPath string
+
+	// Bearer-JWT auth on configuration writes; empty issuer disables it.
+	OIDCIssuer    string
+	OIDCAudiences []string
 }
 
 func (c *Config) DatabaseDSN() string {
@@ -90,6 +95,17 @@ func Load() (*Config, error) {
 		return nil, fmt.Errorf("invalid GITHUB_SYNC_POLL_INTERVAL: %w", err)
 	}
 
+	oidcIssuer := getenv("ARTIFACTAPI_OIDC_ISSUER", "")
+	var oidcAudiences []string
+	for _, a := range strings.Split(getenv("ARTIFACTAPI_OIDC_AUDIENCE", ""), ",") {
+		if a = strings.TrimSpace(a); a != "" {
+			oidcAudiences = append(oidcAudiences, a)
+		}
+	}
+	if oidcIssuer != "" && len(oidcAudiences) == 0 {
+		return nil, fmt.Errorf("ARTIFACTAPI_OIDC_AUDIENCE is required when ARTIFACTAPI_OIDC_ISSUER is set")
+	}
+
 	cfg := &Config{
 		ListenAddr: getenv("LISTEN_ADDR", ":8000"),
 
@@ -123,6 +139,9 @@ func Load() (*Config, error) {
 		GitHubAppInstallationID: getenv("GITHUB_APP_INSTALLATION_ID", ""),
 		GitHubAppPrivateKey:     getenv("GITHUB_APP_PRIVATE_KEY", ""),
 		GitHubAppPrivateKeyPath: getenv("GITHUB_APP_PRIVATE_KEY_PATH", ""),
+
+		OIDCIssuer:    oidcIssuer,
+		OIDCAudiences: oidcAudiences,
 	}
 
 	return cfg, nil

internal/config/env_test.go

@@ -64,3 +64,20 @@ func TestLoadInvalidPort(t *testing.T) {
 		t.Error("expected error for invalid DBPORT")
 	}
 }
+
+func TestLoadOIDC(t *testing.T) {
+	t.Setenv("ARTIFACTAPI_OIDC_ISSUER", "https://vault.example/v1/identity/oidc")
+	t.Setenv("ARTIFACTAPI_OIDC_AUDIENCE", " a, ,b ")
+	cfg, err := Load()
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	if len(cfg.OIDCAudiences) != 2 || cfg.OIDCAudiences[0] != "a" || cfg.OIDCAudiences[1] != "b" {
+		t.Errorf("audiences = %q", cfg.OIDCAudiences)
+	}
+
+	t.Setenv("ARTIFACTAPI_OIDC_AUDIENCE", "")
+	if _, err := Load(); err == nil {
+		t.Error("expected error for issuer without audience")
+	}
+}

internal/database/github_sync_test.go

@@ -207,72 +207,3 @@ func TestGitHubSyncLeaseFailureBackoff(t *testing.T) {
 		t.Fatal("claimed inside freshness window after a successful sync")
 	}
 }
-
-// Deleting a remote drops its sync state, so a recreated remote of the same name
-// starts clean instead of inheriting the old ETag, sync time and retry state.
-func TestGitHubSyncStateDeletedWithRemote(t *testing.T) {
-	requireDB(t)
-	for _, tc := range []struct {
-		table   string
-		pt      models.PackageType
-		claim   func(name string) (bool, string, error)
-		release func(name string, res provider.SyncResult) error
-	}{
-		{"github_rpm_sync_state", models.PackageGitHubRPM,
-			func(n string) (bool, string, error) {
-				return testDB.ClaimGitHubSyncLease(ctx(), n, "r1", time.Hour, time.Minute)
-			},
-			func(n string, res provider.SyncResult) error {
-				return testDB.ReleaseGitHubSyncLease(ctx(), n, "r1", res)
-			}},
-		{"github_deb_sync_state", models.PackageGitHubDeb,
-			func(n string) (bool, string, error) {
-				return testDB.ClaimGitHubDebSyncLease(ctx(), n, "r1", time.Hour, time.Minute)
-			},
-			func(n string, res provider.SyncResult) error {
-				return testDB.ReleaseGitHubDebSyncLease(ctx(), n, "r1", res)
-			}},
-		{"github_alpine_sync_state", models.PackageGitHubAlpine,
-			func(n string) (bool, string, error) {
-				return testDB.ClaimGitHubAlpineSyncLease(ctx(), n, "r1", time.Hour, time.Minute)
-			},
-			func(n string, res provider.SyncResult) error {
-				return testDB.ReleaseGitHubAlpineSyncLease(ctx(), n, "r1", res)
-			}},
-	} {
-		t.Run(tc.table, func(t *testing.T) {
-			name := "gh-recreate-" + time.Now().Format("150405.000000")
-			create := func() {
-				t.Helper()
-				if err := testDB.CreateRemote(ctx(), &models.Remote{
-					Name: name, PackageType: tc.pt, RepoType: models.RepoTypeRemote,
-					BaseURL: "https://api.github.com/repos/acme/tools", ReleasesRemote: "github", MutableTTL: 3600,
-				}); err != nil {
-					t.Fatalf("create remote: %v", err)
-				}
-			}
-
-			create()
-			if ok, _, err := tc.claim(name); err != nil || !ok {
-				t.Fatalf("claim: ok=%v err=%v", ok, err)
-			}
-			if err := tc.release(name, provider.SyncResult{Etag: `"old"`}); err != nil {
-				t.Fatalf("release: %v", err)
-			}
-
-			if err := testDB.DeleteRemote(ctx(), name); err != nil {
-				t.Fatalf("delete remote: %v", err)
-			}
-			var rows int
-			if err := testDB.Pool.QueryRow(ctx(), `SELECT count(*) FROM `+tc.table+` WHERE remote_name = $1`, name).Scan(&rows); err != nil || rows != 0 {
-				t.Fatalf("sync state left after delete: rows=%d err=%v", rows, err)
-			}
-
-			create()
-			ok, etag, err := tc.claim(name)
-			if err != nil || !ok || etag != "" {
-				t.Fatalf("recreated remote claim ok=%v etag=%q err=%v, want a fresh claim with no etag", ok, etag, err)
-			}
-		})
-	}
-}

internal/provider/alpine/github.go

@@ -372,9 +372,6 @@ func (p *GitHubProvider) scanWithState(ctx context.Context, remote models.Remote
 		return newEtag, false, err
 	}
 
-	// A transiently failed asset fails the scan so the ETag is not advanced and
-	// the retry re-derives it; an invalid package is skipped as no retry fixes it.
-	var failed []error
 	seen := map[string]bool{}
 	for _, rel := range releases {
 		if rel.Draft {
@@ -403,14 +400,10 @@ func (p *GitHubProvider) scanWithState(ctx context.Context, remote models.Remote
 			meta, err := p.deriveAsset(ctx, remote, asset, fp)
 			if err != nil {
 				slog.Warn("github_alpine: derive asset failed", "remote", remote.Name, "asset", asset.Name, "error", err)
-				if !errors.Is(err, provider.ErrInvalidPackage) {
-					failed = append(failed, fmt.Errorf("%s: %w", asset.Name, err))
-				}
 				continue
 			}
 			if err := inserter.InsertAlpineMetadata(ctx, meta); err != nil {
 				slog.Error("github_alpine: insert metadata failed", "remote", remote.Name, "asset", asset.Name, "error", err)
-				failed = append(failed, fmt.Errorf("%s: %w", asset.Name, err))
 				continue
 			}
 			slog.Info("github_alpine: derived asset", "remote", remote.Name, "name", meta.Name, "version", meta.Version, "arch", meta.Arch)
@@ -422,7 +415,7 @@ func (p *GitHubProvider) scanWithState(ctx context.Context, remote models.Remote
 			_ = deleter.DeleteAlpineMetadata(ctx, remote.Name, fp)
 		}
 	}
-	return newEtag, true, errors.Join(failed...)
+	return newEtag, true, nil
 }
 
 type ghRelease struct {
@@ -503,7 +496,7 @@ func (p *GitHubProvider) deriveAsset(ctx context.Context, remote models.Remote,
 		return nil, err
 	}
 	if meta.Name == "" || meta.Arch == "" {
-		return nil, fmt.Errorf("%w: .PKGINFO missing pkgname/arch", provider.ErrInvalidPackage)
+		return nil, errors.New(".PKGINFO missing pkgname/arch")
 	}
 
 	meta.RepoName = remote.Name
@@ -533,13 +526,13 @@ func (p *GitHubProvider) fetchPkginfo(ctx context.Context, remote models.Remote,
 		}
 		meta, complete, perr := pkginfoFromPrefix(body)
 		if perr != nil {
-			return nil, fmt.Errorf("%w: parse apk .PKGINFO: %w", provider.ErrInvalidPackage, perr)
+			return nil, fmt.Errorf("parse apk .PKGINFO: %w", perr)
 		}
 		if complete {
 			return meta, nil
 		}
 		if full || n >= p.headerMax {
-			return nil, fmt.Errorf("%w: .PKGINFO not found within %d bytes of %s", provider.ErrInvalidPackage, n, downloadURL)
+			return nil, fmt.Errorf(".PKGINFO not found within %d bytes of %s", n, downloadURL)
 		}
 		n *= 2
 		if n > p.headerMax {
@@ -601,7 +594,7 @@ func pkginfoFromPrefix(prefix []byte) (meta *provider.AlpineMetadata, complete b
 }
 
 // rangeGet returns the first n bytes of downloadURL. full is true when the
-// response holds the whole object.
+// response body was shorter than n (i.e. we already have the whole object).
 func (p *GitHubProvider) rangeGet(ctx context.Context, remote models.Remote, downloadURL string, n int64) ([]byte, bool, error) {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, downloadURL, nil)
 	if err != nil {
@@ -623,9 +616,15 @@ func (p *GitHubProvider) rangeGet(ctx context.Context, remote models.Remote, dow
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusPartialContent {
-		return nil, false, fmt.Errorf("range GET: %w", provider.AssetStatusError(downloadURL, resp))
+		return nil, false, fmt.Errorf("range GET %s: status %d", downloadURL, resp.StatusCode)
 	}
-	return provider.ReadPrefix(resp, n)
+
+	body, err := io.ReadAll(io.LimitReader(resp.Body, n))
+	if err != nil {
+		return nil, false, err
+	}
+	full := int64(len(body)) < n
+	return body, full, nil
 }
 
 // assetPath is the package's location relative to github.com — the path the

internal/provider/alpine/github_test.go

@@ -8,7 +8,6 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
-	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -89,17 +88,15 @@ type githubFixture struct {
 	notModHit   int
 	releaseAuth string
 	assetAuth   string
-	assetFail   map[string]int // asset filename -> downloads left to answer 500
 	mu          sync.Mutex
 }
 
 func newGitHubFixture(t *testing.T, withDigest bool) *githubFixture {
 	t.Helper()
 	f := &githubFixture{
-		apkBytes:  map[string][]byte{},
-		rangeHit:  map[string]int{},
-		fullHit:   map[string]int{},
-		assetFail: map[string]int{},
+		apkBytes: map[string][]byte{},
+		rangeHit: map[string]int{},
+		fullHit:  map[string]int{},
 	}
 	f.apkBytes["demo-1.2.3-r0.apk"] = testsupport.MinimalApk("demo", "1.2.3-r0", "x86_64")
 
@@ -149,12 +146,6 @@ func newGitHubFixture(t *testing.T, withDigest bool) *githubFixture {
 		}
 		rng := r.Header.Get("Range")
 		f.mu.Lock()
-		if f.assetFail[name] > 0 {
-			f.assetFail[name]--
-			f.mu.Unlock()
-			http.Error(w, "boom", http.StatusInternalServerError)
-			return
-		}
 		f.assetAuth = r.Header.Get("Authorization")
 		if rng != "" {
 			f.rangeHit[name]++
@@ -504,13 +495,3 @@ func readAPKIndex(t *testing.T, gzBytes []byte) string {
 		}
 	}
 }
-
-func TestGitHubDeriveAssetMissingPkgnameIsInvalid(t *testing.T) {
-	fx := newGitHubFixture(t, true)
-	fx.apkBytes["nameless-1-r0.apk"] = testsupport.MinimalApk("", "1-r0", "x86_64")
-	asset := ghAsset{BrowserDownloadURL: fx.srv.URL + "/acme/tools/releases/download/v1.2.3/nameless-1-r0.apk"}
-	_, err := newTestProvider().deriveAsset(context.Background(), fx.remote(), asset, "fp")
-	if !errors.Is(err, provider.ErrInvalidPackage) {
-		t.Fatalf("want ErrInvalidPackage, got %v", err)
-	}
-}

internal/provider/alpine/syncer_test.go

@@ -308,58 +308,3 @@ func TestSyncerPrimeBypassesRecencyPeriodicDoesNot(t *testing.T) {
 		t.Fatalf("periodic scan ran inside recency window: %d -> %d releases calls", releasesAfterPrime, fx.releasesHit)
 	}
 }
-
-// A transiently failed asset fails the scan: the ETag is not advanced, a retry
-// is scheduled, and the retry against the unchanged release list derives it. An
-// invalid package is skipped instead, since no retry can fix it.
-func TestSyncerFailedAssetRetry(t *testing.T) {
-	for _, tc := range []struct {
-		name      string
-		corrupt   bool
-		wantRetry bool
-	}{
-		{name: "transient", wantRetry: true},
-		{name: "invalid package", corrupt: true},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			fx := newGitHubFixture(t, true)
-			fx.etag = `"v1"`
-			if tc.corrupt {
-				fx.apkBytes["other-9-r0.apk"] = []byte("not a package")
-			} else {
-				fx.apkBytes["other-9-r0.apk"] = testsupport.MinimalApk("other", "9-r0", "aarch64")
-				fx.assetFail["other-9-r0.apk"] = 1
-			}
-			store := newFakeSyncStore()
-			s := newSyncer(store, newTestProvider(), testSyncConfig())
-			remote := fx.remote()
-			bg := context.Background()
-
-			s.process(bg, syncJob{remote: remote, prime: true})
-			_, pending := store.retryAt[remote.Name]
-			if pending != tc.wantRetry {
-				t.Fatalf("retry pending=%v, want %v", pending, tc.wantRetry)
-			}
-			if _, saved := store.etags[remote.Name]; saved == tc.wantRetry {
-				t.Fatalf("etag saved=%v after first scan", saved)
-			}
-			if rows, _ := store.ListAlpineMetadataEntries(bg, remote.Name); len(rows) != 1 {
-				t.Fatalf("healthy asset not served: %d rows", len(rows))
-			}
-			if !tc.wantRetry {
-				return
-			}
-
-			store.mu.Lock()
-			store.retryAt[remote.Name] = time.Now().Add(-time.Second)
-			store.mu.Unlock()
-			s.process(bg, syncJob{remote: remote})
-			if _, pending := store.retryAt[remote.Name]; pending || store.etags[remote.Name] != `"v1"` {
-				t.Fatalf("retry not recorded: pending=%v etag=%q", pending, store.etags[remote.Name])
-			}
-			if rows, _ := store.ListAlpineMetadataEntries(bg, remote.Name); len(rows) != 2 {
-				t.Fatalf("retry did not derive the failed asset: %d rows", len(rows))
-			}
-		})
-	}
-}

internal/provider/deb/github.go

@@ -333,9 +333,6 @@ func (p *GitHubProvider) scanWithState(ctx context.Context, remote models.Remote
 		return newEtag, false, err
 	}
 
-	// A transiently failed asset fails the scan so the ETag is not advanced and
-	// the retry re-derives it; an invalid package is skipped as no retry fixes it.
-	var failed []error
 	seen := map[string]bool{}
 	for _, rel := range releases {
 		if rel.Draft {
@@ -364,14 +361,10 @@ func (p *GitHubProvider) scanWithState(ctx context.Context, remote models.Remote
 			meta, err := p.deriveAsset(ctx, remote, asset, fp)
 			if err != nil {
 				slog.Warn("github_deb: derive asset failed", "remote", remote.Name, "asset", asset.Name, "error", err)
-				if !errors.Is(err, provider.ErrInvalidPackage) {
-					failed = append(failed, fmt.Errorf("%s: %w", asset.Name, err))
-				}
 				continue
 			}
 			if err := store.InsertDebMetadata(ctx, meta); err != nil {
 				slog.Error("github_deb: insert metadata failed", "remote", remote.Name, "asset", asset.Name, "error", err)
-				failed = append(failed, fmt.Errorf("%s: %w", asset.Name, err))
 				continue
 			}
 			slog.Info("github_deb: derived asset", "remote", remote.Name, "name", meta.Name, "version", meta.Version, "arch", meta.Architecture)
@@ -383,7 +376,7 @@ func (p *GitHubProvider) scanWithState(ctx context.Context, remote models.Remote
 			_ = store.DeleteDebMetadata(ctx, remote.Name, fp)
 		}
 	}
-	return newEtag, true, errors.Join(failed...)
+	return newEtag, true, nil
 }
 
 type ghRelease struct {
@@ -475,7 +468,7 @@ func (p *GitHubProvider) deriveAsset(ctx context.Context, remote models.Remote,
 		Size:         asset.Size,
 	}
 	if meta.Name == "" {
-		return nil, fmt.Errorf("%w: control missing Package field", provider.ErrInvalidPackage)
+		return nil, errors.New("control missing Package field")
 	}
 
 	// The Packages SHA256 must be the sha256 of the whole .deb. Prefer GitHub's
@@ -510,13 +503,13 @@ func (p *GitHubProvider) fetchControl(ctx context.Context, remote models.Remote,
 		}
 		control, complete, perr := controlFromPrefix(body)
 		if perr != nil {
-			return "", fmt.Errorf("%w: parse deb control: %w", provider.ErrInvalidPackage, perr)
+			return "", fmt.Errorf("parse deb control: %w", perr)
 		}
 		if complete {
 			return control, nil
 		}
 		if full || n >= p.headerMax {
-			return "", fmt.Errorf("%w: control.tar not found within %d bytes of %s", provider.ErrInvalidPackage, n, downloadURL)
+			return "", fmt.Errorf("control.tar not found within %d bytes of %s", n, downloadURL)
 		}
 		n *= 2
 		if n > p.headerMax {
@@ -574,7 +567,7 @@ func controlFromPrefix(prefix []byte) (control string, complete bool, err error)
 }
 
 // rangeGet returns the first n bytes of downloadURL. full is true when the
-// response holds the whole object.
+// response body was shorter than n (i.e. we already have the whole object).
 func (p *GitHubProvider) rangeGet(ctx context.Context, remote models.Remote, downloadURL string, n int64) ([]byte, bool, error) {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, downloadURL, nil)
 	if err != nil {
@@ -596,9 +589,15 @@ func (p *GitHubProvider) rangeGet(ctx context.Context, remote models.Remote, dow
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusPartialContent {
-		return nil, false, fmt.Errorf("range GET: %w", provider.AssetStatusError(downloadURL, resp))
+		return nil, false, fmt.Errorf("range GET %s: status %d", downloadURL, resp.StatusCode)
 	}
-	return provider.ReadPrefix(resp, n)
+
+	body, err := io.ReadAll(io.LimitReader(resp.Body, n))
+	if err != nil {
+		return nil, false, err
+	}
+	full := int64(len(body)) < n
+	return body, full, nil
 }
 
 func (p *GitHubProvider) computeSHA256(ctx context.Context, remote models.Remote, downloadURL string) (string, error) {
@@ -621,7 +620,7 @@ func (p *GitHubProvider) computeSHA256(ctx context.Context, remote models.Remote
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode != http.StatusOK {
-		return "", fmt.Errorf("GET: %w", provider.AssetStatusError(downloadURL, resp))
+		return "", fmt.Errorf("GET %s: status %d", downloadURL, resp.StatusCode)
 	}
 
 	h := sha256.New()

internal/provider/deb/github_test.go

@@ -7,7 +7,6 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
-	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -82,17 +81,15 @@ type githubFixture struct {
 	notModHit   int
 	releaseAuth string
 	assetAuth   string
-	assetFail   map[string]int // asset filename -> downloads left to answer 500
 	mu          sync.Mutex
 }
 
 func newGitHubFixture(t *testing.T, withDigest bool) *githubFixture {
 	t.Helper()
 	f := &githubFixture{
-		debBytes:  map[string][]byte{},
-		rangeHit:  map[string]int{},
-		fullHit:   map[string]int{},
-		assetFail: map[string]int{},
+		debBytes: map[string][]byte{},
+		rangeHit: map[string]int{},
+		fullHit:  map[string]int{},
 	}
 	f.debBytes["demo_1.2-3_amd64.deb"] = testsupport.MinimalDeb("demo", "1.2-3", "amd64")
 
@@ -142,12 +139,6 @@ func newGitHubFixture(t *testing.T, withDigest bool) *githubFixture {
 		}
 		rng := r.Header.Get("Range")
 		f.mu.Lock()
-		if f.assetFail[name] > 0 {
-			f.assetFail[name]--
-			f.mu.Unlock()
-			http.Error(w, "boom", http.StatusInternalServerError)
-			return
-		}
 		f.assetAuth = r.Header.Get("Authorization")
 		if rng != "" {
 			f.rangeHit[name]++
@@ -469,13 +460,3 @@ func TestGitHubAssetPatternFilter(t *testing.T) {
 		t.Fatalf("pattern filter failed, rows=%+v", rows)
 	}
 }
-
-func TestGitHubDeriveAssetMissingPackageIsInvalid(t *testing.T) {
-	fx := newGitHubFixture(t, true)
-	fx.debBytes["nameless_1_amd64.deb"] = testsupport.MinimalDeb("", "1", "amd64")
-	asset := ghAsset{BrowserDownloadURL: fx.srv.URL + "/acme/tools/releases/download/v1.2-3/nameless_1_amd64.deb", Digest: "sha256:00"}
-	_, err := newTestProvider().deriveAsset(context.Background(), fx.remote(), asset, "fp")
-	if !errors.Is(err, provider.ErrInvalidPackage) {
-		t.Fatalf("want ErrInvalidPackage, got %v", err)
-	}
-}

internal/provider/deb/syncer_test.go

@@ -308,58 +308,3 @@ func TestSyncerPrimeBypassesRecencyPeriodicDoesNot(t *testing.T) {
 		t.Fatalf("periodic scan ran inside recency window: %d -> %d releases calls", releasesAfterPrime, fx.releasesHit)
 	}
 }
-
-// A transiently failed asset fails the scan: the ETag is not advanced, a retry
-// is scheduled, and the retry against the unchanged release list derives it. An
-// invalid package is skipped instead, since no retry can fix it.
-func TestSyncerFailedAssetRetry(t *testing.T) {
-	for _, tc := range []struct {
-		name      string
-		corrupt   bool
-		wantRetry bool
-	}{
-		{name: "transient", wantRetry: true},
-		{name: "invalid package", corrupt: true},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			fx := newGitHubFixture(t, true)
-			fx.etag = `"v1"`
-			if tc.corrupt {
-				fx.debBytes["other_9-9_arm64.deb"] = []byte("not a package")
-			} else {
-				fx.debBytes["other_9-9_arm64.deb"] = testsupport.MinimalDeb("other", "9-9", "arm64")
-				fx.assetFail["other_9-9_arm64.deb"] = 1
-			}
-			store := newFakeSyncStore()
-			s := newSyncer(store, newTestProvider(), testSyncConfig())
-			remote := fx.remote()
-			bg := context.Background()
-
-			s.process(bg, syncJob{remote: remote, prime: true})
-			_, pending := store.retryAt[remote.Name]
-			if pending != tc.wantRetry {
-				t.Fatalf("retry pending=%v, want %v", pending, tc.wantRetry)
-			}
-			if _, saved := store.etags[remote.Name]; saved == tc.wantRetry {
-				t.Fatalf("etag saved=%v after first scan", saved)
-			}
-			if rows, _ := store.ListDebMetadataEntries(bg, remote.Name); len(rows) != 1 {
-				t.Fatalf("healthy asset not served: %d rows", len(rows))
-			}
-			if !tc.wantRetry {
-				return
-			}
-
-			store.mu.Lock()
-			store.retryAt[remote.Name] = time.Now().Add(-time.Second)
-			store.mu.Unlock()
-			s.process(bg, syncJob{remote: remote})
-			if _, pending := store.retryAt[remote.Name]; pending || store.etags[remote.Name] != `"v1"` {
-				t.Fatalf("retry not recorded: pending=%v etag=%q", pending, store.etags[remote.Name])
-			}
-			if rows, _ := store.ListDebMetadataEntries(bg, remote.Name); len(rows) != 2 {
-				t.Fatalf("retry did not derive the failed asset: %d rows", len(rows))
-			}
-		})
-	}
-}

internal/provider/goproxy/local.go

@@ -0,0 +1,222 @@
+package goproxy
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"os"
+	"slices"
+	"strings"
+
+	"golang.org/x/mod/modfile"
+	"golang.org/x/mod/module"
+	"golang.org/x/mod/semver"
+	modzip "golang.org/x/mod/zip"
+
+	"git.unkin.net/unkin/artifactapi/internal/provider"
+)
+
+type versionFile struct {
+	module  string
+	version string
+	ext     string
+}
+
+// parseVersionFile splits "<escaped module>/@v/<version>.<ext>" into its parts.
+func parseVersionFile(path string) (versionFile, error) {
+	escMod, file, ok := strings.Cut(strings.TrimPrefix(path, "/"), "/@v/")
+	if !ok || escMod == "" || strings.Contains(file, "/") {
+		return versionFile{}, fmt.Errorf("path %q must be <module>/@v/<version>.{zip,mod,info}", path)
+	}
+	dot := strings.LastIndex(file, ".")
+	if dot <= 0 {
+		return versionFile{}, fmt.Errorf("path %q must end in .zip, .mod or .info", path)
+	}
+	ext := file[dot+1:]
+	if ext != "zip" && ext != "mod" && ext != "info" {
+		return versionFile{}, fmt.Errorf("path %q must end in .zip, .mod or .info", path)
+	}
+	mod, err := module.UnescapePath(escMod)
+	if err != nil {
+		return versionFile{}, fmt.Errorf("module path must be case-encoded (uppercase as !lower): %w", err)
+	}
+	ver, err := module.UnescapeVersion(file[:dot])
+	if err != nil {
+		return versionFile{}, err
+	}
+	if err := module.Check(mod, ver); err != nil {
+		return versionFile{}, err
+	}
+	if semver.Canonical(ver) != ver {
+		return versionFile{}, fmt.Errorf("version %q is not canonical semver", ver)
+	}
+	return versionFile{module: mod, version: ver, ext: ext}, nil
+}
+
+func (v versionFile) storagePath() string {
+	escMod, _ := module.EscapePath(v.module)
+	escVer, _ := module.EscapeVersion(v.version)
+	return escMod + "/@v/" + escVer + "." + v.ext
+}
+
+func (p *Provider) ValidateUpload(filePath string) (storagePath, contentType string, err error) {
+	vf, err := parseVersionFile(filePath)
+	if err != nil {
+		return "", "", err
+	}
+	sp := vf.storagePath()
+	return sp, p.ContentType(sp), nil
+}
+
+func (p *Provider) ValidateContent(storagePath, localFile string) error {
+	vf, err := parseVersionFile(storagePath)
+	if err != nil {
+		return err
+	}
+	switch vf.ext {
+	case "zip":
+		if _, err := modzip.CheckZip(module.Version{Path: vf.module, Version: vf.version}, localFile); err != nil {
+			return fmt.Errorf("invalid module zip (files must sit under %s@%s/): %w", vf.module, vf.version, err)
+		}
+	case "mod":
+		data, err := os.ReadFile(localFile)
+		if err != nil {
+			return err
+		}
+		mf, err := modfile.ParseLax("go.mod", data, nil)
+		if err != nil {
+			return fmt.Errorf("invalid go.mod: %w", err)
+		}
+		if mf.Module == nil || mf.Module.Mod.Path != vf.module {
+			return fmt.Errorf("go.mod must declare module %s", vf.module)
+		}
+	case "info":
+		data, err := os.ReadFile(localFile)
+		if err != nil {
+			return err
+		}
+		var info struct{ Version string }
+		if err := json.Unmarshal(data, &info); err != nil {
+			return fmt.Errorf("invalid .info JSON: %w", err)
+		}
+		if info.Version != vf.version {
+			return fmt.Errorf(".info Version %q does not match %s", info.Version, vf.version)
+		}
+	}
+	return nil
+}
+
+func (p *Provider) UploadResponse(storagePath, contentHash string, sizeBytes int64) map[string]any {
+	vf, _ := parseVersionFile(storagePath)
+	return map[string]any{
+		"module":       vf.module,
+		"version":      vf.version,
+		"path":         storagePath,
+		"content_hash": contentHash,
+		"size_bytes":   sizeBytes,
+	}
+}
+
+// versions returns the canonical versions of escMod that have a .mod uploaded, sorted ascending.
+func versions(ctx context.Context, files provider.FileStore, repoName, escMod string) (versions []string, infos map[string]bool, err error) {
+	entries, err := files.ListFilesByPrefix(ctx, repoName, escMod+"/@v/")
+	if err != nil {
+		return nil, nil, err
+	}
+	infos = map[string]bool{}
+	for _, e := range entries {
+		vf, err := parseVersionFile(e.FilePath)
+		if err != nil || vf.storagePath() != e.FilePath {
+			continue
+		}
+		switch vf.ext {
+		case "mod":
+			versions = append(versions, vf.version)
+		case "info":
+			infos[vf.version] = true
+		}
+	}
+	semver.Sort(versions)
+	return versions, infos, nil
+}
+
+func latest(vs []string) string {
+	for i := len(vs) - 1; i >= 0; i-- {
+		if semver.Prerelease(vs[i]) == "" {
+			return vs[i]
+		}
+	}
+	if len(vs) == 0 {
+		return ""
+	}
+	return vs[len(vs)-1]
+}
+
+func infoJSON(version string) []byte {
+	b, _ := json.Marshal(map[string]string{"Version": version})
+	return b
+}
+
+func (p *Provider) ServeLocalIndex(w http.ResponseWriter, r *http.Request, files provider.FileStore, repoName, path string) bool {
+	path = strings.TrimPrefix(path, "/")
+	switch {
+	case strings.HasSuffix(path, "/@v/list"), strings.HasSuffix(path, "/@latest"):
+	case strings.HasSuffix(path, ".info"):
+		vf, err := parseVersionFile(path)
+		if err != nil {
+			return false
+		}
+		escMod, _ := module.EscapePath(vf.module)
+		vs, infos, err := versions(r.Context(), files, repoName, escMod)
+		if err != nil || infos[vf.version] || !slices.Contains(vs, vf.version) {
+			return false
+		}
+	default:
+		return false
+	}
+
+	body, err := p.GenerateLocalIndex(r.Context(), files, repoName, path)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusNotFound)
+		return true
+	}
+	w.Header().Set("Content-Type", p.ContentType(path))
+	w.WriteHeader(http.StatusOK)
+	_, _ = w.Write(body)
+	return true
+}
+
+func (p *Provider) GenerateLocalIndex(ctx context.Context, files provider.FileStore, repoName, path string) ([]byte, error) {
+	path = strings.TrimPrefix(path, "/")
+	if escMod, ok := strings.CutSuffix(path, "/@v/list"); ok {
+		vs, _, err := versions(ctx, files, repoName, escMod)
+		if err != nil {
+			return nil, err
+		}
+		var b strings.Builder
+		for _, v := range vs {
+			b.WriteString(v + "\n")
+		}
+		return []byte(b.String()), nil
+	}
+	if escMod, ok := strings.CutSuffix(path, "/@latest"); ok {
+		vs, _, err := versions(ctx, files, repoName, escMod)
+		if err != nil {
+			return nil, err
+		}
+		v := latest(vs)
+		if v == "" {
+			return nil, fmt.Errorf("no versions of %s", escMod)
+		}
+		return infoJSON(v), nil
+	}
+	if strings.HasSuffix(path, ".info") {
+		vf, err := parseVersionFile(path)
+		if err != nil {
+			return nil, err
+		}
+		return infoJSON(vf.version), nil
+	}
+	return nil, fmt.Errorf("unsupported index path: %q", path)
+}

internal/provider/goproxy/local_test.go

@@ -0,0 +1,198 @@
+package goproxy
+
+import (
+	"archive/zip"
+	"context"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"golang.org/x/mod/module"
+	modzip "golang.org/x/mod/zip"
+
+	"git.unkin.net/unkin/artifactapi/internal/provider"
+)
+
+type fakeFileStore struct{ paths []string }
+
+func (f *fakeFileStore) ListPackages(context.Context, string) ([]string, error) { return nil, nil }
+
+func (f *fakeFileStore) ListFilesByPrefix(_ context.Context, _, prefix string) ([]provider.FileEntry, error) {
+	var out []provider.FileEntry
+	for _, p := range f.paths {
+		if strings.HasPrefix(p, prefix) {
+			out = append(out, provider.FileEntry{FilePath: p, ContentHash: "sha256:x"})
+		}
+	}
+	return out, nil
+}
+
+func TestValidateUpload(t *testing.T) {
+	p := &Provider{}
+	cases := []struct {
+		in, want string
+		ok       bool
+	}{
+		{"example.unkin.net/hello/@v/v0.1.0.zip", "example.unkin.net/hello/@v/v0.1.0.zip", true},
+		{"/example.unkin.net/hello/@v/v0.1.0.mod", "example.unkin.net/hello/@v/v0.1.0.mod", true},
+		{"github.com/!burnt!sushi/toml/@v/v1.2.0.info", "github.com/!burnt!sushi/toml/@v/v1.2.0.info", true},
+		{"example.unkin.net/hello/v2/@v/v2.0.0-rc.1.zip", "example.unkin.net/hello/v2/@v/v2.0.0-rc.1.zip", true},
+		{"github.com/BurntSushi/toml/@v/v1.2.0.zip", "", false},
+		{"example.unkin.net/hello/@v/v0.1.zip", "", false},
+		{"example.unkin.net/hello/@v/v2.0.0.zip", "", false},
+		{"example.unkin.net/hello/@v/v0.1.0.tar.gz", "", false},
+		{"example.unkin.net/hello/v0.1.0.zip", "", false},
+		{"example.unkin.net/hello/@v/list", "", false},
+	}
+	for _, c := range cases {
+		got, ct, err := p.ValidateUpload(c.in)
+		if (err == nil) != c.ok {
+			t.Errorf("%s: err=%v, want ok=%v", c.in, err, c.ok)
+			continue
+		}
+		if c.ok && (got != c.want || ct == "") {
+			t.Errorf("%s: got %q %q, want %q", c.in, got, ct, c.want)
+		}
+	}
+}
+
+func writeZip(t *testing.T, files map[string]string) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "m.zip")
+	f, err := os.Create(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	zw := zip.NewWriter(f)
+	for name, body := range files {
+		w, err := zw.Create(name)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := w.Write([]byte(body)); err != nil {
+			t.Fatal(err)
+		}
+	}
+	if err := zw.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if err := f.Close(); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+
+func writeFile(t *testing.T, body string) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "f")
+	if err := os.WriteFile(path, []byte(body), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+
+func TestValidateContentZip(t *testing.T) {
+	p := &Provider{}
+	sp := "example.unkin.net/hello/@v/v0.1.0.zip"
+
+	dir := t.TempDir()
+	os.WriteFile(filepath.Join(dir, "go.mod"), []byte("module example.unkin.net/hello\n"), 0o600)
+	os.WriteFile(filepath.Join(dir, "main.go"), []byte("package main\n"), 0o600)
+	good := filepath.Join(t.TempDir(), "good.zip")
+	f, _ := os.Create(good)
+	if err := modzip.CreateFromDir(f, module.Version{Path: "example.unkin.net/hello", Version: "v0.1.0"}, dir); err != nil {
+		t.Fatal(err)
+	}
+	f.Close()
+	if err := p.ValidateContent(sp, good); err != nil {
+		t.Errorf("valid zip rejected: %v", err)
+	}
+
+	bad := map[string]map[string]string{
+		"no prefix":     {"go.mod": "module example.unkin.net/hello\n"},
+		"wrong version": {"example.unkin.net/hello@v0.2.0/go.mod": "module example.unkin.net/hello\n"},
+		"wrong module":  {"example.unkin.net/other@v0.1.0/go.mod": "module example.unkin.net/other\n"},
+	}
+	for name, files := range bad {
+		if err := p.ValidateContent(sp, writeZip(t, files)); err == nil {
+			t.Errorf("%s: expected rejection", name)
+		}
+	}
+	if err := p.ValidateContent(sp, writeFile(t, "not a zip")); err == nil {
+		t.Error("non-zip accepted")
+	}
+}
+
+func TestValidateContentModInfo(t *testing.T) {
+	p := &Provider{}
+	mod := "example.unkin.net/hello/@v/v0.1.0.mod"
+	info := "example.unkin.net/hello/@v/v0.1.0.info"
+	cases := []struct {
+		path, body string
+		ok         bool
+	}{
+		{mod, "module example.unkin.net/hello\n\ngo 1.25\n", true},
+		{mod, "module example.unkin.net/other\n", false},
+		{mod, "go 1.25\n", false},
+		{mod, "module (\n", false},
+		{info, `{"Version":"v0.1.0","Time":"2026-01-01T00:00:00Z"}`, true},
+		{info, `{"Version":"v0.2.0"}`, false},
+		{info, `nope`, false},
+	}
+	for _, c := range cases {
+		if err := p.ValidateContent(c.path, writeFile(t, c.body)); (err == nil) != c.ok {
+			t.Errorf("%s %q: err=%v, want ok=%v", c.path, c.body, err, c.ok)
+		}
+	}
+}
+
+func serve(t *testing.T, fs provider.FileStore, path string) (bool, int, string) {
+	t.Helper()
+	rec := httptest.NewRecorder()
+	handled := (&Provider{}).ServeLocalIndex(rec, httptest.NewRequest("GET", "/"+path, nil), fs, "go-local", path)
+	return handled, rec.Code, rec.Body.String()
+}
+
+func TestServeLocalIndex(t *testing.T) {
+	fs := &fakeFileStore{paths: []string{
+		"example.unkin.net/hello/@v/v0.10.0.mod",
+		"example.unkin.net/hello/@v/v0.10.0.zip",
+		"example.unkin.net/hello/@v/v0.2.0.mod",
+		"example.unkin.net/hello/@v/v0.2.0.zip",
+		"example.unkin.net/hello/@v/v0.2.0.info",
+		"example.unkin.net/hello/@v/v0.11.0-rc.1.mod",
+		"example.unkin.net/hello/@v/v0.3.0.zip",
+		"example.unkin.net/hello/v2/@v/v2.0.0.mod",
+		"example.unkin.net/!pre/@v/v1.0.0-beta.mod",
+	}}
+
+	if h, code, body := serve(t, fs, "example.unkin.net/hello/@v/list"); !h || code != 200 || body != "v0.2.0\nv0.10.0\nv0.11.0-rc.1\n" {
+		t.Errorf("list: %v %d %q", h, code, body)
+	}
+	if h, code, body := serve(t, fs, "example.unkin.net/hello/@latest"); !h || code != 200 || body != `{"Version":"v0.10.0"}` {
+		t.Errorf("latest: %v %d %q", h, code, body)
+	}
+	if h, _, body := serve(t, fs, "example.unkin.net/!pre/@latest"); !h || body != `{"Version":"v1.0.0-beta"}` {
+		t.Errorf("prerelease-only latest: %q", body)
+	}
+	if h, code, _ := serve(t, fs, "example.unkin.net/missing/@latest"); !h || code != 404 {
+		t.Errorf("missing latest: %v %d", h, code)
+	}
+	if h, code, body := serve(t, fs, "example.unkin.net/missing/@v/list"); !h || code != 200 || body != "" {
+		t.Errorf("missing list: %v %d %q", h, code, body)
+	}
+	if h, _, body := serve(t, fs, "example.unkin.net/hello/@v/v0.10.0.info"); !h || body != `{"Version":"v0.10.0"}` {
+		t.Errorf("synthesized info: %v %q", h, body)
+	}
+	if h, _, _ := serve(t, fs, "example.unkin.net/hello/@v/v0.2.0.info"); h {
+		t.Error("uploaded .info must be served from storage")
+	}
+	if h, _, _ := serve(t, fs, "example.unkin.net/hello/@v/v0.3.0.info"); h {
+		t.Error(".info without a .mod must not be synthesized")
+	}
+	if h, _, _ := serve(t, fs, "example.unkin.net/hello/@v/v0.10.0.zip"); h {
+		t.Error(".zip must be served from storage")
+	}
+}

internal/provider/provider.go

@@ -41,6 +41,11 @@ type LocalUploader interface {
 	UploadResponse(storagePath, contentHash string, sizeBytes int64) map[string]any
 }
 
+// ContentValidator checks an upload's bytes (spooled to localFile) before it is stored.
+type ContentValidator interface {
+	ValidateContent(storagePath, localFile string) error
+}
+
 type LocalIndexer interface {
 	ServeLocalIndex(w http.ResponseWriter, r *http.Request, files FileStore, repoName, path string) bool
 	GenerateLocalIndex(ctx context.Context, files FileStore, repoName, path string) ([]byte, error)

internal/provider/rpm/github.go

@@ -343,9 +343,6 @@ func (p *GitHubProvider) scanWithState(ctx context.Context, remote models.Remote
 		return newEtag, false, err
 	}
 
-	// A transiently failed asset fails the scan so the ETag is not advanced and
-	// the retry re-derives it; an invalid package is skipped as no retry fixes it.
-	var failed []error
 	seen := map[string]bool{}
 	for _, rel := range releases {
 		if rel.Draft {
@@ -376,14 +373,10 @@ func (p *GitHubProvider) scanWithState(ctx context.Context, remote models.Remote
 			meta, err := p.deriveAsset(ctx, remote, asset, fp)
 			if err != nil {
 				slog.Warn("github_rpm: derive asset failed", "remote", remote.Name, "asset", asset.Name, "error", err)
-				if !errors.Is(err, provider.ErrInvalidPackage) {
-					failed = append(failed, fmt.Errorf("%s: %w", asset.Name, err))
-				}
 				continue
 			}
 			if err := store.InsertRPMMetadata(ctx, meta); err != nil {
 				slog.Error("github_rpm: insert metadata failed", "remote", remote.Name, "asset", asset.Name, "error", err)
-				failed = append(failed, fmt.Errorf("%s: %w", asset.Name, err))
 				continue
 			}
 			slog.Info("github_rpm: derived asset", "remote", remote.Name, "name", meta.Name, "version", meta.Version, "arch", meta.Arch)
@@ -395,7 +388,7 @@ func (p *GitHubProvider) scanWithState(ctx context.Context, remote models.Remote
 			_ = store.DeleteRPMMetadata(ctx, remote.Name, fp)
 		}
 	}
-	return newEtag, true, errors.Join(failed...)
+	return newEtag, true, nil
 }
 
 type ghRelease struct {
@@ -576,12 +569,12 @@ func (p *GitHubProvider) fetchHeader(ctx context.Context, remote models.Remote,
 			}
 			continue
 		}
-		return nil, fmt.Errorf("%w: parse rpm header: %w", provider.ErrInvalidPackage, perr)
+		return nil, fmt.Errorf("parse rpm header: %w", perr)
 	}
 }
 
 // rangeGet returns the first n bytes of downloadURL. full is true when the
-// response holds the whole object.
+// response body was shorter than n (i.e. we already have the whole object).
 func (p *GitHubProvider) rangeGet(ctx context.Context, remote models.Remote, downloadURL string, n int64) ([]byte, bool, error) {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, downloadURL, nil)
 	if err != nil {
@@ -603,9 +596,15 @@ func (p *GitHubProvider) rangeGet(ctx context.Context, remote models.Remote, dow
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusPartialContent {
-		return nil, false, fmt.Errorf("range GET: %w", provider.AssetStatusError(downloadURL, resp))
+		return nil, false, fmt.Errorf("range GET %s: status %d", downloadURL, resp.StatusCode)
 	}
-	return provider.ReadPrefix(resp, n)
+
+	body, err := io.ReadAll(io.LimitReader(resp.Body, n))
+	if err != nil {
+		return nil, false, err
+	}
+	full := int64(len(body)) < n
+	return body, full, nil
 }
 
 func (p *GitHubProvider) computeSHA256(ctx context.Context, remote models.Remote, downloadURL string) (string, error) {
@@ -628,7 +627,7 @@ func (p *GitHubProvider) computeSHA256(ctx context.Context, remote models.Remote
 	}
 	defer resp.Body.Close()
 	if resp.StatusCode != http.StatusOK {
-		return "", fmt.Errorf("GET: %w", provider.AssetStatusError(downloadURL, resp))
+		return "", fmt.Errorf("GET %s: status %d", downloadURL, resp.StatusCode)
 	}
 
 	h := sha256.New()

internal/provider/rpm/github_test.go

@@ -1,13 +1,11 @@
 package rpm
 
 import (
-	"cmp"
 	"compress/gzip"
 	"context"
 	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
-	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -26,22 +24,15 @@ import (
 // fakeStore is an in-memory provider.RemoteMetadataStore keyed by file_path,
 // mirroring the (repo_name, file_path) uniqueness of the real table.
 type fakeStore struct {
-	mu         sync.Mutex
-	rows       map[string]provider.RPMMetadata
-	insertFail map[string]int // package name -> inserts left to fail
+	mu   sync.Mutex
+	rows map[string]provider.RPMMetadata
 }
 
-func newFakeStore() *fakeStore {
-	return &fakeStore{rows: map[string]provider.RPMMetadata{}, insertFail: map[string]int{}}
-}
+func newFakeStore() *fakeStore { return &fakeStore{rows: map[string]provider.RPMMetadata{}} }
 
 func (f *fakeStore) InsertRPMMetadata(_ context.Context, m *provider.RPMMetadata) error {
 	f.mu.Lock()
 	defer f.mu.Unlock()
-	if f.insertFail[m.Name] > 0 {
-		f.insertFail[m.Name]--
-		return errors.New("insert failed")
-	}
 	if _, ok := f.rows[m.FilePath]; ok {
 		return nil // ON CONFLICT DO NOTHING
 	}
@@ -88,20 +79,15 @@ type githubFixture struct {
 	releaseAuth string            // Authorization header seen on the last releases request
 	assetAuth   string            // Authorization header seen on the last asset request
 	failStatus  int               // when set, the releases list answers this status (rate-limit style)
-	assetFail   map[string]int    // asset filename -> downloads left to answer failCode
-	failCode    int               // status for assetFail downloads; 0 = 500
-	shortRead   map[string]int    // asset filename -> ranged GETs left to close early
 	mu          sync.Mutex
 }
 
 func newGitHubFixture(t *testing.T, withDigest bool) *githubFixture {
 	t.Helper()
 	f := &githubFixture{
-		rpmBytes:  map[string][]byte{},
-		rangeHit:  map[string]int{},
-		fullHit:   map[string]int{},
-		assetFail: map[string]int{},
-		shortRead: map[string]int{},
+		rpmBytes: map[string][]byte{},
+		rangeHit: map[string]int{},
+		fullHit:  map[string]int{},
 	}
 	f.rpmBytes["demo-1.2-3.x86_64.rpm"] = testsupport.MinimalRPM("demo", "1.2", "3", "x86_64")
 
@@ -159,17 +145,6 @@ func newGitHubFixture(t *testing.T, withDigest bool) *githubFixture {
 		}
 		rng := r.Header.Get("Range")
 		f.mu.Lock()
-		if f.assetFail[name] > 0 {
-			f.assetFail[name]--
-			code := cmp.Or(f.failCode, http.StatusInternalServerError)
-			f.mu.Unlock()
-			http.Error(w, "boom", code)
-			return
-		}
-		short := rng != "" && f.shortRead[name] > 0
-		if short {
-			f.shortRead[name]--
-		}
 		f.assetAuth = r.Header.Get("Authorization")
 		if rng != "" {
 			f.rangeHit[name]++
@@ -190,9 +165,6 @@ func newGitHubFixture(t *testing.T, withDigest bool) *githubFixture {
 			end = len(body) - 1
 		}
 		w.Header().Set("Content-Range", fmt.Sprintf("bytes 0-%d/%d", end, len(body)))
-		if short {
-			end /= 2
-		}
 		w.Header().Set("Content-Length", strconv.Itoa(end+1))
 		w.WriteHeader(http.StatusPartialContent)
 		w.Write(body[:end+1])

internal/provider/rpm/syncer_test.go

@@ -399,74 +399,3 @@ func TestSyncerFailedScanRetriesAfterBackoff(t *testing.T) {
 		t.Fatalf("recovery did not refresh metadata: %d rows", len(rows))
 	}
 }
-
-// A transiently failed asset fails the scan: the ETag is not advanced, a retry
-// is scheduled, and the retry against the unchanged release list derives it. An
-// invalid package is skipped instead, since no retry can fix it.
-func TestSyncerFailedAssetRetry(t *testing.T) {
-	for _, tc := range []struct {
-		name      string
-		corrupt   bool
-		failCode  int
-		short     bool
-		insert    bool
-		wantRetry bool
-	}{
-		{name: "transient", wantRetry: true},
-		{name: "rate limited", failCode: http.StatusForbidden, wantRetry: true},
-		{name: "short read", short: true, wantRetry: true},
-		{name: "insert failure", insert: true, wantRetry: true},
-		{name: "invalid package", corrupt: true},
-		{name: "asset not found", failCode: http.StatusNotFound},
-		{name: "asset gone", failCode: http.StatusGone},
-	} {
-		t.Run(tc.name, func(t *testing.T) {
-			const other = "other-9-9.aarch64.rpm"
-			fx := newGitHubFixture(t, true)
-			fx.etag = `"v1"`
-			fx.rpmBytes[other] = testsupport.MinimalRPM("other", "9", "9", "aarch64")
-			store := newFakeSyncStore()
-			switch {
-			case tc.corrupt:
-				fx.rpmBytes[other] = []byte("not a package")
-			case tc.short:
-				fx.shortRead[other] = 1
-			case tc.insert:
-				store.insertFail["other"] = 1
-			case tc.failCode != 0 && !tc.wantRetry:
-				fx.failCode, fx.assetFail[other] = tc.failCode, 1<<30
-			default:
-				fx.failCode, fx.assetFail[other] = tc.failCode, 1
-			}
-			s := newSyncer(store, newTestProvider(), testSyncConfig())
-			remote := fx.remote()
-			bg := context.Background()
-
-			s.process(bg, syncJob{remote: remote, prime: true})
-			_, pending := store.retryAt[remote.Name]
-			if pending != tc.wantRetry {
-				t.Fatalf("retry pending=%v, want %v", pending, tc.wantRetry)
-			}
-			if _, saved := store.etags[remote.Name]; saved == tc.wantRetry {
-				t.Fatalf("etag saved=%v after first scan", saved)
-			}
-			if rows, _ := store.ListRPMMetadataEntries(bg, remote.Name); len(rows) != 1 {
-				t.Fatalf("healthy asset not served: %d rows", len(rows))
-			}
-			if !tc.wantRetry {
-				return
-			}
-
-			store.mu.Lock()
-			store.retryAt[remote.Name] = time.Now().Add(-time.Second)
-			store.mu.Unlock()
-			s.process(bg, syncJob{remote: remote})
-			if _, pending := store.retryAt[remote.Name]; pending || store.etags[remote.Name] != `"v1"` {
-				t.Fatalf("retry not recorded: pending=%v etag=%q", pending, store.etags[remote.Name])
-			}
-			if rows, _ := store.ListRPMMetadataEntries(bg, remote.Name); len(rows) != 2 {
-				t.Fatalf("retry did not derive the failed asset: %d rows", len(rows))
-			}
-		})
-	}
-}

internal/provider/syncretry.go

@@ -3,10 +3,8 @@ package provider
 import (
 	"errors"
 	"fmt"
-	"io"
 	"net/http"
 	"strconv"
-	"strings"
 	"time"
 )
 
@@ -45,49 +43,6 @@ func NewUpstreamStatusError(url string, resp *http.Response) *UpstreamStatusErro
 	return e
 }
 
-// ErrInvalidPackage marks an asset whose bytes are not a valid package. It is
-// permanent, so a scan skips the asset instead of failing and retrying.
-var ErrInvalidPackage = errors.New("invalid package")
-
-// AssetStatusError classifies a non-success asset download. A missing or
-// unsatisfiable asset is permanent; anything else (403/429 rate limits, 5xx) is
-// transient.
-func AssetStatusError(url string, resp *http.Response) error {
-	switch resp.StatusCode {
-	case http.StatusNotFound, http.StatusGone, http.StatusRequestedRangeNotSatisfiable:
-		return fmt.Errorf("%w: %s: status %d", ErrInvalidPackage, url, resp.StatusCode)
-	}
-	return NewUpstreamStatusError(url, resp)
-}
-
-// ReadPrefix reads up to n bytes of a 200 or 206 asset response. full reports
-// that the body is the whole object (per Content-Length or the Content-Range
-// total, or a clean EOF before n when the total is unknown); a body ending before n bytes that is not the whole object is a
-// transient short read.
-func ReadPrefix(resp *http.Response, n int64) (body []byte, full bool, err error) {
-	body, err = io.ReadAll(io.LimitReader(resp.Body, n))
-	if err != nil {
-		return nil, false, err
-	}
-	total := resp.ContentLength
-	unknown := resp.StatusCode == http.StatusOK && total == -1
-	if resp.StatusCode == http.StatusPartialContent {
-		total = -1
-		if _, t, ok := strings.Cut(resp.Header.Get("Content-Range"), "/"); ok {
-			if v, perr := strconv.ParseInt(t, 10, 64); perr == nil {
-				total = v
-			}
-			unknown = t == "*"
-		}
-	}
-	// net/http errors on a premature close, so a clean EOF before n with an unknown total is the whole object.
-	full = total == int64(len(body)) || (unknown && int64(len(body)) < n)
-	if !full && int64(len(body)) < n {
-		return nil, false, fmt.Errorf("short read: got %d of %d bytes", len(body), n)
-	}
-	return body, full, nil
-}
-
 // SyncResult is a background scan's outcome, recorded when its sync lease is
 // released. A failed scan keeps the prior sync time and ETag and schedules a
 // retry after Backoff, doubled per consecutive failure up to MaxBackoff, and

internal/provider/syncretry_test.go

@@ -3,9 +3,7 @@ package provider
 import (
 	"errors"
 	"fmt"
-	"io"
 	"net/http"
-	"net/http/httptest"
 	"strconv"
 	"testing"
 	"time"
@@ -63,76 +61,3 @@ func TestNewSyncResult(t *testing.T) {
 		t.Fatalf("wrapped hint not clamped to ttl: retry in %v", until)
 	}
 }
-
-func TestAssetStatusErrorClassification(t *testing.T) {
-	for status, permanent := range map[int]bool{
-		http.StatusNotFound: true, http.StatusGone: true, http.StatusRequestedRangeNotSatisfiable: true,
-		http.StatusForbidden: false, http.StatusTooManyRequests: false, http.StatusInternalServerError: false, http.StatusBadGateway: false,
-	} {
-		err := AssetStatusError("u", &http.Response{StatusCode: status, Header: http.Header{}})
-		if errors.Is(err, ErrInvalidPackage) != permanent {
-			t.Errorf("status %d: permanent=%v, want %v", status, !permanent, permanent)
-		}
-	}
-}
-
-func TestReadPrefix(t *testing.T) {
-	cases := []struct {
-		name     string
-		status   int
-		cl       int64
-		crange   string
-		body     string
-		n        int64
-		wantFull bool
-		wantErr  bool
-	}{
-		{name: "200 whole object", status: 200, cl: 5, body: "hello", n: 32, wantFull: true},
-		{name: "200 larger than n", status: 200, cl: 5, body: "hello", n: 4},
-		{name: "200 chunked shorter than n", status: 200, cl: -1, body: "hello", n: 32, wantFull: true},
-		{name: "200 chunked larger than n", status: 200, cl: -1, body: "hello", n: 4},
-		{name: "206 whole object", status: 206, crange: "bytes 0-4/5", body: "hello", n: 32, wantFull: true},
-		{name: "206 prefix", status: 206, crange: "bytes 0-3/100", body: "hell", n: 4},
-		{name: "206 short read", status: 206, crange: "bytes 0-31/100", body: "hello", n: 32, wantErr: true},
-		{name: "206 no content-range short", status: 206, body: "hello", n: 32, wantErr: true},
-		{name: "206 unknown total shorter than n", status: 206, cl: -1, crange: "bytes 0-4/*", body: "hello", n: 32, wantFull: true},
-		{name: "206 unknown total prefix", status: 206, cl: -1, crange: "bytes 0-3/*", body: "hell", n: 4},
-	}
-	for _, tc := range cases {
-		t.Run(tc.name, func(t *testing.T) {
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
-				if tc.cl > 0 {
-					w.Header().Set("Content-Length", strconv.FormatInt(tc.cl, 10))
-				}
-				if tc.crange != "" {
-					w.Header().Set("Content-Range", tc.crange)
-				}
-				w.WriteHeader(tc.status)
-				_, _ = io.WriteString(w, tc.body)
-				w.(http.Flusher).Flush()
-			}))
-			defer srv.Close()
-			resp, err := http.Get(srv.URL)
-			if err != nil {
-				t.Fatal(err)
-			}
-			defer resp.Body.Close()
-			if tc.cl == -1 && resp.ContentLength != -1 {
-				t.Fatalf("response not chunked: ContentLength=%d", resp.ContentLength)
-			}
-			body, full, err := ReadPrefix(resp, tc.n)
-			if (err != nil) != tc.wantErr {
-				t.Fatalf("err=%v, wantErr=%v", err, tc.wantErr)
-			}
-			if err != nil {
-				if errors.Is(err, ErrInvalidPackage) {
-					t.Fatalf("short read must be transient: %v", err)
-				}
-				return
-			}
-			if full != tc.wantFull || int64(len(body)) > tc.n {
-				t.Fatalf("full=%v len=%d, want full=%v", full, len(body), tc.wantFull)
-			}
-		})
-	}
-}

internal/server/middleware.go

@@ -12,7 +12,7 @@ func cors(next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		w.Header().Set("Access-Control-Allow-Origin", "*")
 		w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
-		w.Header().Set("Access-Control-Allow-Headers", "Content-Type")
+		w.Header().Set("Access-Control-Allow-Headers", "Content-Type, Authorization")
 		if r.Method == http.MethodOptions {
 			w.WriteHeader(http.StatusNoContent)
 			return

internal/server/oidc_test.go

@@ -0,0 +1,80 @@
+package server
+
+import (
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"git.unkin.net/unkin/artifactapi/internal/testsupport"
+)
+
+func TestServerOIDCWriteAuth(t *testing.T) {
+	requireStack(t)
+	iss := testsupport.NewOIDCIssuer()
+	defer iss.Close()
+
+	cfg := *testSrv.cfg
+	cfg.OIDCIssuer = iss.URL
+	cfg.OIDCAudiences = []string{"artifactapi"}
+	s := *testSrv
+	s.cfg = &cfg
+	ts := httptest.NewServer(s.routes())
+	defer ts.Close()
+
+	good := iss.Token(nil, "artifactapi", "ci", time.Hour)
+	do := func(method, path, body, token string) int {
+		t.Helper()
+		rq, _ := http.NewRequest(method, ts.URL+path, strings.NewReader(body))
+		rq.Header.Set("Content-Type", "application/json")
+		if token != "" {
+			rq.Header.Set("Authorization", "Bearer "+token)
+		}
+		resp, err := http.DefaultClient.Do(rq)
+		if err != nil {
+			t.Fatalf("%s %s: %v", method, path, err)
+		}
+		_, _ = io.Copy(io.Discard, resp.Body)
+		_ = resp.Body.Close()
+		return resp.StatusCode
+	}
+	expect := func(want int, method, path, body, token string) {
+		t.Helper()
+		if got := do(method, path, body, token); got != want {
+			t.Errorf("%s %s: status %d, want %d", method, path, got, want)
+		}
+	}
+
+	remote := `{"name":"srv-oidc","package_type":"generic","repo_type":"local"}`
+	virtual := `{"name":"srv-oidc-v","package_type":"generic","members":["srv-oidc"]}`
+
+	expect(401, "POST", "/api/v2/remotes", remote, "")
+	expect(401, "POST", "/api/v2/remotes", remote, iss.Token(nil, "other", "ci", time.Hour))
+	expect(201, "POST", "/api/v2/remotes", remote, good)
+	expect(401, "PUT", "/api/v2/remotes/srv-oidc", `{"package_type":"generic"}`, "")
+	expect(401, "DELETE", "/api/v2/remotes/srv-oidc", "", "")
+	expect(401, "POST", "/api/v2/virtuals", virtual, "")
+	expect(201, "POST", "/api/v2/virtuals", virtual, good)
+	expect(401, "PUT", "/api/v2/virtuals/srv-oidc-v", virtual, "")
+	expect(401, "DELETE", "/api/v2/virtuals/srv-oidc-v", "", "")
+
+	expect(200, "GET", "/api/v2/remotes", "", "")
+	expect(200, "GET", "/api/v2/remotes/srv-oidc", "", "")
+	expect(200, "GET", "/api/v2/virtuals/srv-oidc-v", "", "")
+	expect(201, "PUT", "/api/v2/remotes/srv-oidc/files/a.bin", "payload", "")
+	expect(200, "GET", "/api/v2/remotes/srv-oidc/files/a.bin", "", "")
+	if got := do("DELETE", "/api/v2/remotes/srv-oidc/files/a.bin", "", ""); got >= 400 {
+		t.Errorf("delete file: status %d", got)
+	}
+	if got := do("POST", "/api/v2/probe", `{}`, ""); got == 401 {
+		t.Error("probe gated")
+	}
+	if got := do("GET", "/v2/", "", ""); got == 401 {
+		t.Error("docker /v2 gated")
+	}
+
+	expect(204, "DELETE", "/api/v2/virtuals/srv-oidc-v", "", good)
+	expect(204, "DELETE", "/api/v2/remotes/srv-oidc", "", good)
+}

internal/server/server.go

@@ -15,6 +15,7 @@ import (
 	tfregistry "git.unkin.net/unkin/artifactapi/internal/api/terraform"
 	v1 "git.unkin.net/unkin/artifactapi/internal/api/v1"
 	v2 "git.unkin.net/unkin/artifactapi/internal/api/v2"
+	"git.unkin.net/unkin/artifactapi/internal/auth"
 	"git.unkin.net/unkin/artifactapi/internal/cache"
 	"git.unkin.net/unkin/artifactapi/internal/config"
 	"git.unkin.net/unkin/artifactapi/internal/database"
@@ -186,10 +187,11 @@ func (s *Server) routes() chi.Router {
 	statsHandler := v2.NewStatsHandler(s.db)
 	eventsHandler := v2.NewEventsHandler()
 	probeHandler := v2.NewProbeHandler(s.engine, s.db)
+	writeAuth := auth.NewBearerOIDC(s.cfg.OIDCIssuer, s.cfg.OIDCAudiences)
 
 	r.Route("/api/v2", func(r chi.Router) {
-		r.Mount("/remotes", remotesHandler.Routes())
-		r.Mount("/virtuals", virtualsHandler.Routes())
+		r.Mount("/remotes", writeAuth.RequireWrites(remotesHandler.Routes()))
+		r.Mount("/virtuals", writeAuth.RequireWrites(virtualsHandler.Routes()))
 		r.Mount("/health", healthHandler.Routes())
 		r.Mount("/stats", statsHandler.Routes())
 		r.Mount("/events", eventsHandler.Routes())

internal/testsupport/oidc.go

@@ -0,0 +1,73 @@
+package testsupport
+
+import (
+	"crypto/rand"
+	"crypto/rsa"
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"time"
+
+	"github.com/go-jose/go-jose/v4"
+	"github.com/go-jose/go-jose/v4/jwt"
+)
+
+// OIDCIssuer is a minimal OIDC issuer serving discovery and JWKS, signing
+// RS256 tokens with a generated key.
+type OIDCIssuer struct {
+	*httptest.Server
+	key *rsa.PrivateKey
+}
+
+func NewOIDCIssuer() *OIDCIssuer {
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		panic(err)
+	}
+	iss := &OIDCIssuer{key: key}
+	mux := http.NewServeMux()
+	mux.HandleFunc("/.well-known/openid-configuration", func(w http.ResponseWriter, r *http.Request) {
+		_ = json.NewEncoder(w).Encode(map[string]any{
+			"issuer":                                iss.URL,
+			"jwks_uri":                              iss.URL + "/keys",
+			"id_token_signing_alg_values_supported": []string{"RS256"},
+		})
+	})
+	mux.HandleFunc("/keys", func(w http.ResponseWriter, r *http.Request) {
+		_ = json.NewEncoder(w).Encode(jose.JSONWebKeySet{Keys: []jose.JSONWebKey{
+			{Key: &key.PublicKey, KeyID: "k1", Algorithm: "RS256", Use: "sig"},
+		}})
+	})
+	iss.Server = httptest.NewServer(mux)
+	return iss
+}
+
+// Token signs a token for aud and sub. Pass a nil key to use the issuer's own;
+// expiry is relative to now.
+func (o *OIDCIssuer) Token(key *rsa.PrivateKey, aud, sub string, expiry time.Duration) string {
+	now := time.Now()
+	return o.Sign(key, jwt.Claims{
+		Issuer:   o.URL,
+		Subject:  sub,
+		Audience: jwt.Audience{aud},
+		IssuedAt: jwt.NewNumericDate(now.Add(-time.Minute)),
+		Expiry:   jwt.NewNumericDate(now.Add(expiry)),
+	})
+}
+
+// Sign signs arbitrary claims with RS256. Pass a nil key to use the issuer's own.
+func (o *OIDCIssuer) Sign(key *rsa.PrivateKey, claims jwt.Claims) string {
+	if key == nil {
+		key = o.key
+	}
+	sig, err := jose.NewSigner(jose.SigningKey{Algorithm: jose.RS256, Key: key},
+		(&jose.SignerOptions{}).WithType("JWT").WithHeader("kid", "k1"))
+	if err != nil {
+		panic(err)
+	}
+	tok, err := jwt.Signed(sig).Claims(claims).Serialize()
+	if err != nil {
+		panic(err)
+	}
+	return tok
+}

migrations/0003_github_sync_state_cascade.sql

@@ -1,12 +0,0 @@
--- Sync state is dropped with its remote, so a recreated remote of the same name
--- starts with no inherited ETag or timing. NOT VALID skips checking rows left by
--- remotes deleted before this migration, which would otherwise fail it.
-ALTER TABLE github_rpm_sync_state    DROP CONSTRAINT IF EXISTS github_rpm_sync_state_remote_fk;
-ALTER TABLE github_rpm_sync_state    ADD CONSTRAINT github_rpm_sync_state_remote_fk
-	FOREIGN KEY (remote_name) REFERENCES remotes(name) ON DELETE CASCADE NOT VALID;
-ALTER TABLE github_deb_sync_state    DROP CONSTRAINT IF EXISTS github_deb_sync_state_remote_fk;
-ALTER TABLE github_deb_sync_state    ADD CONSTRAINT github_deb_sync_state_remote_fk
-	FOREIGN KEY (remote_name) REFERENCES remotes(name) ON DELETE CASCADE NOT VALID;
-ALTER TABLE github_alpine_sync_state DROP CONSTRAINT IF EXISTS github_alpine_sync_state_remote_fk;
-ALTER TABLE github_alpine_sync_state ADD CONSTRAINT github_alpine_sync_state_remote_fk
-	FOREIGN KEY (remote_name) REFERENCES remotes(name) ON DELETE CASCADE NOT VALID;

ui/src/components/UsageInstructions.tsx

@@ -218,15 +218,38 @@ sudo apk add --allow-untrusted <package>`,
       ];
 
     case 'goproxy':
-      return [
-        {
-          title: 'Point the Go module proxy here',
-          language: 'bash',
-          code: `export GOPROXY=${proxy}
+      return isLocal
+        ? [
+            {
+              title: 'Fetch private modules from this proxy',
+              language: 'bash',
+              code: `export GOPROXY=${url}/api/v1/local/${name},https://proxy.golang.org,direct
+export GONOSUMDB=example.unkin.net
+go get example.unkin.net/hello@latest`,
+              note: 'Set GONOSUMDB (or GOPRIVATE) to your module prefix: private modules are not in sum.golang.org.',
+            },
+            {
+              title: 'Publish a module version',
+              language: 'bash',
+              code: `# build the zip with golang.org/x/mod/zip (CreateFromDir), or reuse
+# the .zip/.mod/.info from $(go env GOMODCACHE)/cache/download after go mod download
+MOD=example.unkin.net/hello VER=v0.1.0
+for ext in zip mod info; do
+  curl -fsSL --upload-file $VER.$ext \\
+    ${url}/api/v2/remotes/${name}/files/$MOD/@v/$VER.$ext
+done`,
+              note: 'Paths use the case-encoded module path (uppercase as !lower). Zips must hold every file under module@version/ and are rejected otherwise; .info is optional.',
+            },
+          ]
+        : [
+            {
+              title: 'Point the Go module proxy here',
+              language: 'bash',
+              code: `export GOPROXY=${proxy}
 go mod download`,
-          note: 'Append ,direct to fall back to VCS for modules this proxy does not cover.',
-        },
-      ];
+              note: 'Append ,direct to fall back to VCS for modules this proxy does not cover.',
+            },
+          ];
 
     case 'cargo':
       return [