feat: server-level GitHub machine credential for authenticated requests

Anonymous GitHub is capped at 60 requests/hour and cannot read private
repositories, so a machine credential usable by a free (non-enterprise)
account is needed to lift the request budget and reach private release
assets.

- Add internal/githubauth: a process-wide credential delivered via env/secret,
  applied by default to every outbound GitHub request.
- Support two modes: a Personal Access Token sent as `Authorization: Bearer`,
  and a GitHub App that mints a short-lived RS256 JWT (stdlib crypto, no new
  dependency), exchanges it for a ~1h installation token, caches it, and
  single-flights a refresh a few minutes before expiry.
- Inject the credential at the two GitHub call paths: the rpm github provider
  (releases scan + ranged asset-header GETs) and the generic byte proxy
  (private release-asset downloads for github.com hosts).
- Honor precedence: a remote's own username/password overrides the server
  credential; no credential configured stays anonymous.
- Fail closed at startup on partial App configuration; never persist the
  credential to the DB, return it from an API, or log it.
- Read GITHUB_TOKEN / GITHUB_APP_ID / GITHUB_APP_INSTALLATION_ID /
  GITHUB_APP_PRIVATE_KEY[_PATH] via the existing getenv convention.
- Document PAT vs App setup, the free-account fine-grained PAT scopes
  (Contents:read + Metadata:read), precedence, and the rate-limit implication.

.gitignore

@@ -1,2 +1,6 @@
 bin/
-terraform/
+/terraform/
+
+# e2e-docker fixtures are real package files (.rpm, .tgz, .whl, .zip, ...) that
+# are intentionally tracked, overriding any global ignore of those extensions.
+!e2e-docker/fixtures/**

.pre-commit-config.yaml

@@ -0,0 +1,24 @@
+repos:
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v5.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-added-large-files
+      - id: check-merge-conflict
+
+  - repo: https://github.com/dnephin/pre-commit-golang
+    rev: v0.5.1
+    hooks:
+      - id: go-fmt
+      - id: go-mod-tidy
+
+  - repo: local
+    hooks:
+      - id: go-vet
+        name: go vet
+        entry: go vet ./...
+        language: system
+        types: [go]
+        pass_filenames: false

.woodpecker/docker.yaml

@@ -8,6 +8,8 @@ steps:
     settings:
       registry: git.unkin.net
       repo: git.unkin.net/unkin/artifactapi
+      build_args:
+        VERSION: ${CI_COMMIT_TAG}
       username: droneci
       password:
         from_secret: DRONECI_PASSWORD
@@ -22,6 +24,8 @@ steps:
       repo: git.unkin.net/unkin/artifactapi-ui
       dockerfile: ui/Dockerfile.ui
       context: ui
+      build_args:
+        BASE_PATH: /ui
       username: droneci
       password:
         from_secret: DRONECI_PASSWORD

.woodpecker/pre-commit.yaml

@@ -3,7 +3,15 @@ when:
 
 steps:
   - name: pre-commit
-    image: golang:1.25
+    image: git.unkin.net/unkin/almalinux9-gobuilder:20260606
     commands:
-      - test -z "$(gofmt -l .)"
-      - go vet ./...
+      - uvx pre-commit run --all-files
+    backend_options:
+      kubernetes:
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2

Dockerfile

@@ -9,7 +9,8 @@ RUN go mod download
 
 COPY . .
 
-RUN CGO_ENABLED=0 go build -ldflags="-s -w" -o artifactapi ./cmd/artifactapi
+ARG VERSION=dev
+RUN CGO_ENABLED=0 go build -ldflags="-s -w -X main.version=${VERSION}" -o artifactapi ./cmd/artifactapi
 
 FROM gcr.io/distroless/static-debian12:nonroot
 

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build test lint fmt e2e docker docker-ui compose clean tidy check-go
+.PHONY: build test lint fmt e2e docker-e2e docker docker-ui compose clean tidy check-go
 
 BINARY := bin/artifactapi
 MODULE := git.unkin.net/unkin/artifactapi
@@ -12,7 +12,7 @@ check-go:
 	fi
 
 build: check-go tidy
-	go build -ldflags="-s -w" -o $(BINARY) ./cmd/artifactapi
+	go build -ldflags="-s -w -X main.version=$(VERSION)" -o $(BINARY) ./cmd/artifactapi
 
 test: check-go
 	go test -race -count=1 ./pkg/... ./internal/...
@@ -28,6 +28,11 @@ fmt: check-go
 e2e: check-go
 	TESTCONTAINERS_RYUK_DISABLED=true go test -tags=e2e -race -count=1 -timeout=5m ./e2e/...
 
+# Build the container, bring up the full docker-compose stack + a mock upstream,
+# and run the black-box suite against the running product.
+docker-e2e: check-go
+	./scripts/docker-e2e.sh
+
 docker:
 	docker build -t artifactapi:$(VERSION) .
 

README.md

@@ -32,9 +32,150 @@ API: `http://localhost:8000` | Frontend: `http://localhost:5173`
 | `puppet` | `v3/modules/*`, `v3/releases*` | `.tar.gz` |
 | `terraform` | `*/versions` | `*/download/*/*` |
 | `goproxy` | `@v/list`, `@latest` | `.info`, `.mod`, `.zip` |
+| `github_rpm` | `repodata/*` (synthesized) | `.rpm` (redirected) |
 
 Providers classify paths automatically. Users only configure what to proxy and TTLs.
 
+### `github_rpm` — GitHub releases as a yum repo (metadata-only, no precache)
+
+A `github_rpm` remote turns a GitHub repo's **releases** into a real `dnf`/`yum`
+repository without ever caching the packages. It scans releases for `.rpm`
+assets, derives each package's metadata (NEVRA, requires/provides/conflicts/
+obsoletes, files, checksum) and **synthesizes `repodata/` on the fly**. Package
+metadata comes from a **ranged GET of just the RPM header** (the header sits at
+the front of the file, so the whole package is never downloaded); the sha256
+checksum comes from the GitHub asset `digest` when present, else a one-time
+lazy stream. Derived metadata is cached (keyed by asset) so repodata generation
+is served from primed DB rows, never a cold on-demand derive.
+
+Each package's `<location>` points back at the remote, which **302-redirects**
+the download to the `releases_remote` — an existing generic `github.com` remote
+that streams the actual bytes. `dnf` follows the redirect transparently.
+
+#### Background syncer
+
+A single process-wide **background syncer** keeps every `github_rpm` remote's
+derived metadata current off the client request path:
+
+- **Prime on create.** Creating a `github_rpm` remote enqueues a background prime
+  scan, so its metadata is derived right away without blocking the create call.
+  The first `dnf` request is served from cache. If a request arrives before the
+  prime lands, it returns a retryable `503` (with `Retry-After`) rather than
+  serving an empty repo or blocking on a multi-minute derive.
+- **Periodic re-check, driven by `mutable_ttl`.** Each remote is re-checked for
+  new or changed releases no more often than its `mutable_ttl`. New/changed
+  assets are derived incrementally; assets already cached are never re-fetched,
+  and assets that disappear upstream are pruned.
+- **ETag / 304 conditional requests.** The releases-list `ETag` is stored per
+  remote and sent as `If-None-Match`; a `304 Not Modified` means nothing changed
+  and the syncer derives nothing. GitHub does not count `304` conditional
+  responses against the rate limit, so an unchanged repo is nearly free — this is
+  the main lever keeping GitHub traffic low.
+- **Global rate limit.** Every GitHub call (releases list + each ranged asset
+  header GET) passes through a single token-bucket limiter **shared across all
+  remotes**, so GitHub is never hammered. Configure a token (`password`) on the
+  remote for the higher authenticated rate limit (~5000/hr vs ~60/hr
+  unauthenticated).
+- **Multi-replica coordination.** State is shared through the database. Before a
+  periodic scan a replica must atomically claim a per-remote lease
+  (`github_rpm_sync_state`: `last_synced_at`, `etag`, `sync_lease_owner`,
+  `sync_lease_expires`); only the winner scans. This bounds total GitHub load to
+  ~once per `mutable_ttl` regardless of replica count, and the shared `etag`
+  lets any replica issue the conditional request.
+
+```hcl
+# Backend that serves the actual .rpm bytes from github.com.
+resource "artifactapi_remote_generic" "github" {
+  name     = "github"
+  base_url = "https://github.com"
+  patterns = [
+    "acme/tools/releases/download/.*\\.rpm$", # allowlist the repo's release assets
+  ]
+}
+
+resource "artifactapi_remote_github_rpm" "acme-tools" {
+  name            = "acme-tools"
+  base_url        = "https://api.github.com/repos/acme/tools" # the releases API root
+  releases_remote = "github"                                  # backend for downloads
+  mutable_ttl     = 3600                                      # release re-scan interval
+
+  # Optional: restrict which release assets become packages (regex on filename).
+  patterns = [".*\\.x86_64\\.rpm$", ".*\\.noarch\\.rpm$"]
+
+  # Optional: a token for private repos / higher API rate limits.
+  # password = "ghp_..."
+}
+```
+
+`dnf` config: `baseurl=https://artifactapi.example/api/v1/remote/acme-tools`.
+The repo is multi-arch (no `$basearch` needed) — `dnf` selects matching packages
+from the synthesized metadata.
+
+### GitHub authentication
+
+Anonymous GitHub is capped at **60 requests/hour** and cannot read private
+repositories. Configure a **server-level GitHub credential** to raise the ceiling
+to roughly **5000 requests/hour** and to read private-repo release assets. The
+credential is a process-wide machine identity applied by default to *every*
+outbound GitHub request — the releases scan, the ranged asset-header fetches, and
+the generic-github byte proxy that streams private release assets.
+
+The credential is read from the environment (deliver it from a Vault or
+Kubernetes secret). It is **never** stored per-remote in the database, **never**
+returned by any API, and **never** logged. Configure **exactly one** mode.
+
+**Precedence.** A remote's own `username`/`password` credential still wins for
+that remote's requests; the server credential is the default for everything else.
+With no credential configured at all, requests stay anonymous (current behavior).
+Partial configuration (e.g. an App id with no private key) is a **startup error**
+— artifactapi fails closed rather than silently falling back to anonymous.
+
+Both modes share the syncer's single global rate limiter, so a token simply
+raises the effective GitHub ceiling; the default limiter settings stay safe.
+
+#### Mode 1 — Personal Access Token (minimum viable, recommended for free accounts)
+
+Set `GITHUB_TOKEN`. It is sent as `Authorization: Bearer <token>`.
+
+Recommended free-account setup — a **fine-grained PAT** scoped to just the target
+repositories:
+
+1. GitHub → *Settings → Developer settings → Personal access tokens →
+   Fine-grained tokens → Generate new token*.
+2. Limit *Repository access* to the specific repo(s) serving releases.
+3. Grant repository permissions **Contents: Read-only** and **Metadata:
+   Read-only** (Metadata is mandatory and auto-selected).
+
+A classic PAT with the `repo` scope also works but is broader than necessary.
+
+```bash
+GITHUB_TOKEN=github_pat_xxxxxxxx
+```
+
+#### Mode 2 — GitHub App installation token (proper machine identity)
+
+A GitHub App is not tied to a personal account and can be created and installed on
+free personal repos. artifactapi mints a short-lived RS256 **JWT** from the app
+private key, exchanges it at `POST /app/installations/{id}/access_tokens` for a
+~1-hour **installation access token**, caches that token, and refreshes it a few
+minutes before expiry (thread-safe, single-flighted).
+
+1. GitHub → *Settings → Developer settings → GitHub Apps → New GitHub App*.
+2. Under *Permissions → Repository permissions* grant **Contents: Read-only**
+   (Metadata: Read-only is implied).
+3. Generate a **private key** (downloads a PEM) and note the **App ID**.
+4. *Install* the App on the account and select the target repositories, then read
+   the **Installation ID** from the installation URL
+   (`.../settings/installations/<installation-id>`).
+
+```bash
+GITHUB_APP_ID=123456
+GITHUB_APP_INSTALLATION_ID=7654321
+GITHUB_APP_PRIVATE_KEY_PATH=/etc/artifactapi/github-app.pem
+# or inline PEM (e.g. mounted from a secret):
+# GITHUB_APP_PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----\n...\n-----END RSA PRIVATE KEY-----"
+```
+
 ## Terraform
 
 Remotes and virtuals are managed by Terraform. Each package type has its own resource:
@@ -89,6 +230,54 @@ resource "artifactapi_virtual" "helm" {
 
 Provider: [terraform-provider-artifactapi](../terraform-provider-artifactapi)
 
+### Serving providers as a registry
+
+A local `terraform` repo is a real provider registry: upload
+`terraform-provider-{type}_{version}_{os}_{arch}.zip` files under
+`{namespace}/{type}/`, and Terraform installs them from a bare source address —
+no `.terraformrc` mirror config:
+
+```hcl
+terraform {
+  required_providers {
+    artifactapi = {
+      source  = "artifactapi.k8s.syd1.au.unkin.net/<repo>/<type>"
+      version = "0.1.2"
+    }
+  }
+}
+```
+
+The Terraform *namespace* segment is the artifactapi repo name; the provider is
+matched by *type*. The registry serves service discovery
+(`/.well-known/terraform.json`), the `providers.v1` version/download endpoints,
+and a GPG-signed `SHA256SUMS` per the provider registry protocol.
+
+Signing needs a GPG key. By default artifactapi generates one on first start and
+stores it in the database (`signing_keys` table), so every replica shares it and
+there's nothing to provision. To bring your own key instead, point
+`TF_SIGNING_KEY_PATH` at an armored private key (optionally
+`TF_SIGNING_KEY_PASSPHRASE`), which takes precedence over the generated one.
+`TF_PROVIDER_PROTOCOLS` (default `5.0,6.0`) sets the advertised plugin protocols.
+
+### Local docker registry
+
+A local `docker` repo is a real container registry, not a mirror: it serves the
+Docker Registry HTTP API V2 for both push and pull, so any client (`docker`,
+`podman`, `skopeo`, `buildah`) can use it directly.
+
+```sh
+docker tag myapp:latest artifactapi.k8s.syd1.au.unkin.net/docker-internal/myapp:latest
+docker push        artifactapi.k8s.syd1.au.unkin.net/docker-internal/myapp:latest
+docker pull        artifactapi.k8s.syd1.au.unkin.net/docker-internal/myapp:latest
+```
+
+The first path segment after `/v2/` is the artifactapi repo name; the remainder
+is the image name. Blobs and manifests are stored through the shared
+content-addressable store (deduplicated by digest, reaped by GC once
+unreferenced); tags are mutable references and re-pushing a tag moves it. Blob
+uploads support both the monolithic and chunked (`POST`/`PATCH`/`PUT`) flows.
+
 ## Access Control
 
 | Field | Default | Behaviour |
@@ -149,6 +338,15 @@ S3 client supports MinIO, Ceph RGW, and AWS S3 (via minio-go).
 | `MINIO_BUCKET` | `artifacts` | S3 bucket |
 | `MINIO_SECURE` | `false` | Use HTTPS for S3 |
 | `MINIO_REGION` | | S3 region (AWS) |
+| `GITHUB_SYNC_RATE` | `1` | `github_rpm` syncer global GitHub request rate (req/s), shared across all remotes. `1`/s = 3600/hr, under an authenticated token's ~5000/hr; unauthenticated (~60/hr) relies on ETag/304 |
+| `GITHUB_SYNC_BURST` | `5` | Token-bucket burst for the shared limiter |
+| `GITHUB_SYNC_WORKERS` | `3` | Concurrent `github_rpm` scan workers |
+| `GITHUB_SYNC_POLL_INTERVAL` | `60` | Base scheduler tick in seconds; per-remote cadence is its `mutable_ttl`, enforced by the DB lease |
+| `GITHUB_TOKEN` | | Server-level GitHub PAT (fine-grained or classic), sent as `Authorization: Bearer`. Applies to every GitHub request; per-remote creds override it. See [GitHub authentication](#github-authentication) |
+| `GITHUB_APP_ID` | | GitHub App id (App auth mode; mutually exclusive with `GITHUB_TOKEN`) |
+| `GITHUB_APP_INSTALLATION_ID` | | GitHub App installation id |
+| `GITHUB_APP_PRIVATE_KEY` | | GitHub App private key, inline PEM |
+| `GITHUB_APP_PRIVATE_KEY_PATH` | | GitHub App private key, file path (alternative to inline PEM) |
 
 ## Development
 

cmd/artifactapi/main.go

@@ -13,6 +13,8 @@ import (
 	"git.unkin.net/unkin/artifactapi/internal/tui"
 )
 
+var version = "dev"
+
 func main() {
 	if len(os.Args) > 1 && os.Args[1] == "tui" {
 		endpoint := os.Getenv("ARTIFACTAPI_ENDPOINT")
@@ -42,7 +44,7 @@ func main() {
 	ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
 	defer cancel()
 
-	srv, err := server.New(cfg)
+	srv, err := server.New(cfg, version)
 	if err != nil {
 		slog.Error("failed to create server", "error", err)
 		os.Exit(1)

docker-compose.e2e.yml

@@ -0,0 +1,18 @@
+# Overlay for the dockerised end-to-end suite (scripts/docker-e2e.sh).
+# Adds a static mock upstream that the artifactapi container proxies, so the
+# caching tests are hermetic and need no internet access.
+services:
+  mockupstream:
+    image: nginx:alpine
+    volumes:
+      - ./e2e-docker/fixtures:/usr/share/nginx/html:ro,z
+    # No host port needed: only the artifactapi container talks to it, and the
+    # tests compare served bytes against the on-disk fixtures.
+
+  artifactapi:
+    # The host port is set via ARTIFACTAPI_PORT (see scripts/docker-e2e.sh),
+    # defaulting to 8000; the e2e run uses 8001 to avoid colliding with a
+    # locally-running instance.
+    depends_on:
+      mockupstream:
+        condition: service_started

docker-compose.yml

@@ -2,7 +2,7 @@ services:
   artifactapi:
     build: .
     ports:
-      - "8000:8000"
+      - "${ARTIFACTAPI_PORT:-8000}:8000"
     environment:
       LISTEN_ADDR: ":8000"
       DBHOST: postgres

e2e-docker/README.md

@@ -0,0 +1,39 @@
+# Dockerised end-to-end suite
+
+Black-box tests that run against a fully **containerised** artifactapi stack
+(built image + Postgres + Redis + MinIO) plus a static mock upstream. Unlike the
+in-process `e2e/` suite (testcontainers, server run in-process), these only speak
+HTTP to the running product, so they exercise the shipped container image.
+
+## Run
+
+```bash
+make docker-e2e          # build image, compose up, run suite, compose down
+```
+
+`scripts/docker-e2e.sh` builds and starts `docker-compose.yml` +
+`docker-compose.e2e.yml`, waits for `/health`, then runs
+`go test -tags=dockere2e ./e2e-docker/...` and tears everything down.
+
+The stack publishes artifactapi on host port **8001** (to avoid colliding with a
+local instance on 8000). Override with `ARTIFACTAPI_URL` to point the tests at an
+already-running stack.
+
+## Coverage
+
+- **Repository lifecycle** — add / change / delete for remote, local and virtual repos.
+- **Caching** — one immutable artifact per remote package type (generic, docker,
+  helm, pypi, npm, rpm, alpine, puppet, terraform, goproxy) proxied through the
+  mock upstream: first fetch `X-Artifact-Source: remote`, second `cache`, bytes
+  verified against the origin fixture.
+- **Local uploads** — generic (upload/download), pypi (wheel + generated `simple/`
+  index), rpm (real package + **automatic repodata** generation).
+- **Virtual repositories** — pypi simple-index merge and helm `index.yaml` merge
+  across two members.
+
+## Fixtures
+
+`fixtures/` is served by the mock upstream at its web root. Paths mirror each
+provider's upstream URL layout (e.g. `v2/...` for docker, `v1/providers/...` for
+terraform). The RPM under `fixtures/rpmrepo/Packages/` is a real package so the
+rpm provider can parse its metadata for repodata generation.

e2e-docker/caching_test.go

@@ -0,0 +1,76 @@
+//go:build dockere2e
+
+package e2edocker
+
+import (
+	"bytes"
+	"fmt"
+	"net/http"
+	"testing"
+)
+
+// TestCachingPerProvider proxies one immutable artifact for every remote
+// package type through the mock upstream and asserts: first fetch is served
+// from the remote, the second from cache, and the bytes match the origin.
+func TestCachingPerProvider(t *testing.T) {
+	cases := []struct {
+		pkgType string
+		// path is the request path under /api/v1/remote/<name>/. The provider
+		// derives the upstream URL from it (docker prepends /v2/, terraform
+		// prepends /v1/providers/), and the fixture lives at that resolved path.
+		path    string
+		fixture string
+	}{
+		{"generic", "blobs/hello.bin", "blobs/hello.bin"},
+		{"npm", "mypkg/-/mypkg-1.0.0.tgz", "mypkg/-/mypkg-1.0.0.tgz"},
+		{"helm", "charts/mychart-1.0.0.tgz", "charts/mychart-1.0.0.tgz"},
+		{"pypi", "packages/foo-1.0-py3-none-any.whl", "packages/foo-1.0-py3-none-any.whl"},
+		{"rpm", "rpmrepo/Packages/e2e-testpkg-1.0-1.noarch.rpm", "rpmrepo/Packages/e2e-testpkg-1.0-1.noarch.rpm"},
+		{"alpine", "alpine/x86_64/testpkg-1.0-r0.apk", "alpine/x86_64/testpkg-1.0-r0.apk"},
+		{"puppet", "puppet-releases/author-mod-1.0.0.tar.gz", "puppet-releases/author-mod-1.0.0.tar.gz"},
+		{"goproxy", "goproxy/example.com/mod/@v/v1.0.0.zip", "goproxy/example.com/mod/@v/v1.0.0.zip"},
+		{"terraform", "hashicorp/aws/download/pkg.zip", "v1/providers/hashicorp/aws/download/pkg.zip"},
+		{"docker", "library/testimg/blobs/blobdata", "v2/library/testimg/blobs/blobdata"},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.pkgType, func(t *testing.T) {
+			name := "cache-" + tc.pkgType
+			createRepo(t, fmt.Sprintf(`{
+				"name": %q,
+				"package_type": %q,
+				"repo_type": "remote",
+				"base_url": %q,
+				"stale_on_error": true
+			}`, name, tc.pkgType, mockUpstream()))
+			defer deleteRepo(t, name)
+
+			want := fixtureBytes(t, tc.fixture)
+			url := api("/api/v1/remote/" + name + "/" + tc.path)
+
+			// First fetch: from remote.
+			resp, body := doRequest(t, http.MethodGet, url, nil, "")
+			if resp.StatusCode != http.StatusOK {
+				t.Fatalf("first fetch: status %d: %s", resp.StatusCode, body)
+			}
+			if src := resp.Header.Get("X-Artifact-Source"); src != "remote" {
+				t.Fatalf("first fetch source = %q, want remote", src)
+			}
+			if !bytes.Equal(body, want) {
+				t.Fatalf("first fetch body mismatch: got %d bytes, want %d", len(body), len(want))
+			}
+
+			// Second fetch: from cache, identical bytes.
+			resp, body = doRequest(t, http.MethodGet, url, nil, "")
+			if resp.StatusCode != http.StatusOK {
+				t.Fatalf("second fetch: status %d: %s", resp.StatusCode, body)
+			}
+			if src := resp.Header.Get("X-Artifact-Source"); src != "cache" {
+				t.Fatalf("second fetch source = %q, want cache", src)
+			}
+			if !bytes.Equal(body, want) {
+				t.Fatalf("cached body mismatch: got %d bytes, want %d", len(body), len(want))
+			}
+		})
+	}
+}

e2e-docker/docker_local_test.go

@@ -0,0 +1,177 @@
+//go:build dockere2e
+
+package e2edocker
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+func digestOf(b []byte) string {
+	sum := sha256.Sum256(b)
+	return "sha256:" + hex.EncodeToString(sum[:])
+}
+
+// pushBlobMonolithic uploads a blob with POST (open session) then PUT?digest
+// (whole body) — the monolithic-after-POST flow.
+func pushBlobMonolithic(t *testing.T, repo, image string, blob []byte) {
+	t.Helper()
+	dgst := digestOf(blob)
+
+	resp, body := doRequest(t, http.MethodPost, api("/v2/"+repo+"/"+image+"/blobs/uploads/"), nil, "")
+	if resp.StatusCode != http.StatusAccepted {
+		t.Fatalf("start upload: status %d: %s", resp.StatusCode, body)
+	}
+	loc := resp.Header.Get("Location")
+	if loc == "" {
+		t.Fatalf("start upload: no Location header")
+	}
+
+	resp, body = doRequest(t, http.MethodPut, baseURL()+loc+"?digest="+dgst, blob, "application/octet-stream")
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("finish upload: status %d: %s", resp.StatusCode, body)
+	}
+	if got := resp.Header.Get("Docker-Content-Digest"); got != dgst {
+		t.Fatalf("finish upload: digest mismatch: got %q want %q", got, dgst)
+	}
+}
+
+// pushBlobChunked uploads a blob with POST then PATCH (body) then PUT?digest
+// (empty) — the chunked flow a real docker daemon uses.
+func pushBlobChunked(t *testing.T, repo, image string, blob []byte) {
+	t.Helper()
+	dgst := digestOf(blob)
+
+	resp, body := doRequest(t, http.MethodPost, api("/v2/"+repo+"/"+image+"/blobs/uploads/"), nil, "")
+	if resp.StatusCode != http.StatusAccepted {
+		t.Fatalf("start upload: status %d: %s", resp.StatusCode, body)
+	}
+	loc := resp.Header.Get("Location")
+
+	resp, body = doRequest(t, http.MethodPatch, baseURL()+loc, blob, "application/octet-stream")
+	if resp.StatusCode != http.StatusAccepted {
+		t.Fatalf("patch upload: status %d: %s", resp.StatusCode, body)
+	}
+	if got := resp.Header.Get("Range"); got != fmt.Sprintf("0-%d", len(blob)-1) {
+		t.Fatalf("patch upload: unexpected Range %q", got)
+	}
+	loc = resp.Header.Get("Location")
+
+	resp, body = doRequest(t, http.MethodPut, baseURL()+loc+"?digest="+dgst, nil, "")
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("finish upload: status %d: %s", resp.StatusCode, body)
+	}
+}
+
+// TestLocalDockerPushPull exercises a full container push and pull against a
+// local docker repo using the Docker Registry HTTP API V2, the way a docker
+// client would: upload the config and layer blobs, push the manifest under a
+// tag, then pull the manifest and blobs back byte-identically.
+func TestLocalDockerPushPull(t *testing.T) {
+	createRepo(t, `{"name":"docker-internal","package_type":"docker","repo_type":"local"}`)
+	defer deleteRepo(t, "docker-internal")
+
+	const image = "team/app"
+	const tag = "v1.0.0"
+
+	// /v2/ version check.
+	resp, _ := doRequest(t, http.MethodGet, api("/v2/"), nil, "")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("/v2/ ping: status %d", resp.StatusCode)
+	}
+
+	config := []byte(`{"architecture":"amd64","os":"linux","config":{},"rootfs":{"type":"layers","diff_ids":["sha256:0000000000000000000000000000000000000000000000000000000000000000"]}}`)
+	layer := bytes.Repeat([]byte("artifactapi-layer-data-"), 4096) // ~90 KB opaque layer
+
+	configDigest := digestOf(config)
+	layerDigest := digestOf(layer)
+
+	// A brand-new blob should be absent (this is the client's mount check).
+	resp, _ = doRequest(t, http.MethodHead, api("/v2/"+"docker-internal/"+image+"/blobs/"+configDigest), nil, "")
+	if resp.StatusCode != http.StatusNotFound {
+		t.Fatalf("pre-push blob HEAD: expected 404, got %d", resp.StatusCode)
+	}
+
+	pushBlobMonolithic(t, "docker-internal", image, config)
+	pushBlobChunked(t, "docker-internal", image, layer)
+
+	manifest := []byte(fmt.Sprintf(`{"schemaVersion":2,"mediaType":"application/vnd.docker.distribution.manifest.v2+json","config":{"mediaType":"application/vnd.docker.container.image.v1+json","size":%d,"digest":%q},"layers":[{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","size":%d,"digest":%q}]}`,
+		len(config), configDigest, len(layer), layerDigest))
+	manifestDigest := digestOf(manifest)
+	manifestType := "application/vnd.docker.distribution.manifest.v2+json"
+
+	resp, body := doRequest(t, http.MethodPut, api("/v2/docker-internal/"+image+"/manifests/"+tag), manifest, manifestType)
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("push manifest: status %d: %s", resp.StatusCode, body)
+	}
+	if got := resp.Header.Get("Docker-Content-Digest"); got != manifestDigest {
+		t.Fatalf("push manifest: digest %q want %q", got, manifestDigest)
+	}
+
+	// --- pull back ---
+
+	// Manifest by tag.
+	resp, body = doRequest(t, http.MethodGet, api("/v2/docker-internal/"+image+"/manifests/"+tag), nil, "")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("pull manifest by tag: status %d: %s", resp.StatusCode, body)
+	}
+	if !bytes.Equal(body, manifest) {
+		t.Fatalf("pulled manifest bytes differ from pushed")
+	}
+	if ct := resp.Header.Get("Content-Type"); ct != manifestType {
+		t.Fatalf("pulled manifest content-type %q want %q", ct, manifestType)
+	}
+	if got := resp.Header.Get("Docker-Content-Digest"); got != manifestDigest {
+		t.Fatalf("pulled manifest digest %q want %q", got, manifestDigest)
+	}
+
+	// Manifest by digest.
+	resp, body = doRequest(t, http.MethodGet, api("/v2/docker-internal/"+image+"/manifests/"+manifestDigest), nil, "")
+	if resp.StatusCode != http.StatusOK || !bytes.Equal(body, manifest) {
+		t.Fatalf("pull manifest by digest: status %d, equal=%v", resp.StatusCode, bytes.Equal(body, manifest))
+	}
+
+	// Blobs by digest.
+	for _, tc := range []struct {
+		name   string
+		digest string
+		want   []byte
+	}{
+		{"config", configDigest, config},
+		{"layer", layerDigest, layer},
+	} {
+		resp, body = doRequest(t, http.MethodGet, api("/v2/docker-internal/"+image+"/blobs/"+tc.digest), nil, "")
+		if resp.StatusCode != http.StatusOK {
+			t.Fatalf("pull %s blob: status %d", tc.name, resp.StatusCode)
+		}
+		if !bytes.Equal(body, tc.want) {
+			t.Fatalf("pulled %s blob bytes differ", tc.name)
+		}
+		if got := resp.Header.Get("Docker-Content-Digest"); got != tc.digest {
+			t.Fatalf("pulled %s blob digest %q want %q", tc.name, got, tc.digest)
+		}
+	}
+
+	// tags/list reflects the pushed tag.
+	resp, body = doRequest(t, http.MethodGet, api("/v2/docker-internal/"+image+"/tags/list"), nil, "")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("tags/list: status %d: %s", resp.StatusCode, body)
+	}
+	if !strings.Contains(string(body), `"`+tag+`"`) {
+		t.Fatalf("tags/list missing tag %q: %s", tag, body)
+	}
+	if !strings.Contains(string(body), `"docker-internal/`+image+`"`) {
+		t.Fatalf("tags/list wrong repository name: %s", body)
+	}
+
+	// A now-present blob HEAD should succeed (client would skip re-upload).
+	resp, _ = doRequest(t, http.MethodHead, api("/v2/docker-internal/"+image+"/blobs/"+layerDigest), nil, "")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("post-push blob HEAD: expected 200, got %d", resp.StatusCode)
+	}
+}

e2e-docker/fixtures/blobs/hello.bin

@@ -0,0 +1 @@
+hello artifactapi generic blob

e2e-docker/fixtures/helm-a/index.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+entries:
+  alpha:
+    - name: alpha
+      version: 1.0.0
+      urls:
+        - charts/alpha-1.0.0.tgz
+generated: "2026-01-01T00:00:00Z"

e2e-docker/fixtures/helm-b/index.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+entries:
+  beta:
+    - name: beta
+      version: 2.0.0
+      urls:
+        - charts/beta-2.0.0.tgz
+generated: "2026-01-01T00:00:00Z"

e2e-docker/helpers_test.go

@@ -0,0 +1,108 @@
+//go:build dockere2e
+
+// Package e2edocker holds the black-box end-to-end suite that runs against a
+// fully dockerised artifactapi stack (see scripts/docker-e2e.sh). Unlike the
+// in-process e2e suite, these tests only speak HTTP to the running container.
+package e2edocker
+
+import (
+	"bytes"
+	"io"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+)
+
+func baseURL() string {
+	if v := os.Getenv("ARTIFACTAPI_URL"); v != "" {
+		return strings.TrimRight(v, "/")
+	}
+	return "http://localhost:8000"
+}
+
+// mockUpstream is the base URL the artifactapi *container* uses to reach the
+// static mock upstream. It is resolved on the compose network, not the host.
+func mockUpstream() string {
+	if v := os.Getenv("MOCK_UPSTREAM_INTERNAL"); v != "" {
+		return strings.TrimRight(v, "/")
+	}
+	return "http://mockupstream"
+}
+
+func api(path string) string { return baseURL() + path }
+
+func fixtureBytes(t *testing.T, rel string) []byte {
+	t.Helper()
+	b, err := os.ReadFile(filepath.Join("fixtures", rel))
+	if err != nil {
+		t.Fatalf("read fixture %s: %v", rel, err)
+	}
+	return b
+}
+
+func doRequest(t *testing.T, method, url string, body []byte, contentType string) (*http.Response, []byte) {
+	t.Helper()
+	var r io.Reader
+	if body != nil {
+		r = bytes.NewReader(body)
+	}
+	req, err := http.NewRequest(method, url, r)
+	if err != nil {
+		t.Fatalf("%s %s: %v", method, url, err)
+	}
+	if contentType != "" {
+		req.Header.Set("Content-Type", contentType)
+	}
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("%s %s: %v", method, url, err)
+	}
+	defer resp.Body.Close()
+	respBody, _ := io.ReadAll(resp.Body)
+	return resp, respBody
+}
+
+func createRepo(t *testing.T, jsonBody string) {
+	t.Helper()
+	resp, body := doRequest(t, http.MethodPost, api("/api/v2/remotes"), []byte(jsonBody), "application/json")
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("create repo: status %d: %s", resp.StatusCode, body)
+	}
+}
+
+func deleteRepo(t *testing.T, name string) {
+	t.Helper()
+	doRequest(t, http.MethodDelete, api("/api/v2/remotes/"+name), nil, "")
+}
+
+func createVirtual(t *testing.T, jsonBody string) {
+	t.Helper()
+	resp, body := doRequest(t, http.MethodPost, api("/api/v2/virtuals"), []byte(jsonBody), "application/json")
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("create virtual: status %d: %s", resp.StatusCode, body)
+	}
+}
+
+func deleteVirtual(t *testing.T, name string) {
+	t.Helper()
+	doRequest(t, http.MethodDelete, api("/api/v2/virtuals/"+name), nil, "")
+}
+
+// getEventually retries a GET until it returns 200 or the deadline passes. Used
+// for asynchronously-generated artifacts (e.g. rpm repodata after upload).
+func getEventually(t *testing.T, url string, timeout time.Duration) (*http.Response, []byte) {
+	t.Helper()
+	deadline := time.Now().Add(timeout)
+	var resp *http.Response
+	var body []byte
+	for {
+		resp, body = doRequest(t, http.MethodGet, url, nil, "")
+		if resp.StatusCode == http.StatusOK || time.Now().After(deadline) {
+			return resp, body
+		}
+		time.Sleep(250 * time.Millisecond)
+	}
+}

e2e-docker/local_test.go

@@ -0,0 +1,93 @@
+//go:build dockere2e
+
+package e2edocker
+
+import (
+	"bytes"
+	"net/http"
+	"strings"
+	"testing"
+	"time"
+)
+
+func uploadFile(t *testing.T, repo, filePath string, body []byte, contentType string) {
+	t.Helper()
+	url := api("/api/v2/remotes/" + repo + "/files/" + filePath)
+	resp, respBody := doRequest(t, http.MethodPut, url, body, contentType)
+	if resp.StatusCode != http.StatusCreated {
+		t.Fatalf("upload %s: status %d: %s", filePath, resp.StatusCode, respBody)
+	}
+}
+
+// TestLocalGenericUpload uploads a generic file and downloads it back.
+func TestLocalGenericUpload(t *testing.T) {
+	createRepo(t, `{"name":"local-generic","package_type":"generic","repo_type":"local"}`)
+	defer deleteRepo(t, "local-generic")
+
+	content := []byte("artifactapi local generic upload payload")
+	uploadFile(t, "local-generic", "data/hello.bin", content, "application/octet-stream")
+
+	resp, body := doRequest(t, http.MethodGet, api("/api/v1/local/local-generic/data/hello.bin"), nil, "")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("download: status %d: %s", resp.StatusCode, body)
+	}
+	if !bytes.Equal(body, content) {
+		t.Fatalf("downloaded content mismatch")
+	}
+}
+
+// TestLocalPyPIUpload uploads a wheel and validates the generated simple index.
+func TestLocalPyPIUpload(t *testing.T) {
+	createRepo(t, `{"name":"local-pypi","package_type":"pypi","repo_type":"local"}`)
+	defer deleteRepo(t, "local-pypi")
+
+	wheel := fixtureBytes(t, "packages/foo-1.0-py3-none-any.whl")
+	uploadFile(t, "local-pypi", "foo-1.0-py3-none-any.whl", wheel, "application/zip")
+
+	// Root index lists the package.
+	resp, body := doRequest(t, http.MethodGet, api("/api/v1/local/local-pypi/simple/"), nil, "")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("simple index: status %d: %s", resp.StatusCode, body)
+	}
+	if !strings.Contains(string(body), "foo") {
+		t.Fatalf("simple index missing package 'foo': %s", body)
+	}
+
+	// Per-package index lists the wheel file.
+	resp, body = doRequest(t, http.MethodGet, api("/api/v1/local/local-pypi/simple/foo/"), nil, "")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("package index: status %d: %s", resp.StatusCode, body)
+	}
+	if !strings.Contains(string(body), "foo-1.0-py3-none-any.whl") {
+		t.Fatalf("package index missing wheel: %s", body)
+	}
+
+	// The wheel downloads back byte-identical.
+	resp, body = doRequest(t, http.MethodGet, api("/api/v1/local/local-pypi/foo/foo-1.0-py3-none-any.whl"), nil, "")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("download wheel: status %d: %s", resp.StatusCode, body)
+	}
+	if !bytes.Equal(body, wheel) {
+		t.Fatalf("wheel content mismatch")
+	}
+}
+
+// TestLocalRPMRepodata uploads a real RPM and validates that repodata is
+// generated automatically (the special rpm-local feature).
+func TestLocalRPMRepodata(t *testing.T) {
+	createRepo(t, `{"name":"local-rpm","package_type":"rpm","repo_type":"local"}`)
+	defer deleteRepo(t, "local-rpm")
+
+	rpm := fixtureBytes(t, "rpmrepo/Packages/e2e-testpkg-1.0-1.noarch.rpm")
+	uploadFile(t, "local-rpm", "e2e-testpkg-1.0-1.noarch.rpm", rpm, "application/x-rpm")
+
+	// repodata is generated asynchronously after upload; poll for it.
+	resp, body := getEventually(t, api("/api/v1/local/local-rpm/repodata/repomd.xml"), 15*time.Second)
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("repomd.xml: status %d: %s", resp.StatusCode, body)
+	}
+	s := string(body)
+	if !strings.Contains(s, "<repomd") || !strings.Contains(s, "primary") {
+		t.Fatalf("repomd.xml not a valid repodata document: %s", s)
+	}
+}

e2e-docker/repos_test.go

@@ -0,0 +1,134 @@
+//go:build dockere2e
+
+package e2edocker
+
+import (
+	"encoding/json"
+	"net/http"
+	"testing"
+)
+
+func TestHealth(t *testing.T) {
+	resp, body := doRequest(t, http.MethodGet, api("/health"), nil, "")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("health: status %d: %s", resp.StatusCode, body)
+	}
+}
+
+// TestRemoteLifecycle covers add/change/delete for a remote repository.
+func TestRemoteLifecycle(t *testing.T) {
+	createRepo(t, `{
+		"name": "crud-remote",
+		"package_type": "generic",
+		"repo_type": "remote",
+		"base_url": "https://example.com",
+		"mutable_ttl": 600,
+		"stale_on_error": true
+	}`)
+	defer deleteRepo(t, "crud-remote")
+
+	got := getRepo(t, "crud-remote")
+	if got["base_url"] != "https://example.com" || got["mutable_ttl"].(float64) != 600 {
+		t.Fatalf("unexpected created remote: %v", got)
+	}
+
+	// change
+	resp, body := doRequest(t, http.MethodPut, api("/api/v2/remotes/crud-remote"), []byte(`{
+		"package_type": "generic",
+		"base_url": "https://updated.example.com",
+		"mutable_ttl": 120,
+		"stale_on_error": true
+	}`), "application/json")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("update remote: status %d: %s", resp.StatusCode, body)
+	}
+	got = getRepo(t, "crud-remote")
+	if got["base_url"] != "https://updated.example.com" || got["mutable_ttl"].(float64) != 120 {
+		t.Fatalf("update not applied: %v", got)
+	}
+
+	// delete
+	resp, _ = doRequest(t, http.MethodDelete, api("/api/v2/remotes/crud-remote"), nil, "")
+	if resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("delete remote: status %d", resp.StatusCode)
+	}
+	resp, _ = doRequest(t, http.MethodGet, api("/api/v2/remotes/crud-remote"), nil, "")
+	if resp.StatusCode != http.StatusNotFound {
+		t.Fatalf("expected 404 after delete, got %d", resp.StatusCode)
+	}
+}
+
+// TestLocalLifecycle covers add/delete for a local repository.
+func TestLocalLifecycle(t *testing.T) {
+	createRepo(t, `{
+		"name": "crud-local",
+		"package_type": "generic",
+		"repo_type": "local"
+	}`)
+	defer deleteRepo(t, "crud-local")
+
+	got := getRepo(t, "crud-local")
+	if got["repo_type"] != "local" {
+		t.Fatalf("expected repo_type local, got %v", got["repo_type"])
+	}
+
+	resp, _ := doRequest(t, http.MethodDelete, api("/api/v2/remotes/crud-local"), nil, "")
+	if resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("delete local: status %d", resp.StatusCode)
+	}
+}
+
+// TestVirtualLifecycle covers add/change/delete for a virtual repository.
+func TestVirtualLifecycle(t *testing.T) {
+	createRepo(t, `{"name":"vmem-a","package_type":"helm","repo_type":"remote","base_url":"https://a.example.com","stale_on_error":true}`)
+	createRepo(t, `{"name":"vmem-b","package_type":"helm","repo_type":"remote","base_url":"https://b.example.com","stale_on_error":true}`)
+	defer deleteRepo(t, "vmem-a")
+	defer deleteRepo(t, "vmem-b")
+
+	createVirtual(t, `{
+		"name": "crud-virtual",
+		"package_type": "helm",
+		"members": ["vmem-a"]
+	}`)
+	defer deleteVirtual(t, "crud-virtual")
+
+	// change members
+	resp, body := doRequest(t, http.MethodPut, api("/api/v2/virtuals/crud-virtual"), []byte(`{
+		"package_type": "helm",
+		"members": ["vmem-a", "vmem-b"]
+	}`), "application/json")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("update virtual: status %d: %s", resp.StatusCode, body)
+	}
+
+	resp, body = doRequest(t, http.MethodGet, api("/api/v2/virtuals/crud-virtual"), nil, "")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("get virtual: status %d: %s", resp.StatusCode, body)
+	}
+	var v map[string]any
+	if err := json.Unmarshal(body, &v); err != nil {
+		t.Fatalf("decode virtual: %v", err)
+	}
+	members, _ := v["members"].([]any)
+	if len(members) != 2 {
+		t.Fatalf("expected 2 members after update, got %v", v["members"])
+	}
+
+	resp, _ = doRequest(t, http.MethodDelete, api("/api/v2/virtuals/crud-virtual"), nil, "")
+	if resp.StatusCode != http.StatusNoContent {
+		t.Fatalf("delete virtual: status %d", resp.StatusCode)
+	}
+}
+
+func getRepo(t *testing.T, name string) map[string]any {
+	t.Helper()
+	resp, body := doRequest(t, http.MethodGet, api("/api/v2/remotes/"+name), nil, "")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("get remote %s: status %d: %s", name, resp.StatusCode, body)
+	}
+	var m map[string]any
+	if err := json.Unmarshal(body, &m); err != nil {
+		t.Fatalf("decode remote %s: %v", name, err)
+	}
+	return m
+}

e2e-docker/virtual_test.go

@@ -0,0 +1,54 @@
+//go:build dockere2e
+
+package e2edocker
+
+import (
+	"net/http"
+	"strings"
+	"testing"
+)
+
+// TestVirtualPyPIMerge uploads different packages to two pypi locals and
+// checks that a virtual over them serves a merged simple index.
+func TestVirtualPyPIMerge(t *testing.T) {
+	createRepo(t, `{"name":"pmerge-a","package_type":"pypi","repo_type":"local"}`)
+	createRepo(t, `{"name":"pmerge-b","package_type":"pypi","repo_type":"local"}`)
+	defer deleteRepo(t, "pmerge-a")
+	defer deleteRepo(t, "pmerge-b")
+
+	uploadFile(t, "pmerge-a", "foo-1.0-py3-none-any.whl", fixtureBytes(t, "packages/foo-1.0-py3-none-any.whl"), "application/zip")
+	uploadFile(t, "pmerge-b", "bar-2.0-py3-none-any.whl", []byte("bar wheel payload"), "application/zip")
+
+	createVirtual(t, `{"name":"pmerge-v","package_type":"pypi","members":["pmerge-a","pmerge-b"]}`)
+	defer deleteVirtual(t, "pmerge-v")
+
+	resp, body := doRequest(t, http.MethodGet, api("/api/v1/virtual/pmerge-v/simple/"), nil, "")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("virtual simple index: status %d: %s", resp.StatusCode, body)
+	}
+	s := string(body)
+	if !strings.Contains(s, "foo") || !strings.Contains(s, "bar") {
+		t.Fatalf("merged index missing a member package (want foo and bar): %s", s)
+	}
+}
+
+// TestVirtualHelmMerge points two helm remotes at mock index.yaml documents
+// with distinct charts and checks the virtual merges both into one index.
+func TestVirtualHelmMerge(t *testing.T) {
+	createRepo(t, `{"name":"hmerge-a","package_type":"helm","repo_type":"remote","base_url":"`+mockUpstream()+`/helm-a","stale_on_error":true}`)
+	createRepo(t, `{"name":"hmerge-b","package_type":"helm","repo_type":"remote","base_url":"`+mockUpstream()+`/helm-b","stale_on_error":true}`)
+	defer deleteRepo(t, "hmerge-a")
+	defer deleteRepo(t, "hmerge-b")
+
+	createVirtual(t, `{"name":"hmerge-v","package_type":"helm","members":["hmerge-a","hmerge-b"]}`)
+	defer deleteVirtual(t, "hmerge-v")
+
+	resp, body := doRequest(t, http.MethodGet, api("/api/v1/virtual/hmerge-v/index.yaml"), nil, "")
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("virtual index.yaml: status %d: %s", resp.StatusCode, body)
+	}
+	s := string(body)
+	if !strings.Contains(s, "alpha") || !strings.Contains(s, "beta") {
+		t.Fatalf("merged helm index missing a member chart (want alpha and beta): %s", s)
+	}
+}

e2e/e2e_test.go

@@ -95,7 +95,7 @@ func TestMain(m *testing.M) {
 	}
 	cfg.ListenAddr = "127.0.0.1:0"
 
-	srv, err := server.New(cfg)
+	srv, err := server.New(cfg, "e2e-test")
 	if err != nil {
 		log.Fatalf("server: %v", err)
 	}

e2e/management_test.go

@@ -24,6 +24,30 @@ func TestRoot(t *testing.T) {
 	}
 }
 
+func TestRemoteUpstreamTimeouts(t *testing.T) {
+	createRemote(t, `{
+		"name": "timeout-test",
+		"package_type": "generic",
+		"base_url": "https://example.com",
+		"stale_on_error": true,
+		"upstream_dial_timeout": 3,
+		"upstream_tls_timeout": 4,
+		"upstream_response_header_timeout": 5
+	}`)
+	defer deleteRemote(t, "timeout-test")
+
+	remote := getJSON(t, apiURL("/api/v2/remotes/timeout-test"))
+	for field, want := range map[string]float64{
+		"upstream_dial_timeout":            3,
+		"upstream_tls_timeout":             4,
+		"upstream_response_header_timeout": 5,
+	} {
+		if got, _ := remote[field].(float64); got != want {
+			t.Errorf("%s: got %v, want %v", field, remote[field], want)
+		}
+	}
+}
+
 func TestRemoteCRUD(t *testing.T) {
 	createRemote(t, `{
 		"name": "test-generic",

e2e/proxy_test.go

@@ -24,6 +24,39 @@ func TestProxyBlocklist(t *testing.T) {
 	assertStatus(t, apiURL("/api/v1/remote/blocklist-test/malware.exe"), http.StatusForbidden)
 }
 
+func TestProxyHeadBlocklist(t *testing.T) {
+	createRemote(t, `{
+		"name": "head-block-test",
+		"package_type": "generic",
+		"base_url": "https://example.com",
+		"blocklist": ["\\.exe$"],
+		"stale_on_error": true
+	}`)
+	defer deleteRemote(t, "head-block-test")
+
+	req, _ := http.NewRequest(http.MethodHead, apiURL("/v2/head-block-test/malware.exe"), nil)
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("HEAD: %v", err)
+	}
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusForbidden {
+		t.Fatalf("HEAD blocklisted path: got %d, want 403", resp.StatusCode)
+	}
+}
+
+func TestProxyHeadUnknownRemote(t *testing.T) {
+	req, _ := http.NewRequest(http.MethodHead, apiURL("/v2/nonexistent/some/path"), nil)
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatalf("HEAD: %v", err)
+	}
+	resp.Body.Close()
+	if resp.StatusCode != http.StatusNotFound {
+		t.Fatalf("HEAD unknown remote: got %d, want 404", resp.StatusCode)
+	}
+}
+
 func TestProxyPatterns(t *testing.T) {
 	createRemote(t, `{
 		"name": "patterns-test",

go.mod

@@ -3,15 +3,19 @@ module git.unkin.net/unkin/artifactapi
 go 1.25.9
 
 require (
+	github.com/cavaliergopher/rpm v1.3.0
 	github.com/charmbracelet/bubbletea v1.3.10
 	github.com/charmbracelet/lipgloss v1.1.0
 	github.com/go-chi/chi/v5 v5.3.0
+	github.com/google/uuid v1.6.0
 	github.com/jackc/pgx/v5 v5.10.0
 	github.com/minio/minio-go/v7 v7.2.0
 	github.com/redis/go-redis/v9 v9.20.0
 	github.com/testcontainers/testcontainers-go v0.42.0
 	github.com/testcontainers/testcontainers-go/modules/postgres v0.42.0
 	github.com/testcontainers/testcontainers-go/modules/redis v0.42.0
+	golang.org/x/crypto v0.51.0
+	golang.org/x/time v0.15.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -44,7 +48,6 @@ require (
 	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-ole/go-ole v1.2.6 // indirect
-	github.com/google/uuid v1.6.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
@@ -95,7 +98,6 @@ require (
 	go.opentelemetry.io/otel/trace v1.41.0 // indirect
 	go.uber.org/atomic v1.11.0 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/crypto v0.51.0 // indirect
 	golang.org/x/net v0.53.0 // indirect
 	golang.org/x/sync v0.20.0 // indirect
 	golang.org/x/sys v0.44.0 // indirect

go.sum

@@ -12,6 +12,8 @@ github.com/bsm/ginkgo/v2 v2.12.0 h1:Ny8MWAHyOepLGlLKYmXG4IEkioBysk6GpaRTLC8zwWs=
 github.com/bsm/ginkgo/v2 v2.12.0/go.mod h1:SwYbGRRDovPVboqFv0tPTcG1sN61LM1Z4ARdbAV9g4c=
 github.com/bsm/gomega v1.27.10 h1:yeMWxP2pV2fG3FgAODIY8EiRE3dy0aeFYt4l7wh6yKA=
 github.com/bsm/gomega v1.27.10/go.mod h1:JyEr/xRbxbtgWNi8tIEVPUYZ5Dzef52k01W3YH0H+O0=
+github.com/cavaliergopher/rpm v1.3.0 h1:UHX46sasX8MesUXXQ+UbkFLUX4eUWTlEcX8jcnRBIgI=
+github.com/cavaliergopher/rpm v1.3.0/go.mod h1:vEumo1vvtrHM1Ov86f6+k8j7zNKOxQfHDCAIcR/36ZI=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
@@ -232,6 +234,8 @@ golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
 golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
 golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
 golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=

internal/api/terraform/registry.go

@@ -0,0 +1,301 @@
+// Package terraform serves local terraform repos as a real Terraform provider
+// registry: service discovery, version listing, and GPG-signed downloads, so
+// `terraform init` installs from a bare source address with no client config.
+package terraform
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"path"
+	"sort"
+	"strings"
+
+	"github.com/go-chi/chi/v5"
+
+	"git.unkin.net/unkin/artifactapi/internal/database"
+	tfprov "git.unkin.net/unkin/artifactapi/internal/provider/terraform"
+	"git.unkin.net/unkin/artifactapi/internal/tfsign"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+// ProvidersV1Path is the base the service-discovery document advertises (Terraform
+// appends "{namespace}/{type}/versions" etc). MountPath is the same prefix without
+// the trailing slash, for chi.Mount.
+const (
+	ProvidersV1Path = "/terraform/v1/providers/"
+	MountPath       = "/terraform/v1/providers"
+)
+
+type Handler struct {
+	db        *database.DB
+	signer    *tfsign.Signer
+	protocols []string
+}
+
+func NewHandler(db *database.DB, signer *tfsign.Signer, protocols string) *Handler {
+	var protos []string
+	for _, p := range strings.Split(protocols, ",") {
+		if p = strings.TrimSpace(p); p != "" {
+			protos = append(protos, p)
+		}
+	}
+	if len(protos) == 0 {
+		protos = []string{"5.0", "6.0"}
+	}
+	return &Handler{db: db, signer: signer, protocols: protos}
+}
+
+// Enabled reports whether a signing key is configured. Without one the registry
+// cannot produce the signed SHA256SUMS the protocol requires, so it stays off.
+func (h *Handler) Enabled() bool { return h.signer != nil }
+
+func (h *Handler) Routes() chi.Router {
+	r := chi.NewRouter()
+	r.Get("/{namespace}/{type}/versions", h.versions)
+	r.Get("/{namespace}/{type}/{version}/download/{os}/{arch}", h.download)
+	r.Get("/{namespace}/{type}/{version}/sha256sums", h.sha256sums)
+	r.Get("/{namespace}/{type}/{version}/sha256sums.sig", h.sha256sumsSig)
+	return r
+}
+
+// ServiceDiscovery answers /.well-known/terraform.json, pointing Terraform at the
+// providers.v1 protocol base.
+func (h *Handler) ServiceDiscovery(w http.ResponseWriter, r *http.Request) {
+	if !h.Enabled() {
+		http.NotFound(w, r)
+		return
+	}
+	writeJSON(w, map[string]string{"providers.v1": ProvidersV1Path})
+}
+
+// providerFile is one resolved platform artifact within a repo.
+type providerFile struct {
+	version  string
+	os       string
+	arch     string
+	filePath string // path within the repo, e.g. unkin/artifactapi/...zip
+	sha256   string // hex, no "sha256:" prefix
+}
+
+// resolve finds every provider zip of the given type in the repo (namespace).
+// The Terraform source namespace maps to the artifactapi repo name; the provider
+// is matched by type across whatever in-repo folder it was uploaded under.
+func (h *Handler) resolve(r *http.Request, namespace, typeName string) ([]providerFile, error) {
+	remote, err := h.db.GetRemote(r.Context(), namespace)
+	if err != nil || remote.PackageType != models.PackageTerraform {
+		return nil, nil
+	}
+
+	rows, err := h.db.ListLocalFiles(r.Context(), namespace, 10000, 0)
+	if err != nil {
+		return nil, err
+	}
+
+	var out []providerFile
+	for _, row := range rows {
+		parsed := tfprov.ParseProviderZip(path.Base(row.FilePath))
+		if !parsed.Ok || parsed.Type != typeName {
+			continue
+		}
+		out = append(out, providerFile{
+			version:  parsed.Version,
+			os:       parsed.OS,
+			arch:     parsed.Arch,
+			filePath: row.FilePath,
+			sha256:   strings.TrimPrefix(row.ContentHash, "sha256:"),
+		})
+	}
+	return out, nil
+}
+
+func (h *Handler) versions(w http.ResponseWriter, r *http.Request) {
+	if !h.Enabled() {
+		http.NotFound(w, r)
+		return
+	}
+	namespace := chi.URLParam(r, "namespace")
+	typeName := chi.URLParam(r, "type")
+
+	files, err := h.resolve(r, namespace, typeName)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	if len(files) == 0 {
+		http.NotFound(w, r)
+		return
+	}
+
+	// Group platforms by version, de-duplicated and stably ordered.
+	type platform struct {
+		OS   string `json:"os"`
+		Arch string `json:"arch"`
+	}
+	platforms := map[string]map[string]platform{}
+	for _, f := range files {
+		if platforms[f.version] == nil {
+			platforms[f.version] = map[string]platform{}
+		}
+		platforms[f.version][f.os+"_"+f.arch] = platform{OS: f.os, Arch: f.arch}
+	}
+
+	type versionEntry struct {
+		Version   string     `json:"version"`
+		Protocols []string   `json:"protocols"`
+		Platforms []platform `json:"platforms"`
+	}
+	out := struct {
+		Versions []versionEntry `json:"versions"`
+	}{}
+	for version, plats := range platforms {
+		entry := versionEntry{Version: version, Protocols: h.protocols}
+		for _, p := range plats {
+			entry.Platforms = append(entry.Platforms, p)
+		}
+		sort.Slice(entry.Platforms, func(i, j int) bool {
+			return entry.Platforms[i].OS+entry.Platforms[i].Arch < entry.Platforms[j].OS+entry.Platforms[j].Arch
+		})
+		out.Versions = append(out.Versions, entry)
+	}
+	sort.Slice(out.Versions, func(i, j int) bool { return out.Versions[i].Version < out.Versions[j].Version })
+
+	writeJSON(w, out)
+}
+
+func (h *Handler) download(w http.ResponseWriter, r *http.Request) {
+	if !h.Enabled() {
+		http.NotFound(w, r)
+		return
+	}
+	namespace := chi.URLParam(r, "namespace")
+	typeName := chi.URLParam(r, "type")
+	version := chi.URLParam(r, "version")
+	osName := chi.URLParam(r, "os")
+	arch := chi.URLParam(r, "arch")
+
+	files, err := h.resolve(r, namespace, typeName)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+
+	var match *providerFile
+	for i := range files {
+		if files[i].version == version && files[i].os == osName && files[i].arch == arch {
+			match = &files[i]
+			break
+		}
+	}
+	if match == nil {
+		http.NotFound(w, r)
+		return
+	}
+
+	base := baseURL(r)
+	verBase := fmt.Sprintf("%s%s/%s/%s", base+ProvidersV1Path, namespace, typeName, version)
+
+	type gpgKey struct {
+		KeyID      string `json:"key_id"`
+		ASCIIArmor string `json:"ascii_armor"`
+	}
+	resp := struct {
+		Protocols           []string `json:"protocols"`
+		OS                  string   `json:"os"`
+		Arch                string   `json:"arch"`
+		Filename            string   `json:"filename"`
+		DownloadURL         string   `json:"download_url"`
+		SHASumsURL          string   `json:"shasums_url"`
+		SHASumsSignatureURL string   `json:"shasums_signature_url"`
+		SHASum              string   `json:"shasum"`
+		SigningKeys         struct {
+			GPGPublicKeys []gpgKey `json:"gpg_public_keys"`
+		} `json:"signing_keys"`
+	}{
+		Protocols:           h.protocols,
+		OS:                  match.os,
+		Arch:                match.arch,
+		Filename:            path.Base(match.filePath),
+		DownloadURL:         fmt.Sprintf("%s/api/v1/local/%s/%s", base, namespace, match.filePath),
+		SHASumsURL:          verBase + "/sha256sums",
+		SHASumsSignatureURL: verBase + "/sha256sums.sig",
+		SHASum:              match.sha256,
+	}
+	resp.SigningKeys.GPGPublicKeys = []gpgKey{{
+		KeyID:      h.signer.KeyID(),
+		ASCIIArmor: h.signer.PublicKeyArmor(),
+	}}
+
+	writeJSON(w, resp)
+}
+
+func (h *Handler) sha256sums(w http.ResponseWriter, r *http.Request) {
+	sums, ok := h.buildSums(w, r)
+	if !ok {
+		return
+	}
+	w.Header().Set("Content-Type", "text/plain; charset=utf-8")
+	w.Write(sums)
+}
+
+func (h *Handler) sha256sumsSig(w http.ResponseWriter, r *http.Request) {
+	sums, ok := h.buildSums(w, r)
+	if !ok {
+		return
+	}
+	sig, err := h.signer.Sign(sums)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	w.Header().Set("Content-Type", "application/octet-stream")
+	w.Write(sig)
+}
+
+// buildSums renders the SHA256SUMS body for one version: one "<hex>  <filename>"
+// line per platform zip, sorted by filename so the signed bytes are stable.
+func (h *Handler) buildSums(w http.ResponseWriter, r *http.Request) ([]byte, bool) {
+	if !h.Enabled() {
+		http.NotFound(w, r)
+		return nil, false
+	}
+	namespace := chi.URLParam(r, "namespace")
+	typeName := chi.URLParam(r, "type")
+	version := chi.URLParam(r, "version")
+
+	files, err := h.resolve(r, namespace, typeName)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return nil, false
+	}
+
+	var lines []string
+	for _, f := range files {
+		if f.version != version {
+			continue
+		}
+		lines = append(lines, fmt.Sprintf("%s  %s", f.sha256, path.Base(f.filePath)))
+	}
+	if len(lines) == 0 {
+		http.NotFound(w, r)
+		return nil, false
+	}
+	sort.Strings(lines)
+	return []byte(strings.Join(lines, "\n") + "\n"), true
+}
+
+func writeJSON(w http.ResponseWriter, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	json.NewEncoder(w).Encode(v)
+}
+
+func baseURL(r *http.Request) string {
+	scheme := "http"
+	if r.TLS != nil {
+		scheme = "https"
+	}
+	if fwd := r.Header.Get("X-Forwarded-Proto"); fwd != "" {
+		scheme = fwd
+	}
+	return scheme + "://" + r.Host
+}

internal/api/terraform/registry_test.go

@@ -0,0 +1,186 @@
+package terraform
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"golang.org/x/crypto/openpgp"
+	"golang.org/x/crypto/openpgp/armor"
+
+	"git.unkin.net/unkin/artifactapi/internal/database"
+	"git.unkin.net/unkin/artifactapi/internal/testsupport"
+	"git.unkin.net/unkin/artifactapi/internal/tfsign"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+var testDSN string
+
+func TestMain(m *testing.M) {
+	ctx := context.Background()
+	dsn, terminate, err := testsupport.StartPostgres(ctx)
+	if err != nil {
+		os.Exit(m.Run())
+	}
+	testDSN = dsn
+	code := m.Run()
+	terminate()
+	os.Exit(code)
+}
+
+// testSigner writes a throwaway armored key and loads it.
+func testSigner(t *testing.T) *tfsign.Signer {
+	t.Helper()
+	e, err := openpgp.NewEntity("artifactapi test", "tf", "tf@example.com", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var buf bytes.Buffer
+	w, _ := armor.Encode(&buf, openpgp.PrivateKeyType, nil)
+	if err := e.SerializePrivate(w, nil); err != nil {
+		t.Fatal(err)
+	}
+	w.Close()
+	p := filepath.Join(t.TempDir(), "private-key.asc")
+	if err := os.WriteFile(p, buf.Bytes(), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	s, err := tfsign.Load(p, "")
+	if err != nil {
+		t.Fatal(err)
+	}
+	return s
+}
+
+func TestProviderRegistryFlow(t *testing.T) {
+	if testDSN == "" {
+		t.Skip("Docker unavailable")
+	}
+	ctx := context.Background()
+	db, err := database.New(testDSN)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+
+	const repo = "tf-reg" // Terraform namespace == repo name
+	const filePath = "unkin/artifactapi/terraform-provider-artifactapi_1.2.3_linux_amd64.zip"
+	const hash = "sha256:983cdb25cb7b976538e4334d26e52dee5f44749b9be1500c760cf5cf66be659b"
+	const wantSha = "983cdb25cb7b976538e4334d26e52dee5f44749b9be1500c760cf5cf66be659b"
+
+	if err := db.CreateRemote(ctx, &models.Remote{Name: repo, PackageType: models.PackageTerraform, RepoType: models.RepoTypeLocal}); err != nil {
+		t.Fatal(err)
+	}
+	if err := db.UpsertBlob(ctx, hash, "blobs/98/3c", 6381007, "application/zip"); err != nil {
+		t.Fatal(err)
+	}
+	if err := db.CreateLocalFile(ctx, repo, filePath, hash); err != nil {
+		t.Fatal(err)
+	}
+
+	signer := testSigner(t)
+	h := NewHandler(db, signer, "5.0,6.0")
+	router := chi.NewRouter()
+	router.Get("/.well-known/terraform.json", h.ServiceDiscovery)
+	router.Mount(MountPath, h.Routes())
+
+	get := func(p string) *httptest.ResponseRecorder {
+		req := httptest.NewRequest("GET", p, nil)
+		w := httptest.NewRecorder()
+		router.ServeHTTP(w, req)
+		return w
+	}
+
+	// Service discovery.
+	w := get("/.well-known/terraform.json")
+	if w.Code != 200 {
+		t.Fatalf("discovery = %d", w.Code)
+	}
+	var disc map[string]string
+	json.Unmarshal(w.Body.Bytes(), &disc)
+	if disc["providers.v1"] != ProvidersV1Path {
+		t.Errorf("providers.v1 = %q", disc["providers.v1"])
+	}
+
+	// Versions.
+	w = get("/terraform/v1/providers/tf-reg/artifactapi/versions")
+	if w.Code != 200 {
+		t.Fatalf("versions = %d %s", w.Code, w.Body)
+	}
+	var vresp struct {
+		Versions []struct {
+			Version   string              `json:"version"`
+			Protocols []string            `json:"protocols"`
+			Platforms []map[string]string `json:"platforms"`
+		} `json:"versions"`
+	}
+	json.Unmarshal(w.Body.Bytes(), &vresp)
+	if len(vresp.Versions) != 1 || vresp.Versions[0].Version != "1.2.3" {
+		t.Fatalf("unexpected versions: %+v", vresp)
+	}
+	if len(vresp.Versions[0].Platforms) != 1 || vresp.Versions[0].Platforms[0]["os"] != "linux" {
+		t.Fatalf("unexpected platforms: %+v", vresp.Versions[0].Platforms)
+	}
+
+	// Download.
+	w = get("/terraform/v1/providers/tf-reg/artifactapi/1.2.3/download/linux/amd64")
+	if w.Code != 200 {
+		t.Fatalf("download = %d %s", w.Code, w.Body)
+	}
+	var dl struct {
+		Filename            string `json:"filename"`
+		DownloadURL         string `json:"download_url"`
+		SHASumsURL          string `json:"shasums_url"`
+		SHASumsSignatureURL string `json:"shasums_signature_url"`
+		SHASum              string `json:"shasum"`
+		SigningKeys         struct {
+			GPGPublicKeys []struct {
+				KeyID      string `json:"key_id"`
+				ASCIIArmor string `json:"ascii_armor"`
+			} `json:"gpg_public_keys"`
+		} `json:"signing_keys"`
+	}
+	json.Unmarshal(w.Body.Bytes(), &dl)
+	if dl.SHASum != wantSha {
+		t.Errorf("shasum = %q", dl.SHASum)
+	}
+	wantURL := "http://example.com/api/v1/local/tf-reg/" + filePath
+	if dl.DownloadURL != wantURL {
+		t.Errorf("download_url = %q, want %q", dl.DownloadURL, wantURL)
+	}
+	if len(dl.SigningKeys.GPGPublicKeys) != 1 || dl.SigningKeys.GPGPublicKeys[0].KeyID != signer.KeyID() {
+		t.Errorf("signing key mismatch: %+v", dl.SigningKeys)
+	}
+
+	// SHA256SUMS + signature verify against the advertised key.
+	sums := get("/terraform/v1/providers/tf-reg/artifactapi/1.2.3/sha256sums")
+	wantLine := wantSha + "  terraform-provider-artifactapi_1.2.3_linux_amd64.zip\n"
+	if sums.Body.String() != wantLine {
+		t.Errorf("sha256sums = %q, want %q", sums.Body.String(), wantLine)
+	}
+	sig := get("/terraform/v1/providers/tf-reg/artifactapi/1.2.3/sha256sums.sig")
+	keyring, err := openpgp.ReadArmoredKeyRing(bytes.NewReader([]byte(dl.SigningKeys.GPGPublicKeys[0].ASCIIArmor)))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, err := openpgp.CheckDetachedSignature(keyring, bytes.NewReader(sums.Body.Bytes()), bytes.NewReader(sig.Body.Bytes())); err != nil {
+		t.Errorf("sha256sums.sig did not verify: %v", err)
+	}
+}
+
+func TestRegistryDisabledWithoutSigner(t *testing.T) {
+	h := NewHandler(nil, nil, "")
+	router := chi.NewRouter()
+	router.Get("/.well-known/terraform.json", h.ServiceDiscovery)
+	req := httptest.NewRequest("GET", "/.well-known/terraform.json", nil)
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+	if w.Code != 404 {
+		t.Errorf("disabled discovery = %d, want 404", w.Code)
+	}
+}

internal/api/v1/docker.go

@@ -0,0 +1,486 @@
+package v1
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"os"
+	"sort"
+	"strings"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+
+	"git.unkin.net/unkin/artifactapi/internal/database"
+	"git.unkin.net/unkin/artifactapi/internal/storage"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+// This file implements the write half of the Docker Registry HTTP API V2 for
+// *local* docker repositories, so a `docker push` / `docker pull` against
+// artifactapi treats a local docker repo as a genuine registry (matching the
+// project's "local repos are the real thing" principle) rather than a mirror.
+//
+// Storage reuses the existing content-addressable primitives:
+//   - blob and manifest bytes are stored via the CAS (deduplicated by sha256)
+//   - a local_files row per (repo, "<image>/blobs/<digest>") and
+//     (repo, "<image>/manifests/<ref>") keeps the blob referenced so the GC
+//     does not reap it, and lets pulls resolve a reference back to a blob.
+// Tags are mutable references (UpsertLocalFile); digests and blobs are
+// immutable (CreateLocalFile, tolerating an already-exists on re-push).
+
+const dockerAPIVersionHeader = "registry/2.0"
+
+// Chunked blob uploads are staged in object storage under uploads/<uuid> rather
+// than in process memory, so the POST / PATCH / PUT of a single push can each be
+// served by a different replica (the API runs with minReplicas>1 and no session
+// affinity). The upload UUID travels in the Location URL handed back to the
+// client, so any replica reconstructs the staging key with no shared in-process
+// state. Abandoned stages are dropped by the GC's uploads sweep.
+func uploadKey(id string) string { return "uploads/" + id }
+
+var errUploadUnknown = errors.New("unknown upload")
+
+// appendUpload appends a chunk to the staged upload object and returns the new
+// total size. The staged bytes live entirely in object storage (download,
+// append to a per-request temp file, re-upload), which keeps the session state
+// replica-independent. Docker sends the whole layer in one PATCH, so this is a
+// single append in the common case.
+func (h *ProxyHandler) appendUpload(ctx context.Context, id string, chunk io.Reader) (int64, error) {
+	key := uploadKey(id)
+	reader, info, err := h.store.Download(ctx, key)
+	if err != nil {
+		return 0, errUploadUnknown
+	}
+
+	tmp, err := os.CreateTemp("", "docker-upload-*")
+	if err != nil {
+		reader.Close()
+		return 0, err
+	}
+	defer os.Remove(tmp.Name())
+	defer tmp.Close()
+
+	if _, err := io.Copy(tmp, reader); err != nil {
+		reader.Close()
+		return 0, err
+	}
+	reader.Close()
+
+	n, err := io.Copy(tmp, chunk)
+	if err != nil {
+		return 0, err
+	}
+	size := info.Size + n
+	if _, err := tmp.Seek(0, io.SeekStart); err != nil {
+		return 0, err
+	}
+	if err := h.store.Upload(ctx, key, tmp, size, "application/octet-stream"); err != nil {
+		return 0, err
+	}
+	return size, nil
+}
+
+// dockerReq is a parsed /v2/<remote>/<image>/... request. kind is one of
+// "manifest", "blob", "upload", "tags".
+type dockerReq struct {
+	image string
+	kind  string
+	ref   string // tag, digest, or upload uuid depending on kind
+}
+
+// parseDockerPath splits the chi "*" remainder (everything after the repo name)
+// into the image name and the registry operation. The image name may itself
+// contain slashes, so operations are located by their well-known infixes.
+func parseDockerPath(rest string) (dockerReq, bool) {
+	rest = strings.TrimPrefix(rest, "/")
+	switch {
+	case strings.HasSuffix(rest, "/tags/list"):
+		return dockerReq{image: strings.TrimSuffix(rest, "/tags/list"), kind: "tags"}, true
+	case rest == "tags/list":
+		return dockerReq{}, false // no image
+	}
+	if i := strings.Index(rest, "/blobs/uploads"); i >= 0 {
+		image := rest[:i]
+		ref := strings.TrimPrefix(rest[i+len("/blobs/uploads"):], "/")
+		return dockerReq{image: image, kind: "upload", ref: ref}, image != ""
+	}
+	if i := strings.LastIndex(rest, "/manifests/"); i >= 0 {
+		return dockerReq{image: rest[:i], kind: "manifest", ref: rest[i+len("/manifests/"):]}, true
+	}
+	if i := strings.LastIndex(rest, "/blobs/"); i >= 0 {
+		return dockerReq{image: rest[:i], kind: "blob", ref: rest[i+len("/blobs/"):]}, true
+	}
+	return dockerReq{}, false
+}
+
+func isDigest(ref string) bool { return strings.HasPrefix(ref, "sha256:") }
+
+// localDockerRemote returns the repo if name is a local docker repository.
+func (h *ProxyHandler) localDockerRemote(r *http.Request, name string) (*models.Remote, bool) {
+	remote, err := h.db.GetRemote(r.Context(), name)
+	if err != nil {
+		return nil, false
+	}
+	return remote, remote.RepoType == models.RepoTypeLocal && remote.PackageType == models.PackageDocker
+}
+
+func dockerError(w http.ResponseWriter, status int, code, msg string) {
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Docker-Distribution-Api-Version", dockerAPIVersionHeader)
+	w.WriteHeader(status)
+	fmt.Fprintf(w, `{"errors":[{"code":%q,"message":%q}]}`, code, msg)
+}
+
+// dockerGet dispatches a registry GET to the local handler for local docker
+// repos and falls through to the upstream proxy for everything else.
+func (h *ProxyHandler) dockerGet(w http.ResponseWriter, r *http.Request) {
+	name := chi.URLParam(r, "remoteName")
+	if remote, ok := h.localDockerRemote(r, name); ok {
+		h.dockerLocalGet(w, r, remote, false)
+		return
+	}
+	h.handleProxy(w, r)
+}
+
+func (h *ProxyHandler) dockerHead(w http.ResponseWriter, r *http.Request) {
+	name := chi.URLParam(r, "remoteName")
+	if remote, ok := h.localDockerRemote(r, name); ok {
+		h.dockerLocalGet(w, r, remote, true)
+		return
+	}
+	h.handleProxyHead(w, r)
+}
+
+func (h *ProxyHandler) dockerPost(w http.ResponseWriter, r *http.Request) {
+	name := chi.URLParam(r, "remoteName")
+	remote, ok := h.localDockerRemote(r, name)
+	if !ok {
+		dockerError(w, http.StatusMethodNotAllowed, "UNSUPPORTED", "push is only supported for local docker repositories")
+		return
+	}
+	h.dockerStartUpload(w, r, remote)
+}
+
+func (h *ProxyHandler) dockerPatch(w http.ResponseWriter, r *http.Request) {
+	name := chi.URLParam(r, "remoteName")
+	remote, ok := h.localDockerRemote(r, name)
+	if !ok {
+		dockerError(w, http.StatusMethodNotAllowed, "UNSUPPORTED", "push is only supported for local docker repositories")
+		return
+	}
+	h.dockerPatchUpload(w, r, remote)
+}
+
+func (h *ProxyHandler) dockerPut(w http.ResponseWriter, r *http.Request) {
+	name := chi.URLParam(r, "remoteName")
+	remote, ok := h.localDockerRemote(r, name)
+	if !ok {
+		dockerError(w, http.StatusMethodNotAllowed, "UNSUPPORTED", "push is only supported for local docker repositories")
+		return
+	}
+	req, ok := parseDockerPath(chi.URLParam(r, "*"))
+	if !ok {
+		dockerError(w, http.StatusNotFound, "NAME_UNKNOWN", "unrecognised registry path")
+		return
+	}
+	switch req.kind {
+	case "upload":
+		h.dockerFinishUpload(w, r, remote, req)
+	case "manifest":
+		h.dockerPutManifest(w, r, remote, req)
+	default:
+		dockerError(w, http.StatusMethodNotAllowed, "UNSUPPORTED", "PUT not supported for this path")
+	}
+}
+
+func (h *ProxyHandler) dockerDelete(w http.ResponseWriter, r *http.Request) {
+	name := chi.URLParam(r, "remoteName")
+	remote, ok := h.localDockerRemote(r, name)
+	if !ok {
+		dockerError(w, http.StatusMethodNotAllowed, "UNSUPPORTED", "delete is only supported for local docker repositories")
+		return
+	}
+	req, ok := parseDockerPath(chi.URLParam(r, "*"))
+	if !ok {
+		dockerError(w, http.StatusNotFound, "NAME_UNKNOWN", "unrecognised registry path")
+		return
+	}
+	// Cancel an in-progress upload: drop its staging object.
+	if req.kind == "upload" && req.ref != "" {
+		_ = h.store.Delete(r.Context(), uploadKey(req.ref))
+		w.Header().Set("Docker-Distribution-Api-Version", dockerAPIVersionHeader)
+		w.WriteHeader(http.StatusNoContent)
+		return
+	}
+	if req.kind != "manifest" && req.kind != "blob" {
+		dockerError(w, http.StatusNotFound, "NAME_UNKNOWN", "unrecognised registry path")
+		return
+	}
+	filePath := req.image + "/" + req.kind + "s/" + req.ref
+	if err := h.db.DeleteLocalFile(r.Context(), remote.Name, filePath); err != nil {
+		dockerError(w, http.StatusInternalServerError, "UNKNOWN", err.Error())
+		return
+	}
+	w.Header().Set("Docker-Distribution-Api-Version", dockerAPIVersionHeader)
+	w.WriteHeader(http.StatusAccepted)
+}
+
+// dockerLocalGet serves manifest / blob / tags-list reads for a local repo.
+func (h *ProxyHandler) dockerLocalGet(w http.ResponseWriter, r *http.Request, remote *models.Remote, head bool) {
+	req, ok := parseDockerPath(chi.URLParam(r, "*"))
+	if !ok {
+		dockerError(w, http.StatusNotFound, "NAME_UNKNOWN", "unrecognised registry path")
+		return
+	}
+	switch req.kind {
+	case "tags":
+		h.dockerTagsList(w, r, remote, req.image)
+	case "manifest":
+		h.dockerServeRef(w, r, remote, req.image+"/manifests/"+req.ref, head, true)
+	case "blob":
+		h.dockerServeRef(w, r, remote, req.image+"/blobs/"+req.ref, head, false)
+	default:
+		dockerError(w, http.StatusNotFound, "NAME_UNKNOWN", "unrecognised registry path")
+	}
+}
+
+// dockerServeRef streams the blob backing a local_files path. isManifest
+// controls only the default content type; the stored blob content type wins.
+func (h *ProxyHandler) dockerServeRef(w http.ResponseWriter, r *http.Request, remote *models.Remote, filePath string, head, isManifest bool) {
+	file, err := h.db.GetLocalFile(r.Context(), remote.Name, filePath)
+	if err != nil {
+		dockerError(w, http.StatusInternalServerError, "UNKNOWN", err.Error())
+		return
+	}
+	if file == nil {
+		code := "BLOB_UNKNOWN"
+		if isManifest {
+			code = "MANIFEST_UNKNOWN"
+		}
+		dockerError(w, http.StatusNotFound, code, "not found")
+		return
+	}
+
+	s3Key := storage.BlobKey(file.ContentHash[len("sha256:"):])
+	reader, info, err := h.store.Download(r.Context(), s3Key)
+	if err != nil {
+		dockerError(w, http.StatusInternalServerError, "UNKNOWN", err.Error())
+		return
+	}
+	defer reader.Close()
+
+	contentType := info.ContentType
+	if contentType == "" {
+		if isManifest {
+			contentType = "application/vnd.docker.distribution.manifest.v2+json"
+		} else {
+			contentType = "application/octet-stream"
+		}
+	}
+	w.Header().Set("Content-Type", contentType)
+	w.Header().Set("Content-Length", fmt.Sprintf("%d", info.Size))
+	w.Header().Set("Docker-Content-Digest", file.ContentHash)
+	w.Header().Set("Docker-Distribution-Api-Version", dockerAPIVersionHeader)
+	w.Header().Set("X-Artifact-Source", "local")
+	if head {
+		w.WriteHeader(http.StatusOK)
+		return
+	}
+	w.WriteHeader(http.StatusOK)
+	io.Copy(w, reader)
+}
+
+func (h *ProxyHandler) dockerTagsList(w http.ResponseWriter, r *http.Request, remote *models.Remote, image string) {
+	prefix := image + "/manifests/"
+	files, err := h.db.ListLocalFilesByPrefix(r.Context(), remote.Name, prefix)
+	if err != nil {
+		dockerError(w, http.StatusInternalServerError, "UNKNOWN", err.Error())
+		return
+	}
+	tags := []string{}
+	for _, f := range files {
+		ref := strings.TrimPrefix(f.FilePath, prefix)
+		if ref == "" || isDigest(ref) {
+			continue
+		}
+		tags = append(tags, ref)
+	}
+	sort.Strings(tags)
+	w.Header().Set("Content-Type", "application/json")
+	w.Header().Set("Docker-Distribution-Api-Version", dockerAPIVersionHeader)
+	w.WriteHeader(http.StatusOK)
+	fmt.Fprintf(w, `{"name":%q,"tags":`, remote.Name+"/"+image)
+	writeJSONStringList(w, tags)
+	fmt.Fprint(w, "}")
+}
+
+func writeJSONStringList(w io.Writer, items []string) {
+	fmt.Fprint(w, "[")
+	for i, s := range items {
+		if i > 0 {
+			fmt.Fprint(w, ",")
+		}
+		fmt.Fprintf(w, "%q", s)
+	}
+	fmt.Fprint(w, "]")
+}
+
+// dockerStartUpload begins a blob upload. It honours a monolithic
+// POST?digest=... (blob in the POST body) and otherwise opens a chunked
+// session, returning its Location for the client's PATCH/PUT.
+func (h *ProxyHandler) dockerStartUpload(w http.ResponseWriter, r *http.Request, remote *models.Remote) {
+	req, ok := parseDockerPath(chi.URLParam(r, "*"))
+	if !ok || req.kind != "upload" {
+		dockerError(w, http.StatusNotFound, "NAME_UNKNOWN", "unrecognised registry path")
+		return
+	}
+
+	if digest := r.URL.Query().Get("digest"); digest != "" {
+		h.dockerCommitBlob(w, r, remote, req.image, digest, r.Body)
+		return
+	}
+
+	// Stage an empty object keyed by the upload UUID; PATCH/PUT append to it.
+	id := uuid.NewString()
+	if err := h.store.Upload(r.Context(), uploadKey(id), bytes.NewReader(nil), 0, "application/octet-stream"); err != nil {
+		dockerError(w, http.StatusInternalServerError, "UNKNOWN", err.Error())
+		return
+	}
+	loc := fmt.Sprintf("/v2/%s/%s/blobs/uploads/%s", remote.Name, req.image, id)
+	w.Header().Set("Location", loc)
+	w.Header().Set("Docker-Upload-UUID", id)
+	w.Header().Set("Range", "0-0")
+	w.Header().Set("Docker-Distribution-Api-Version", dockerAPIVersionHeader)
+	w.WriteHeader(http.StatusAccepted)
+}
+
+func (h *ProxyHandler) dockerPatchUpload(w http.ResponseWriter, r *http.Request, remote *models.Remote) {
+	req, ok := parseDockerPath(chi.URLParam(r, "*"))
+	if !ok || req.kind != "upload" || req.ref == "" {
+		dockerError(w, http.StatusNotFound, "BLOB_UPLOAD_UNKNOWN", "unknown upload")
+		return
+	}
+	size, err := h.appendUpload(r.Context(), req.ref, r.Body)
+	if err != nil {
+		if errors.Is(err, errUploadUnknown) {
+			dockerError(w, http.StatusNotFound, "BLOB_UPLOAD_UNKNOWN", "unknown upload")
+			return
+		}
+		dockerError(w, http.StatusInternalServerError, "UNKNOWN", err.Error())
+		return
+	}
+	loc := fmt.Sprintf("/v2/%s/%s/blobs/uploads/%s", remote.Name, req.image, req.ref)
+	w.Header().Set("Location", loc)
+	w.Header().Set("Docker-Upload-UUID", req.ref)
+	w.Header().Set("Range", fmt.Sprintf("0-%d", size-1))
+	w.Header().Set("Docker-Distribution-Api-Version", dockerAPIVersionHeader)
+	w.WriteHeader(http.StatusAccepted)
+}
+
+// dockerFinishUpload completes a chunked upload: appends any final PUT body,
+// stores the assembled blob, and verifies its digest.
+func (h *ProxyHandler) dockerFinishUpload(w http.ResponseWriter, r *http.Request, remote *models.Remote, req dockerReq) {
+	digest := r.URL.Query().Get("digest")
+	if digest == "" {
+		dockerError(w, http.StatusBadRequest, "DIGEST_INVALID", "digest query parameter required")
+		return
+	}
+	if req.ref == "" {
+		// Monolithic PUT with no prior session: body is the whole blob.
+		h.dockerCommitBlob(w, r, remote, req.image, digest, r.Body)
+		return
+	}
+
+	key := uploadKey(req.ref)
+	reader, _, err := h.store.Download(r.Context(), key)
+	if err != nil {
+		dockerError(w, http.StatusNotFound, "BLOB_UPLOAD_UNKNOWN", "unknown upload")
+		return
+	}
+	defer reader.Close()
+	// Drop the staging object once we're done, regardless of outcome; a fresh
+	// context so cleanup still runs if the client disconnects.
+	defer h.store.Delete(context.Background(), key)
+
+	// Stream the staged bytes plus any trailing PUT body through the CAS in one
+	// pass — no extra round trip to re-assemble.
+	combined := io.MultiReader(reader, r.Body)
+	h.dockerCommitBlob(w, r, remote, req.image, digest, combined)
+}
+
+// dockerCommitBlob stores blob bytes through the CAS, verifies the client's
+// declared digest, and records the per-image local_files reference.
+func (h *ProxyHandler) dockerCommitBlob(w http.ResponseWriter, r *http.Request, remote *models.Remote, image, digest string, body io.Reader) {
+	result, err := h.cas.Store(r.Context(), body, "application/octet-stream")
+	if err != nil {
+		dockerError(w, http.StatusInternalServerError, "UNKNOWN", fmt.Sprintf("store failed: %v", err))
+		return
+	}
+	if result.ContentHash != digest {
+		dockerError(w, http.StatusBadRequest, "DIGEST_INVALID", fmt.Sprintf("digest mismatch: got %s, declared %s", result.ContentHash, digest))
+		return
+	}
+	if err := h.db.UpsertBlob(r.Context(), result.ContentHash, result.S3Key, result.SizeBytes, "application/octet-stream"); err != nil {
+		dockerError(w, http.StatusInternalServerError, "UNKNOWN", err.Error())
+		return
+	}
+	if err := h.db.CreateLocalFile(r.Context(), remote.Name, image+"/blobs/"+digest, result.ContentHash); err != nil && !errors.Is(err, database.ErrAlreadyExists) {
+		dockerError(w, http.StatusInternalServerError, "UNKNOWN", err.Error())
+		return
+	}
+	w.Header().Set("Location", fmt.Sprintf("/v2/%s/%s/blobs/%s", remote.Name, image, digest))
+	w.Header().Set("Docker-Content-Digest", digest)
+	w.Header().Set("Docker-Distribution-Api-Version", dockerAPIVersionHeader)
+	w.WriteHeader(http.StatusCreated)
+}
+
+// dockerPutManifest stores a manifest and points its reference (tag or digest)
+// at it. Tags are mutable so a re-push moves the tag; digests are immutable.
+func (h *ProxyHandler) dockerPutManifest(w http.ResponseWriter, r *http.Request, remote *models.Remote, req dockerReq) {
+	body, err := io.ReadAll(r.Body)
+	if err != nil {
+		dockerError(w, http.StatusInternalServerError, "UNKNOWN", err.Error())
+		return
+	}
+	contentType := r.Header.Get("Content-Type")
+	if contentType == "" {
+		contentType = "application/vnd.docker.distribution.manifest.v2+json"
+	}
+	sum := sha256.Sum256(body)
+	digest := "sha256:" + hex.EncodeToString(sum[:])
+
+	result, err := h.cas.Store(r.Context(), strings.NewReader(string(body)), contentType)
+	if err != nil {
+		dockerError(w, http.StatusInternalServerError, "UNKNOWN", fmt.Sprintf("store failed: %v", err))
+		return
+	}
+	if err := h.db.UpsertBlob(r.Context(), result.ContentHash, result.S3Key, result.SizeBytes, contentType); err != nil {
+		dockerError(w, http.StatusInternalServerError, "UNKNOWN", err.Error())
+		return
+	}
+	// Always addressable by digest (immutable).
+	if err := h.db.CreateLocalFile(r.Context(), remote.Name, req.image+"/manifests/"+digest, result.ContentHash); err != nil && !errors.Is(err, database.ErrAlreadyExists) {
+		dockerError(w, http.StatusInternalServerError, "UNKNOWN", err.Error())
+		return
+	}
+	// If pushed under a tag, (re)point the tag at this manifest.
+	if !isDigest(req.ref) {
+		if err := h.db.UpsertLocalFile(r.Context(), remote.Name, req.image+"/manifests/"+req.ref, result.ContentHash); err != nil {
+			dockerError(w, http.StatusInternalServerError, "UNKNOWN", err.Error())
+			return
+		}
+	}
+
+	slog.Info("local docker manifest pushed", "repo", remote.Name, "image", req.image, "ref", req.ref, "digest", digest)
+	w.Header().Set("Location", fmt.Sprintf("/v2/%s/%s/manifests/%s", remote.Name, req.image, req.ref))
+	w.Header().Set("Docker-Content-Digest", digest)
+	w.Header().Set("Docker-Distribution-Api-Version", dockerAPIVersionHeader)
+	w.WriteHeader(http.StatusCreated)
+}

internal/api/v1/docker_test.go

@@ -0,0 +1,50 @@
+package v1
+
+import "testing"
+
+func TestParseDockerPath(t *testing.T) {
+	tests := []struct {
+		name      string
+		rest      string
+		wantOK    bool
+		wantImage string
+		wantKind  string
+		wantRef   string
+	}{
+		{"start upload trailing slash", "team/app/blobs/uploads/", true, "team/app", "upload", ""},
+		{"start upload no slash", "team/app/blobs/uploads", true, "team/app", "upload", ""},
+		{"patch upload with uuid", "team/app/blobs/uploads/abc-123", true, "team/app", "upload", "abc-123"},
+		{"single-segment image upload", "app/blobs/uploads/", true, "app", "upload", ""},
+		{"blob by digest", "team/app/blobs/sha256:deadbeef", true, "team/app", "blob", "sha256:deadbeef"},
+		{"manifest by tag", "team/app/manifests/v1.0.0", true, "team/app", "manifest", "v1.0.0"},
+		{"manifest by digest", "team/app/manifests/sha256:cafe", true, "team/app", "manifest", "sha256:cafe"},
+		{"tags list", "team/app/tags/list", true, "team/app", "tags", ""},
+		{"leading slash tolerated", "/team/app/manifests/latest", true, "team/app", "manifest", "latest"},
+		{"deep image name", "a/b/c/manifests/latest", true, "a/b/c", "manifest", "latest"},
+		{"unrecognised", "team/app/whatever", false, "", "", ""},
+		{"tags list without image", "tags/list", false, "", "", ""},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			got, ok := parseDockerPath(tc.rest)
+			if ok != tc.wantOK {
+				t.Fatalf("ok = %v, want %v", ok, tc.wantOK)
+			}
+			if !tc.wantOK {
+				return
+			}
+			if got.image != tc.wantImage || got.kind != tc.wantKind || got.ref != tc.wantRef {
+				t.Fatalf("got %+v, want image=%q kind=%q ref=%q", got, tc.wantImage, tc.wantKind, tc.wantRef)
+			}
+		})
+	}
+}
+
+func TestIsDigest(t *testing.T) {
+	if !isDigest("sha256:abc") {
+		t.Fatal("sha256: prefix should be a digest")
+	}
+	if isDigest("v1.0.0") {
+		t.Fatal("a tag is not a digest")
+	}
+}

internal/api/v1/proxy.go

@@ -23,10 +23,18 @@ type ProxyHandler struct {
 	db            *database.DB
 	store         *storage.S3
 	local         *v2.LocalHandler
+	cas           *storage.CAS
 }
 
 func NewProxyHandler(engine *proxy.Engine, virtualEngine *virtual.Engine, db *database.DB, store *storage.S3, local *v2.LocalHandler) *ProxyHandler {
-	return &ProxyHandler{engine: engine, virtualEngine: virtualEngine, db: db, store: store, local: local}
+	return &ProxyHandler{
+		engine:        engine,
+		virtualEngine: virtualEngine,
+		db:            db,
+		store:         store,
+		local:         local,
+		cas:           storage.NewCAS(store),
+	}
 }
 
 func (h *ProxyHandler) Routes() chi.Router {
@@ -37,6 +45,28 @@ func (h *ProxyHandler) Routes() chi.Router {
 	return r
 }
 
+// DockerV2Routes mounts the Docker Registry HTTP API V2. Reads (GET/HEAD)
+// dispatch to a local registry implementation for local docker repos and fall
+// through to the upstream proxy otherwise; writes (POST/PATCH/PUT/DELETE) are
+// only valid for local docker repos and drive push.
+func (h *ProxyHandler) DockerV2Routes() chi.Router {
+	r := chi.NewRouter()
+	r.Get("/", h.handleDockerPing)
+	r.Head("/", h.handleDockerPing)
+	r.Get("/{remoteName}/*", h.dockerGet)
+	r.Head("/{remoteName}/*", h.dockerHead)
+	r.Post("/{remoteName}/*", h.dockerPost)
+	r.Patch("/{remoteName}/*", h.dockerPatch)
+	r.Put("/{remoteName}/*", h.dockerPut)
+	r.Delete("/{remoteName}/*", h.dockerDelete)
+	return r
+}
+
+func (h *ProxyHandler) handleDockerPing(w http.ResponseWriter, r *http.Request) {
+	w.Header().Set("Docker-Distribution-Api-Version", "registry/2.0")
+	w.WriteHeader(http.StatusOK)
+}
+
 func (h *ProxyHandler) handleProxy(w http.ResponseWriter, r *http.Request) {
 	remoteName := chi.URLParam(r, "remoteName")
 	path := chi.URLParam(r, "*")
@@ -53,7 +83,16 @@ func (h *ProxyHandler) handleProxy(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	result, err := h.engine.Fetch(r.Context(), *remote, path, prov)
+	// Metadata-only remotes (e.g. github_rpm) synthesize their own responses and
+	// redirect package downloads to a backend remote instead of proxying bytes.
+	if rs, ok := prov.(provider.RemoteServer); ok {
+		proxyBaseURL := fmt.Sprintf("%s://%s", scheme(r), r.Host)
+		if rs.ServeRemote(w, r, *remote, path, proxyBaseURL, h.db) {
+			return
+		}
+	}
+
+	result, err := h.engine.Fetch(r.Context(), *remote, path, prov, r.Header)
 	if err != nil {
 		var proxyErr *proxy.ProxyError
 		if errors.As(err, &proxyErr) {
@@ -75,6 +114,42 @@ func (h *ProxyHandler) handleProxy(w http.ResponseWriter, r *http.Request) {
 	io.Copy(w, result.Reader)
 }
 
+func (h *ProxyHandler) handleProxyHead(w http.ResponseWriter, r *http.Request) {
+	remoteName := chi.URLParam(r, "remoteName")
+	path := chi.URLParam(r, "*")
+
+	remote, err := h.db.GetRemote(r.Context(), remoteName)
+	if err != nil {
+		http.Error(w, fmt.Sprintf("remote %q not found", remoteName), http.StatusNotFound)
+		return
+	}
+
+	prov, err := provider.Get(remote.PackageType)
+	if err != nil {
+		http.Error(w, fmt.Sprintf("no provider for %q", remote.PackageType), http.StatusInternalServerError)
+		return
+	}
+
+	result, err := h.engine.Head(r.Context(), *remote, path, prov)
+	if err != nil {
+		var proxyErr *proxy.ProxyError
+		if errors.As(err, &proxyErr) {
+			http.Error(w, proxyErr.Message, proxyErr.Status)
+			return
+		}
+		slog.Error("proxy head failed", "remote", remoteName, "path", path, "error", err)
+		http.Error(w, "bad gateway", http.StatusBadGateway)
+		return
+	}
+
+	w.Header().Set("Content-Type", result.ContentType)
+	w.Header().Set("X-Artifact-Source", result.Source)
+	if result.Size > 0 {
+		w.Header().Set("Content-Length", fmt.Sprintf("%d", result.Size))
+	}
+	w.WriteHeader(http.StatusOK)
+}
+
 func (h *ProxyHandler) handleVirtual(w http.ResponseWriter, r *http.Request) {
 	virtualName := chi.URLParam(r, "virtualName")
 	path := chi.URLParam(r, "*")

internal/api/v1/scheme_test.go

@@ -0,0 +1,20 @@
+package v1
+
+import (
+	"crypto/tls"
+	"net/http"
+	"testing"
+)
+
+func TestScheme(t *testing.T) {
+	if got := scheme(&http.Request{TLS: &tls.ConnectionState{}}); got != "https" {
+		t.Errorf("TLS request scheme = %q, want https", got)
+	}
+	r := &http.Request{Header: http.Header{"X-Forwarded-Proto": {"https"}}}
+	if got := scheme(r); got != "https" {
+		t.Errorf("X-Forwarded-Proto scheme = %q, want https", got)
+	}
+	if got := scheme(&http.Request{Header: http.Header{}}); got != "http" {
+		t.Errorf("default scheme = %q, want http", got)
+	}
+}

internal/api/v2/errorpaths_test.go

@@ -0,0 +1,130 @@
+package v2
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"strings"
+	"testing"
+
+	"git.unkin.net/unkin/artifactapi/internal/database"
+	"git.unkin.net/unkin/artifactapi/internal/testsupport"
+)
+
+var testDSN string
+
+func TestMain(m *testing.M) {
+	ctx := context.Background()
+	dsn, terminate, err := testsupport.StartPostgres(ctx)
+	if err != nil {
+		os.Exit(m.Run())
+	}
+	testDSN = dsn
+	code := m.Run()
+	terminate()
+	if code != 0 {
+		os.Exit(code)
+	}
+}
+
+// closedDB returns a DB whose pool has been closed, so every query fails —
+// used to drive the handlers' error branches.
+func closedDB(t *testing.T) *database.DB {
+	t.Helper()
+	if testDSN == "" {
+		t.Skip("Docker unavailable")
+	}
+	db, err := database.New(testDSN)
+	if err != nil {
+		t.Fatalf("new db: %v", err)
+	}
+	db.Close()
+	return db
+}
+
+func do(t *testing.T, h http.Handler, method, path, body string) int {
+	t.Helper()
+	var r io.Reader
+	if body != "" {
+		r = strings.NewReader(body)
+	}
+	req := httptest.NewRequest(method, path, r)
+	w := httptest.NewRecorder()
+	h.ServeHTTP(w, req)
+	return w.Code
+}
+
+func TestRemotesErrorPaths(t *testing.T) {
+	h := NewRemotesHandler(closedDB(t), nil).Routes()
+	if c := do(t, h, "GET", "/", ""); c != 500 {
+		t.Errorf("list with dead db = %d, want 500", c)
+	}
+	if c := do(t, h, "POST", "/", `{"name":"x","package_type":"generic","repo_type":"remote","base_url":"https://x"}`); c != 500 {
+		t.Errorf("create with dead db = %d, want 500", c)
+	}
+	if c := do(t, h, "PUT", "/x", `{"package_type":"generic","base_url":"https://x"}`); c != 500 {
+		t.Errorf("update with dead db = %d, want 500", c)
+	}
+	if c := do(t, h, "GET", "/x", ""); c != 404 {
+		t.Errorf("get missing = %d, want 404", c)
+	}
+	if c := do(t, h, "DELETE", "/x", ""); c != 500 {
+		t.Errorf("delete with dead db = %d, want 500", c)
+	}
+	// Bad request bodies never reach the db.
+	if c := do(t, h, "POST", "/", `not json`); c != 400 {
+		t.Errorf("invalid json = %d, want 400", c)
+	}
+}
+
+func TestVirtualsErrorPaths(t *testing.T) {
+	h := NewVirtualsHandler(closedDB(t)).Routes()
+	if c := do(t, h, "GET", "/", ""); c != 500 {
+		t.Errorf("list = %d, want 500", c)
+	}
+	if c := do(t, h, "GET", "/x", ""); c != 404 {
+		t.Errorf("get missing = %d, want 404", c)
+	}
+	if c := do(t, h, "POST", "/", `{"name":"v","package_type":"helm","members":["a"]}`); c != 500 {
+		t.Errorf("create = %d, want 500", c)
+	}
+	if c := do(t, h, "PUT", "/v", `{"package_type":"helm","members":["a"]}`); c != 500 {
+		t.Errorf("update = %d, want 500", c)
+	}
+	if c := do(t, h, "DELETE", "/v", ""); c != 500 {
+		t.Errorf("delete = %d, want 500", c)
+	}
+}
+
+func TestStatsErrorPaths(t *testing.T) {
+	h := NewStatsHandler(closedDB(t)).Routes()
+	for _, p := range []string{"/", "/top-remotes", "/top-files-by-hits", "/top-files-by-bandwidth"} {
+		if c := do(t, h, "GET", p, ""); c != 500 {
+			t.Errorf("stats %s = %d, want 500", p, c)
+		}
+	}
+}
+
+func TestLocalErrorPaths(t *testing.T) {
+	h := NewLocalHandler(closedDB(t), nil).Routes()
+	// GetRemote fails on the closed db -> not found.
+	if c := do(t, h, "PUT", "/x/files/a.bin", "data"); c != 404 {
+		t.Errorf("upload unknown repo = %d, want 404", c)
+	}
+	// download / remove hit the db and 500.
+	if c := do(t, h, "GET", "/x/files/a.bin", ""); c != 500 {
+		t.Errorf("download = %d, want 500", c)
+	}
+	if c := do(t, h, "DELETE", "/x/files/a.bin", ""); c != 500 {
+		t.Errorf("remove = %d, want 500", c)
+	}
+}
+
+func TestLocalHandlerDBAccessor(t *testing.T) {
+	db := closedDB(t)
+	if NewLocalHandler(db, nil).DB() != db {
+		t.Error("DB() should return the handler's database")
+	}
+}

internal/api/v2/local.go

@@ -1,6 +1,7 @@
 package v2
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	"io"
@@ -58,14 +59,14 @@ func (h *LocalHandler) upload(w http.ResponseWriter, r *http.Request) {
 	prov, _ := provider.Get(remote.PackageType)
 
 	if uploader, ok := prov.(provider.LocalUploader); ok {
-		h.uploadValidated(w, r, remote, filePath, uploader)
+		h.uploadValidated(w, r, remote, filePath, prov, uploader)
 		return
 	}
 
 	h.uploadGeneric(w, r, remote, filePath)
 }
 
-func (h *LocalHandler) uploadValidated(w http.ResponseWriter, r *http.Request, remote *models.Remote, filePath string, uploader provider.LocalUploader) {
+func (h *LocalHandler) uploadValidated(w http.ResponseWriter, r *http.Request, remote *models.Remote, filePath string, prov provider.Provider, uploader provider.LocalUploader) {
 	storagePath, contentType, err := uploader.ValidateUpload(filePath)
 	if err != nil {
 		http.Error(w, err.Error(), http.StatusBadRequest)
@@ -102,6 +103,10 @@ func (h *LocalHandler) uploadValidated(w http.ResponseWriter, r *http.Request, r
 		return
 	}
 
+	if hook, ok := prov.(provider.PostUploadHook); ok {
+		go hook.AfterUpload(context.Background(), remote.Name, storagePath, result.ContentHash, h, h.db)
+	}
+
 	writeJSON(w, http.StatusCreated, uploader.UploadResponse(storagePath, result.ContentHash, result.SizeBytes))
 }
 
@@ -180,13 +185,43 @@ func (h *LocalHandler) remove(w http.ResponseWriter, r *http.Request) {
 	repoName := chi.URLParam(r, "name")
 	filePath := chi.URLParam(r, "*")
 
-	if err := h.db.DeleteLocalFile(r.Context(), repoName, filePath); err != nil {
+	if err := deleteLocalFile(r.Context(), h.db, repoName, filePath); err != nil {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
 	}
 	w.WriteHeader(http.StatusNoContent)
 }
 
+// deleteLocalFile removes a local file and runs the provider's post-delete hook,
+// so provider-derived state (e.g. RPM metadata that feeds generated repodata)
+// stops referencing a package that no longer exists.
+func deleteLocalFile(ctx context.Context, db *database.DB, repoName, filePath string) error {
+	if err := db.DeleteLocalFile(ctx, repoName, filePath); err != nil {
+		return err
+	}
+
+	remote, err := db.GetRemote(ctx, repoName)
+	if err != nil {
+		return nil // file is gone; no repo left to resolve a cleanup hook from
+	}
+	prov, err := provider.Get(remote.PackageType)
+	if err != nil {
+		return nil
+	}
+	if hook, ok := prov.(provider.PostDeleteHook); ok {
+		return hook.AfterDelete(ctx, repoName, filePath, db)
+	}
+	return nil
+}
+
 func (h *LocalHandler) DB() *database.DB {
 	return h.db
 }
+
+func (h *LocalHandler) Download(ctx context.Context, key string) (io.ReadCloser, int64, error) {
+	reader, info, err := h.store.Download(ctx, key)
+	if err != nil {
+		return nil, 0, err
+	}
+	return reader, info.Size, nil
+}

internal/api/v2/local_evict_cleanup_test.go

@@ -0,0 +1,75 @@
+package v2
+
+import (
+	"context"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+
+	"git.unkin.net/unkin/artifactapi/internal/database"
+	"git.unkin.net/unkin/artifactapi/internal/provider"
+	_ "git.unkin.net/unkin/artifactapi/internal/provider/rpm" // register the rpm provider so its PostDeleteHook runs
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+// TestLocalEvictCleansRPMMetadata verifies that evicting an RPM from a local
+// repo also removes the derived rpm_metadata row, so generated repodata stops
+// listing the deleted package.
+func TestLocalEvictCleansRPMMetadata(t *testing.T) {
+	if testDSN == "" {
+		t.Skip("Docker unavailable")
+	}
+	ctx := context.Background()
+	db, err := database.New(testDSN)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+
+	const repo = "rpm-evict-cleanup"
+	if err := db.CreateRemote(ctx, &models.Remote{Name: repo, PackageType: models.PackageRPM, RepoType: models.RepoTypeLocal}); err != nil {
+		t.Fatal(err)
+	}
+
+	const hash = "sha256:bb22"
+	const path = "Packages/example-0.1.0-1.x86_64.rpm"
+	if err := db.UpsertBlob(ctx, hash, "blobs/bb/22", 2048, "application/x-rpm"); err != nil {
+		t.Fatal(err)
+	}
+	if err := db.CreateLocalFile(ctx, repo, path, hash); err != nil {
+		t.Fatal(err)
+	}
+	if err := db.InsertRPMMetadata(ctx, &provider.RPMMetadata{
+		RepoName: repo, FilePath: path, ContentHash: hash,
+		Name: "example", Version: "0.1.0", Release: "1", Arch: "x86_64",
+		Requires: []provider.RPMDep{}, Provides: []provider.RPMDep{},
+		Files: []provider.RPMFile{}, Changelogs: []provider.RPMChangelog{},
+	}); err != nil {
+		t.Fatal(err)
+	}
+
+	h := NewObjectsHandler(db)
+	router := chi.NewRouter()
+	router.Route("/locals/{name}/objects", func(r chi.Router) {
+		r.Delete("/*", h.LocalRoutes().ServeHTTP)
+	})
+
+	del := httptest.NewRequest("DELETE", "/locals/"+repo+"/objects/"+path, nil)
+	dw := httptest.NewRecorder()
+	router.ServeHTTP(dw, del)
+	if dw.Code != 204 {
+		t.Fatalf("evict = %d, want 204", dw.Code)
+	}
+
+	if f, _ := db.GetLocalFile(ctx, repo, path); f != nil {
+		t.Fatalf("local file still present after evict: %+v", f)
+	}
+	entries, err := db.ListRPMMetadataEntries(ctx, repo)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(entries) != 0 {
+		t.Fatalf("rpm_metadata still present after evict: %+v", entries)
+	}
+}

internal/api/v2/local_fault_test.go

@@ -0,0 +1,88 @@
+package v2
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/go-chi/chi/v5"
+
+	"git.unkin.net/unkin/artifactapi/internal/database"
+	"git.unkin.net/unkin/artifactapi/internal/storage"
+	"git.unkin.net/unkin/artifactapi/internal/testsupport"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+// TestLocalUploadStoreFailure covers the upload handlers' store-error branches
+// by killing the object store after a successful upload.
+func TestLocalUploadStoreFailure(t *testing.T) {
+	if testDSN == "" {
+		t.Skip("Docker unavailable")
+	}
+	ctx := context.Background()
+	db, err := database.New(testDSN)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+
+	conn, termMinio, err := testsupport.StartMinio(ctx)
+	if err != nil {
+		t.Skip("minio unavailable")
+	}
+	var store *storage.S3
+	for i := 0; i < 20; i++ {
+		if store, err = storage.NewS3(conn.Endpoint, conn.AccessKey, conn.SecretKey, "fault", false, ""); err == nil {
+			break
+		}
+		time.Sleep(500 * time.Millisecond)
+	}
+	if err != nil {
+		termMinio()
+		t.Fatal(err)
+	}
+
+	for _, pt := range []models.PackageType{models.PackageGeneric, models.PackagePyPI} {
+		if err := db.CreateRemote(ctx, &models.Remote{Name: "fault-" + string(pt), PackageType: pt, RepoType: models.RepoTypeLocal}); err != nil {
+			t.Fatal(err)
+		}
+	}
+
+	h := NewLocalHandler(db, store)
+	router := chi.NewRouter()
+	router.Route("/remotes/{name}/files", func(r chi.Router) {
+		r.Put("/*", h.Routes().ServeHTTP)
+	})
+	srv := httptest.NewServer(router)
+	defer srv.Close()
+
+	put := func(name, path, body string) int {
+		rq, _ := http.NewRequest("PUT", srv.URL+"/remotes/"+name+"/files/"+path, strings.NewReader(body))
+		resp, err := http.DefaultClient.Do(rq)
+		if err != nil {
+			t.Fatalf("put: %v", err)
+		}
+		resp.Body.Close()
+		return resp.StatusCode
+	}
+
+	// Sanity: uploads succeed while the store is up.
+	if c := put("fault-generic", "ok.bin", "data"); c != 201 {
+		t.Fatalf("generic upload while up = %d", c)
+	}
+	if c := put("fault-pypi", "foo-1.0-py3-none-any.whl", "wheel"); c != 201 {
+		t.Fatalf("pypi upload while up = %d", c)
+	}
+
+	// Kill the store; subsequent CAS.Store calls fail -> 500.
+	termMinio()
+	if c := put("fault-generic", "after.bin", "data"); c != 500 {
+		t.Errorf("generic upload after store down = %d, want 500", c)
+	}
+	if c := put("fault-pypi", "bar-1.0-py3-none-any.whl", "wheel"); c != 500 {
+		t.Errorf("pypi upload after store down = %d, want 500", c)
+	}
+}

internal/api/v2/local_objects_test.go

@@ -0,0 +1,78 @@
+package v2
+
+import (
+	"context"
+	"encoding/json"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+
+	"git.unkin.net/unkin/artifactapi/internal/database"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+// TestLocalObjectsListing verifies that files uploaded to a local repo (which
+// live in local_files, not artifacts) are listed by the local objects endpoint
+// and can be evicted through it.
+func TestLocalObjectsListing(t *testing.T) {
+	if testDSN == "" {
+		t.Skip("Docker unavailable")
+	}
+	ctx := context.Background()
+	db, err := database.New(testDSN)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer db.Close()
+
+	const repo = "rpm-local-objs"
+	if err := db.CreateRemote(ctx, &models.Remote{Name: repo, PackageType: models.PackageRPM, RepoType: models.RepoTypeLocal}); err != nil {
+		t.Fatal(err)
+	}
+
+	const hash = "sha256:aa11"
+	const path = "Packages/example-0.1.0-1.x86_64.rpm"
+	if err := db.UpsertBlob(ctx, hash, "blobs/aa/11", 1234, "application/x-rpm"); err != nil {
+		t.Fatal(err)
+	}
+	if err := db.CreateLocalFile(ctx, repo, path, hash); err != nil {
+		t.Fatal(err)
+	}
+
+	h := NewObjectsHandler(db)
+	router := chi.NewRouter()
+	router.Route("/locals/{name}/objects", func(r chi.Router) {
+		r.Get("/", h.LocalRoutes().ServeHTTP)
+		r.Delete("/*", h.LocalRoutes().ServeHTTP)
+	})
+
+	// The uploaded package must appear in the listing with its blob size.
+	req := httptest.NewRequest("GET", "/locals/"+repo+"/objects", nil)
+	w := httptest.NewRecorder()
+	router.ServeHTTP(w, req)
+	if w.Code != 200 {
+		t.Fatalf("list = %d, want 200", w.Code)
+	}
+	var got []models.Artifact
+	if err := json.Unmarshal(w.Body.Bytes(), &got); err != nil {
+		t.Fatalf("decode: %v", err)
+	}
+	if len(got) != 1 {
+		t.Fatalf("got %d objects, want 1", len(got))
+	}
+	if got[0].Path != path || got[0].SizeBytes != 1234 || got[0].ContentHash != hash {
+		t.Fatalf("unexpected object: %+v", got[0])
+	}
+
+	// Eviction removes it from local_files.
+	del := httptest.NewRequest("DELETE", "/locals/"+repo+"/objects/"+path, nil)
+	dw := httptest.NewRecorder()
+	router.ServeHTTP(dw, del)
+	if dw.Code != 204 {
+		t.Fatalf("evict = %d, want 204", dw.Code)
+	}
+	if f, _ := db.GetLocalFile(ctx, repo, path); f != nil {
+		t.Fatalf("file still present after evict: %+v", f)
+	}
+}

internal/api/v2/objects.go

@@ -25,9 +25,18 @@ func (h *ObjectsHandler) Routes() chi.Router {
 	return r
 }
 
-func (h *ObjectsHandler) list(w http.ResponseWriter, r *http.Request) {
-	remoteName := chi.URLParam(r, "name")
-	limit, _ := strconv.Atoi(r.URL.Query().Get("per_page"))
+// LocalRoutes lists and evicts objects for local repos, which live in the
+// local_files table rather than the artifacts table used by remotes.
+func (h *ObjectsHandler) LocalRoutes() chi.Router {
+	r := chi.NewRouter()
+	r.Get("/", h.listLocal)
+	r.Delete("/*", h.evictLocal)
+	return r
+}
+
+// pageBounds parses the shared page/per_page query params into a SQL limit and offset.
+func pageBounds(r *http.Request) (limit, offset int) {
+	limit, _ = strconv.Atoi(r.URL.Query().Get("per_page"))
 	if limit <= 0 || limit > 5000 {
 		limit = 50
 	}
@@ -35,7 +44,12 @@ func (h *ObjectsHandler) list(w http.ResponseWriter, r *http.Request) {
 	if page <= 0 {
 		page = 1
 	}
-	offset := (page - 1) * limit
+	return limit, (page - 1) * limit
+}
+
+func (h *ObjectsHandler) list(w http.ResponseWriter, r *http.Request) {
+	remoteName := chi.URLParam(r, "name")
+	limit, offset := pageBounds(r)
 
 	artifacts, err := h.db.ListArtifacts(r.Context(), remoteName, limit, offset)
 	if err != nil {
@@ -45,6 +59,29 @@ func (h *ObjectsHandler) list(w http.ResponseWriter, r *http.Request) {
 	writeJSON(w, http.StatusOK, artifacts)
 }
 
+func (h *ObjectsHandler) listLocal(w http.ResponseWriter, r *http.Request) {
+	repoName := chi.URLParam(r, "name")
+	limit, offset := pageBounds(r)
+
+	artifacts, err := h.db.ListLocalArtifacts(r.Context(), repoName, limit, offset)
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	writeJSON(w, http.StatusOK, artifacts)
+}
+
+func (h *ObjectsHandler) evictLocal(w http.ResponseWriter, r *http.Request) {
+	repoName := chi.URLParam(r, "name")
+	path := chi.URLParam(r, "*")
+
+	if err := deleteLocalFile(r.Context(), h.db, repoName, path); err != nil {
+		http.Error(w, fmt.Sprintf("evict failed: %v", err), http.StatusInternalServerError)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
 func (h *ObjectsHandler) evict(w http.ResponseWriter, r *http.Request) {
 	remoteName := chi.URLParam(r, "name")
 	path := chi.URLParam(r, "*")

internal/api/v2/remotes.go

@@ -11,12 +11,19 @@ import (
 	"git.unkin.net/unkin/artifactapi/pkg/models"
 )
 
-type RemotesHandler struct {
-	db *database.DB
+// Primer enqueues a background metadata prime for a newly created remote so the
+// create call never blocks on a derive. *rpm.Syncer satisfies it.
+type Primer interface {
+	EnqueuePrime(remote models.Remote)
 }
 
-func NewRemotesHandler(db *database.DB) *RemotesHandler {
-	return &RemotesHandler{db: db}
+type RemotesHandler struct {
+	db     *database.DB
+	primer Primer
+}
+
+func NewRemotesHandler(db *database.DB, primer Primer) *RemotesHandler {
+	return &RemotesHandler{db: db, primer: primer}
 }
 
 func (h *RemotesHandler) Routes() chi.Router {
@@ -69,10 +76,19 @@ func (h *RemotesHandler) create(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "base_url is required for remote repositories", http.StatusBadRequest)
 		return
 	}
+	if err := remote.ValidatePatterns(); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
 	if err := h.db.CreateRemote(r.Context(), &remote); err != nil {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
 	}
+	// Prime a github_rpm remote's metadata in the background so its first
+	// repodata request is served from cache instead of a cold on-demand derive.
+	if h.primer != nil && remote.PackageType == models.PackageGitHubRPM {
+		h.primer.EnqueuePrime(remote)
+	}
 	writeJSON(w, http.StatusCreated, remote)
 }
 
@@ -84,6 +100,10 @@ func (h *RemotesHandler) update(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	remote.Name = name
+	if err := remote.ValidatePatterns(); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
 	if err := h.db.UpdateRemote(r.Context(), &remote); err != nil {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return

internal/auth/basic_test.go

@@ -0,0 +1,23 @@
+package auth
+
+import (
+	"encoding/base64"
+	"testing"
+
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+func TestBasicHeaders(t *testing.T) {
+	h := BasicHeaders(models.Remote{Username: "alice", Password: "secret"})
+	got := h.Get("Authorization")
+	want := "Basic " + base64.StdEncoding.EncodeToString([]byte("alice:secret"))
+	if got != want {
+		t.Errorf("Authorization = %q, want %q", got, want)
+	}
+}
+
+func TestBasicHeadersNoUser(t *testing.T) {
+	if h := BasicHeaders(models.Remote{}); h.Get("Authorization") != "" {
+		t.Error("expected no Authorization header without a username")
+	}
+}

internal/cache/cache_test.go

@@ -0,0 +1,133 @@
+package cache
+
+import (
+	"context"
+	"os"
+	"testing"
+	"time"
+
+	"git.unkin.net/unkin/artifactapi/internal/testsupport"
+)
+
+var testRedis *Redis
+
+func TestMain(m *testing.M) {
+	ctx := context.Background()
+	url, terminate, err := testsupport.StartRedis(ctx)
+	if err != nil {
+		os.Exit(m.Run())
+	}
+	r, err := NewRedis(url)
+	if err != nil {
+		terminate()
+		panic(err)
+	}
+	testRedis = r
+	code := m.Run()
+	r.Close()
+	terminate()
+	if code != 0 {
+		os.Exit(code)
+	}
+}
+
+func requireRedis(t *testing.T) {
+	t.Helper()
+	if testRedis == nil {
+		t.Skip("Docker unavailable; skipping cache integration test")
+	}
+}
+
+func TestNewRedisInvalid(t *testing.T) {
+	if _, err := NewRedis("://bad-url"); err == nil {
+		t.Error("expected error for invalid redis URL")
+	}
+}
+
+func TestTTL(t *testing.T) {
+	requireRedis(t)
+	ctx := context.Background()
+	if fresh, _ := testRedis.CheckTTL(ctx, "r", "missing"); fresh {
+		t.Error("missing key should not be fresh")
+	}
+	if err := testRedis.SetTTL(ctx, "r", "p", time.Minute); err != nil {
+		t.Fatal(err)
+	}
+	if fresh, err := testRedis.CheckTTL(ctx, "r", "p"); err != nil || !fresh {
+		t.Errorf("expected fresh after SetTTL: %v %v", fresh, err)
+	}
+}
+
+func TestLock(t *testing.T) {
+	requireRedis(t)
+	ctx := context.Background()
+	ok, err := testRedis.AcquireLock(ctx, "r", "lockpath", time.Minute)
+	if err != nil || !ok {
+		t.Fatalf("first acquire should succeed: %v %v", ok, err)
+	}
+	if ok, _ := testRedis.AcquireLock(ctx, "r", "lockpath", time.Minute); ok {
+		t.Error("second acquire should fail while held")
+	}
+	if err := testRedis.ReleaseLock(ctx, "r", "lockpath"); err != nil {
+		t.Fatal(err)
+	}
+	if ok, _ := testRedis.AcquireLock(ctx, "r", "lockpath", time.Minute); !ok {
+		t.Error("acquire should succeed after release")
+	}
+}
+
+func TestETagAndToken(t *testing.T) {
+	requireRedis(t)
+	ctx := context.Background()
+	if v, _ := testRedis.GetETag(ctx, "r", "missing"); v != "" {
+		t.Error("missing etag should be empty")
+	}
+	testRedis.SetETag(ctx, "r", "p", `"abc"`, time.Minute)
+	if v, _ := testRedis.GetETag(ctx, "r", "p"); v != `"abc"` {
+		t.Errorf("etag = %q", v)
+	}
+
+	if v, _ := testRedis.GetToken(ctx, "missing"); v != "" {
+		t.Error("missing token should be empty")
+	}
+	testRedis.SetToken(ctx, "key", "tok", time.Minute)
+	if v, _ := testRedis.GetToken(ctx, "key"); v != "tok" {
+		t.Errorf("token = %q", v)
+	}
+}
+
+func TestCircuit(t *testing.T) {
+	requireRedis(t)
+	ctx := context.Background()
+	if n, _ := testRedis.GetCircuitFailures(ctx, "cr"); n != 0 {
+		t.Errorf("initial failures = %d", n)
+	}
+	n1, err := testRedis.IncrCircuitFailure(ctx, "cr", time.Minute)
+	if err != nil || n1 != 1 {
+		t.Fatalf("first incr = %d %v", n1, err)
+	}
+	n2, _ := testRedis.IncrCircuitFailure(ctx, "cr", time.Minute)
+	if n2 != 2 {
+		t.Errorf("second incr = %d", n2)
+	}
+	if n, _ := testRedis.GetCircuitFailures(ctx, "cr"); n != 2 {
+		t.Errorf("get failures = %d", n)
+	}
+	testRedis.ResetCircuit(ctx, "cr")
+	if n, _ := testRedis.GetCircuitFailures(ctx, "cr"); n != 0 {
+		t.Errorf("failures after reset = %d", n)
+	}
+}
+
+func TestFlushRemote(t *testing.T) {
+	requireRedis(t)
+	ctx := context.Background()
+	testRedis.SetTTL(ctx, "flushme", "a", time.Hour)
+	testRedis.SetETag(ctx, "flushme", "a", "x", time.Hour)
+	if err := testRedis.FlushRemote(ctx, "flushme"); err != nil {
+		t.Fatal(err)
+	}
+	if fresh, _ := testRedis.CheckTTL(ctx, "flushme", "a"); fresh {
+		t.Error("expected keys flushed")
+	}
+}

internal/cache/redis.go

@@ -70,6 +70,18 @@ func (r *Redis) GetETag(ctx context.Context, remote, path string) (string, error
 	return val, err
 }
 
+func (r *Redis) GetToken(ctx context.Context, key string) (string, error) {
+	val, err := r.client.Get(ctx, "token:"+key).Result()
+	if err == redis.Nil {
+		return "", nil
+	}
+	return val, err
+}
+
+func (r *Redis) SetToken(ctx context.Context, key, token string, ttl time.Duration) error {
+	return r.client.Set(ctx, "token:"+key, token, ttl).Err()
+}
+
 func (r *Redis) IncrCircuitFailure(ctx context.Context, remote string, cooldown time.Duration) (int64, error) {
 	key := fmt.Sprintf("circuit:%s", remote)
 	pipe := r.client.Pipeline()

internal/config/env.go

@@ -24,6 +24,38 @@ type Config struct {
 	S3Bucket    string
 	S3Secure    bool
 	S3Region    string
+
+	// Terraform provider registry signing. When TFSigningKeyPath points at a
+	// readable armored GPG private key, artifactapi serves local terraform
+	// repos as a real provider registry (service discovery + signed
+	// SHA256SUMS). Left empty, the registry endpoints stay disabled.
+	TFSigningKeyPath       string
+	TFSigningKeyPassphrase string
+	TFProviderProtocols    string
+
+	// github_rpm background syncer. The syncer keeps derived RPM metadata for
+	// every github_rpm remote fresh off the client request path, sharing a
+	// single global token-bucket limiter across all remotes so GitHub is never
+	// hammered. Defaults are conservative: 1 req/s (3600/hr) sits well under an
+	// authenticated token's 5000/hr. Unauthenticated remotes (60/hr) lean on
+	// ETag/304 — an unchanged repo costs nothing — so keep those repos small or
+	// configure a token.
+	GitHubSyncRatePerSec   float64
+	GitHubSyncBurst        int
+	GitHubSyncWorkers      int
+	GitHubSyncPollInterval int
+
+	// Server-level GitHub machine credential, applied by default to every
+	// outbound GitHub request (releases scan, ranged asset fetches, and the
+	// generic-github byte proxy for private assets). Delivered via env/secret
+	// only — never stored per-remote, never returned by an API, never logged.
+	// Configure exactly one mode: a Personal Access Token, or a GitHub App
+	// (id + installation id + private key). Partial App config fails at startup.
+	GitHubToken             string
+	GitHubAppID             string
+	GitHubAppInstallationID string
+	GitHubAppPrivateKey     string
+	GitHubAppPrivateKeyPath string
 }
 
 func (c *Config) DatabaseDSN() string {
@@ -41,6 +73,23 @@ func Load() (*Config, error) {
 
 	s3Secure, _ := strconv.ParseBool(getenv("MINIO_SECURE", "false"))
 
+	syncRate, err := strconv.ParseFloat(getenv("GITHUB_SYNC_RATE", "1"), 64)
+	if err != nil {
+		return nil, fmt.Errorf("invalid GITHUB_SYNC_RATE: %w", err)
+	}
+	syncBurst, err := strconv.Atoi(getenv("GITHUB_SYNC_BURST", "5"))
+	if err != nil {
+		return nil, fmt.Errorf("invalid GITHUB_SYNC_BURST: %w", err)
+	}
+	syncWorkers, err := strconv.Atoi(getenv("GITHUB_SYNC_WORKERS", "3"))
+	if err != nil {
+		return nil, fmt.Errorf("invalid GITHUB_SYNC_WORKERS: %w", err)
+	}
+	syncPoll, err := strconv.Atoi(getenv("GITHUB_SYNC_POLL_INTERVAL", "60"))
+	if err != nil {
+		return nil, fmt.Errorf("invalid GITHUB_SYNC_POLL_INTERVAL: %w", err)
+	}
+
 	cfg := &Config{
 		ListenAddr: getenv("LISTEN_ADDR", ":8000"),
 
@@ -59,13 +108,28 @@ func Load() (*Config, error) {
 		S3Bucket:    getenv("MINIO_BUCKET", "artifacts"),
 		S3Secure:    s3Secure,
 		S3Region:    getenv("MINIO_REGION", ""),
+
+		TFSigningKeyPath:       getenv("TF_SIGNING_KEY_PATH", ""),
+		TFSigningKeyPassphrase: getenv("TF_SIGNING_KEY_PASSPHRASE", ""),
+		TFProviderProtocols:    getenv("TF_PROVIDER_PROTOCOLS", "5.0,6.0"),
+
+		GitHubSyncRatePerSec:   syncRate,
+		GitHubSyncBurst:        syncBurst,
+		GitHubSyncWorkers:      syncWorkers,
+		GitHubSyncPollInterval: syncPoll,
+
+		GitHubToken:             getenv("GITHUB_TOKEN", ""),
+		GitHubAppID:             getenv("GITHUB_APP_ID", ""),
+		GitHubAppInstallationID: getenv("GITHUB_APP_INSTALLATION_ID", ""),
+		GitHubAppPrivateKey:     getenv("GITHUB_APP_PRIVATE_KEY", ""),
+		GitHubAppPrivateKeyPath: getenv("GITHUB_APP_PRIVATE_KEY_PATH", ""),
 	}
 
 	return cfg, nil
 }
 
 func getenv(key, fallback string) string {
-	if v := os.Getenv(key); v != "" {
+	if v, ok := os.LookupEnv(key); ok {
 		return v
 	}
 	return fallback

internal/config/env_test.go

@@ -0,0 +1,66 @@
+package config
+
+import (
+	"os"
+	"testing"
+)
+
+func TestLoadDefaults(t *testing.T) {
+	// Unset the vars Load reads so the fallback defaults are exercised.
+	for _, k := range []string{
+		"LISTEN_ADDR", "DBHOST", "DBPORT", "DBUSER", "DBPASS", "DBNAME", "DBSSL",
+		"REDIS_URL", "MINIO_ENDPOINT", "MINIO_ACCESS_KEY", "MINIO_SECRET_KEY",
+		"MINIO_BUCKET", "MINIO_SECURE", "MINIO_REGION",
+	} {
+		old, ok := os.LookupEnv(k)
+		os.Unsetenv(k)
+		if ok {
+			t.Cleanup(func() { os.Setenv(k, old) })
+		}
+	}
+
+	cfg, err := Load()
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	if cfg.ListenAddr != ":8000" || cfg.DBPort != 5432 || cfg.DBUser != "artifacts" {
+		t.Errorf("unexpected defaults: %+v", cfg)
+	}
+	if cfg.RedisURL != "redis://localhost:6379" || cfg.S3Bucket != "artifacts" || cfg.S3Secure {
+		t.Errorf("unexpected defaults: %+v", cfg)
+	}
+}
+
+func TestLoadOverrides(t *testing.T) {
+	t.Setenv("LISTEN_ADDR", ":9999")
+	t.Setenv("DBHOST", "db.example.com")
+	t.Setenv("DBPORT", "6000")
+	t.Setenv("DBUSER", "u")
+	t.Setenv("DBPASS", "pw")
+	t.Setenv("DBNAME", "n")
+	t.Setenv("DBSSL", "require")
+	t.Setenv("MINIO_SECURE", "true")
+	t.Setenv("MINIO_REGION", "us-east-1")
+
+	cfg, err := Load()
+	if err != nil {
+		t.Fatalf("load: %v", err)
+	}
+	if cfg.ListenAddr != ":9999" || cfg.DBHost != "db.example.com" || cfg.DBPort != 6000 {
+		t.Errorf("overrides not applied: %+v", cfg)
+	}
+	if !cfg.S3Secure {
+		t.Error("MINIO_SECURE=true not parsed")
+	}
+	want := "postgres://u:pw@db.example.com:6000/n?sslmode=require"
+	if got := cfg.DatabaseDSN(); got != want {
+		t.Errorf("DSN = %q, want %q", got, want)
+	}
+}
+
+func TestLoadInvalidPort(t *testing.T) {
+	t.Setenv("DBPORT", "not-a-number")
+	if _, err := Load(); err == nil {
+		t.Error("expected error for invalid DBPORT")
+	}
+}

internal/database/artifacts.go

@@ -4,6 +4,8 @@ import (
 	"context"
 	"time"
 
+	"github.com/jackc/pgx/v5"
+
 	"git.unkin.net/unkin/artifactapi/pkg/models"
 )
 
@@ -109,16 +111,49 @@ func (db *DB) InsertAccessLog(ctx context.Context, remoteName, path string, cach
 	return err
 }
 
-func (db *DB) FindOrphanedBlobs(ctx context.Context) ([]models.Blob, error) {
+// AccessLogEntry is one buffered access-log record.
+type AccessLogEntry struct {
+	RemoteName string
+	Path       string
+	CacheHit   bool
+	SizeBytes  int64
+	UpstreamMS int
+	ClientIP   string
+}
+
+// InsertAccessLogBatch bulk-inserts access-log rows with a single COPY.
+func (db *DB) InsertAccessLogBatch(ctx context.Context, entries []AccessLogEntry) error {
+	if len(entries) == 0 {
+		return nil
+	}
+	rows := make([][]any, len(entries))
+	for i, e := range entries {
+		rows[i] = []any{e.RemoteName, e.Path, e.CacheHit, e.SizeBytes, e.UpstreamMS, e.ClientIP}
+	}
+	_, err := db.Pool.CopyFrom(ctx,
+		pgx.Identifier{"access_log"},
+		[]string{"remote_name", "path", "cache_hit", "size_bytes", "upstream_ms", "client_ip"},
+		pgx.CopyFromRows(rows),
+	)
+	return err
+}
+
+// FindOrphanedBlobs returns blobs no longer referenced by any artifact or
+// local file, restricted to those created before now()-minAge. The age cutoff
+// is a grace period that avoids a TOCTOU race with in-flight dedup uploads,
+// which insert the blob row before the referencing artifact/local_files row.
+func (db *DB) FindOrphanedBlobs(ctx context.Context, minAge time.Duration) ([]models.Blob, error) {
+	cutoff := time.Now().Add(-minAge)
 	rows, err := db.Pool.Query(ctx, `
 		SELECT b.content_hash, b.s3_key, b.size_bytes, b.content_type, b.created_at
 		FROM blobs b
-		WHERE b.content_hash NOT IN (
+		WHERE b.created_at < $1
+		  AND b.content_hash NOT IN (
 			SELECT content_hash FROM artifacts
 			UNION
 			SELECT content_hash FROM local_files
 		)
-	`)
+	`, cutoff)
 	if err != nil {
 		return nil, err
 	}

internal/database/database_test.go

@@ -0,0 +1,334 @@
+package database
+
+import (
+	"context"
+	"os"
+	"testing"
+	"time"
+
+	"git.unkin.net/unkin/artifactapi/internal/provider"
+	"git.unkin.net/unkin/artifactapi/internal/testsupport"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+var (
+	testDB  *DB
+	testDSN string
+)
+
+func TestMain(m *testing.M) {
+	c := context.Background()
+	dsn, terminate, err := testsupport.StartPostgres(c)
+	if err != nil {
+		// Docker unavailable: run anyway so tests self-skip via requireDB.
+		os.Exit(m.Run())
+	}
+	testDSN = dsn
+	db, err := New(dsn)
+	if err != nil {
+		terminate()
+		panic(err)
+	}
+	testDB = db
+
+	code := m.Run()
+
+	db.Close()
+	terminate()
+	// Return normally on success so the coverage profile is flushed; os.Exit
+	// would truncate it.
+	if code != 0 {
+		os.Exit(code)
+	}
+}
+
+func requireDB(t *testing.T) {
+	t.Helper()
+	if testDB == nil {
+		t.Skip("Docker unavailable; skipping database integration test")
+	}
+}
+
+func ctx() context.Context { return context.Background() }
+
+func seedRemote(t *testing.T, name string) {
+	t.Helper()
+	if err := testDB.CreateRemote(ctx(), &models.Remote{
+		Name: name, PackageType: models.PackageGeneric, RepoType: models.RepoTypeRemote,
+		BaseURL: "https://example.com", MutableTTL: 3600,
+	}); err != nil {
+		t.Fatalf("seed remote: %v", err)
+	}
+}
+
+// seedBlob inserts a blob and returns its full content hash (sha256:<hash>),
+// matching the reference convention used by artifacts and local files.
+func seedBlob(t *testing.T, hash string) string {
+	t.Helper()
+	full := "sha256:" + hash
+	if err := testDB.UpsertBlob(ctx(), full, "blobs/sha256/"+hash, 10, "application/octet-stream"); err != nil {
+		t.Fatalf("seed blob: %v", err)
+	}
+	return full
+}
+
+func TestRemotesCRUD(t *testing.T) {
+	requireDB(t)
+	seedRemote(t, "r-crud")
+	got, err := testDB.GetRemote(ctx(), "r-crud")
+	if err != nil || got.BaseURL != "https://example.com" {
+		t.Fatalf("get: %v %v", got, err)
+	}
+	got.BaseURL = "https://updated.example.com"
+	if err := testDB.UpdateRemote(ctx(), got); err != nil {
+		t.Fatalf("update: %v", err)
+	}
+	got, _ = testDB.GetRemote(ctx(), "r-crud")
+	if got.BaseURL != "https://updated.example.com" {
+		t.Errorf("update not applied: %v", got.BaseURL)
+	}
+	list, err := testDB.ListRemotes(ctx())
+	if err != nil || len(list) == 0 {
+		t.Fatalf("list: %v %v", len(list), err)
+	}
+	if err := testDB.DeleteRemote(ctx(), "r-crud"); err != nil {
+		t.Fatalf("delete: %v", err)
+	}
+	if _, err := testDB.GetRemote(ctx(), "r-crud"); err == nil {
+		t.Error("expected error after delete")
+	}
+}
+
+func TestArtifactsAndBlobs(t *testing.T) {
+	requireDB(t)
+	seedRemote(t, "r-art")
+	seedBlob(t, "aaaa")
+	hash := "sha256:aaaa"
+	if err := testDB.UpsertBlob(ctx(), hash, "blobs/sha256/aaaa", 10, "text/plain"); err != nil {
+		t.Fatal(err)
+	}
+	if err := testDB.UpsertArtifact(ctx(), "r-art", "path/a.txt", hash, "etag1"); err != nil {
+		t.Fatal(err)
+	}
+	// Upsert again to exercise the ON CONFLICT update branch.
+	if err := testDB.UpsertArtifact(ctx(), "r-art", "path/a.txt", hash, "etag2"); err != nil {
+		t.Fatal(err)
+	}
+	art, err := testDB.GetArtifact(ctx(), "r-art", "path/a.txt")
+	if err != nil || art.ContentHash != hash {
+		t.Fatalf("get artifact: %v %v", art, err)
+	}
+	if err := testDB.TouchArtifactAccess(ctx(), "r-art", "path/a.txt"); err != nil {
+		t.Fatal(err)
+	}
+	arts, err := testDB.ListArtifacts(ctx(), "r-art", 10, 0)
+	if err != nil || len(arts) != 1 {
+		t.Fatalf("list artifacts: %v %v", len(arts), err)
+	}
+	if err := testDB.InsertAccessLog(ctx(), "r-art", "path/a.txt", true, 10, 5, "1.2.3.4"); err != nil {
+		t.Fatal(err)
+	}
+	if err := testDB.InsertAccessLogBatch(ctx(), []AccessLogEntry{
+		{RemoteName: "r-art", Path: "b", CacheHit: false, SizeBytes: 20, UpstreamMS: 3},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	if err := testDB.InsertAccessLogBatch(ctx(), nil); err != nil {
+		t.Fatalf("empty batch should be a no-op: %v", err)
+	}
+	if err := testDB.DeleteArtifact(ctx(), "r-art", "path/a.txt"); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestOrphanAndColdCleanup(t *testing.T) {
+	requireDB(t)
+	seedBlob(t, "orphanhash")
+	// A blob with no artifact/local_file reference is orphaned, but only past
+	// the grace period.
+	if got, _ := testDB.FindOrphanedBlobs(ctx(), time.Hour); containsHash(got, "sha256:orphanhash") {
+		t.Error("fresh orphan should be excluded by grace period")
+	}
+	orphans, err := testDB.FindOrphanedBlobs(ctx(), -time.Hour) // cutoff in the future => include fresh
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !containsHash(orphans, "sha256:orphanhash") {
+		t.Error("expected orphan to be found with zero grace")
+	}
+	if err := testDB.DeleteBlob(ctx(), "sha256:orphanhash"); err != nil {
+		t.Fatal(err)
+	}
+
+	seedRemote(t, "r-cold")
+	seedBlob(t, "coldhash")
+	testDB.UpsertArtifact(ctx(), "r-cold", "cold.txt", "sha256:coldhash", "")
+	n, err := testDB.DeleteColdArtifacts(ctx(), "r-cold", -time.Hour) // negative => everything is "cold"
+	if err != nil || n < 1 {
+		t.Fatalf("delete cold: n=%d err=%v", n, err)
+	}
+}
+
+func containsHash(blobs []models.Blob, hash string) bool {
+	for _, b := range blobs {
+		if b.ContentHash == hash {
+			return true
+		}
+	}
+	return false
+}
+
+func TestLocalFiles(t *testing.T) {
+	requireDB(t)
+	seedRemote(t, "r-local")
+	seedBlob(t, "localhash")
+	hash := "sha256:localhash"
+	if err := testDB.CreateLocalFile(ctx(), "r-local", "foo/foo-1.0.whl", hash); err != nil {
+		t.Fatal(err)
+	}
+	// Duplicate create must be rejected.
+	if err := testDB.CreateLocalFile(ctx(), "r-local", "foo/foo-1.0.whl", hash); err == nil {
+		t.Error("expected duplicate local file error")
+	}
+	f, err := testDB.GetLocalFile(ctx(), "r-local", "foo/foo-1.0.whl")
+	if err != nil || f == nil {
+		t.Fatalf("get local file: %v %v", f, err)
+	}
+	if files, err := testDB.ListLocalFiles(ctx(), "r-local", 10, 0); err != nil || len(files) != 1 {
+		t.Fatalf("list: %v %v", len(files), err)
+	}
+	if files, err := testDB.ListLocalFilesByPrefix(ctx(), "r-local", "foo/"); err != nil || len(files) != 1 {
+		t.Fatalf("list by prefix: %v %v", len(files), err)
+	}
+	if entries, err := testDB.ListFilesByPrefix(ctx(), "r-local", "foo/"); err != nil || len(entries) != 1 {
+		t.Fatalf("provider list by prefix: %v %v", len(entries), err)
+	}
+	if pkgs, err := testDB.ListLocalFilePackages(ctx(), "r-local"); err != nil || len(pkgs) == 0 {
+		t.Fatalf("list packages: %v %v", pkgs, err)
+	}
+	if pkgs, err := testDB.ListPackages(ctx(), "r-local"); err != nil || len(pkgs) == 0 {
+		t.Fatalf("provider list packages: %v %v", pkgs, err)
+	}
+	if err := testDB.DeleteLocalFile(ctx(), "r-local", "foo/foo-1.0.whl"); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestVirtualsCRUD(t *testing.T) {
+	requireDB(t)
+	if err := testDB.CreateVirtual(ctx(), &models.Virtual{
+		Name: "v-crud", PackageType: models.PackageHelm, Members: []string{"a", "b"},
+	}); err != nil {
+		t.Fatal(err)
+	}
+	v, err := testDB.GetVirtual(ctx(), "v-crud")
+	if err != nil || len(v.Members) != 2 {
+		t.Fatalf("get virtual: %v %v", v, err)
+	}
+	v.Members = []string{"a"}
+	if err := testDB.UpdateVirtual(ctx(), v); err != nil {
+		t.Fatal(err)
+	}
+	if vs, err := testDB.ListVirtuals(ctx()); err != nil || len(vs) == 0 {
+		t.Fatalf("list virtuals: %v %v", len(vs), err)
+	}
+	if err := testDB.DeleteVirtual(ctx(), "v-crud"); err != nil {
+		t.Fatal(err)
+	}
+}
+
+func TestStats(t *testing.T) {
+	requireDB(t)
+	seedRemote(t, "r-stats")
+	seedBlob(t, "statshash")
+	testDB.UpsertArtifact(ctx(), "r-stats", "s.txt", "sha256:statshash", "")
+	testDB.InsertAccessLog(ctx(), "r-stats", "s.txt", true, 100, 2, "")
+
+	if _, err := testDB.GetOverviewStats(ctx()); err != nil {
+		t.Fatalf("overview: %v", err)
+	}
+	if _, err := testDB.GetTopRemotes(ctx(), 5); err != nil {
+		t.Fatalf("top remotes: %v", err)
+	}
+	if _, err := testDB.GetTopFilesByHits(ctx(), 5); err != nil {
+		t.Fatalf("top files by hits: %v", err)
+	}
+	if _, err := testDB.GetTopFilesByBandwidth(ctx(), 5); err != nil {
+		t.Fatalf("top files by bandwidth: %v", err)
+	}
+}
+
+func TestDatabaseErrorPaths(t *testing.T) {
+	requireDB(t)
+	bad, err := New(testDSN)
+	if err != nil {
+		t.Fatal(err)
+	}
+	bad.Close() // every query now fails
+	ctx := context.Background()
+
+	if _, err := bad.ListRemotes(ctx); err == nil {
+		t.Error("ListRemotes should error on closed db")
+	}
+	if _, err := bad.ListVirtuals(ctx); err == nil {
+		t.Error("ListVirtuals should error")
+	}
+	if _, err := bad.ListArtifacts(ctx, "r", 10, 0); err == nil {
+		t.Error("ListArtifacts should error")
+	}
+	if _, err := bad.ListLocalFiles(ctx, "r", 10, 0); err == nil {
+		t.Error("ListLocalFiles should error")
+	}
+	if _, err := bad.ListLocalFilesByPrefix(ctx, "r", "p"); err == nil {
+		t.Error("ListLocalFilesByPrefix should error")
+	}
+	if _, err := bad.ListLocalFilePackages(ctx, "r"); err == nil {
+		t.Error("ListLocalFilePackages should error")
+	}
+	if _, err := bad.ListFilesByPrefix(ctx, "r", "p"); err == nil {
+		t.Error("ListFilesByPrefix should error")
+	}
+	if _, err := bad.ListPackages(ctx, "r"); err == nil {
+		t.Error("ListPackages should error")
+	}
+	if _, err := bad.FindOrphanedBlobs(ctx, 0); err == nil {
+		t.Error("FindOrphanedBlobs should error")
+	}
+	if _, err := bad.GetOverviewStats(ctx); err == nil {
+		t.Error("GetOverviewStats should error")
+	}
+	if _, err := bad.GetTopRemotes(ctx, 5); err == nil {
+		t.Error("GetTopRemotes should error")
+	}
+	if _, err := bad.GetTopFilesByHits(ctx, 5); err == nil {
+		t.Error("GetTopFilesByHits should error")
+	}
+	if _, err := bad.GetTopFilesByBandwidth(ctx, 5); err == nil {
+		t.Error("GetTopFilesByBandwidth should error")
+	}
+	if _, err := bad.ListRPMMetadataEntries(ctx, "r"); err == nil {
+		t.Error("ListRPMMetadataEntries should error")
+	}
+}
+
+func TestRPMMetadata(t *testing.T) {
+	requireDB(t)
+	seedRemote(t, "r-rpm")
+	meta := &provider.RPMMetadata{
+		RepoName: "r-rpm", FilePath: "Packages/x.rpm", ContentHash: "sha256:rpm",
+		Name: "x", Version: "1.0", Release: "1", Arch: "noarch",
+		Requires: []provider.RPMDep{{Name: "libc"}},
+		Provides: []provider.RPMDep{{Name: "x"}},
+		Files:    []provider.RPMFile{},
+	}
+	if err := testDB.InsertRPMMetadata(ctx(), meta); err != nil {
+		t.Fatal(err)
+	}
+	entries, err := testDB.ListRPMMetadataEntries(ctx(), "r-rpm")
+	if err != nil || len(entries) != 1 {
+		t.Fatalf("list rpm entries: %v %v", len(entries), err)
+	}
+	if rows, err := testDB.ListRPMMetadata(ctx(), "r-rpm"); err != nil || len(rows) != 1 {
+		t.Fatalf("list rpm rows: %v %v", len(rows), err)
+	}
+}

internal/database/github_sync.go

@@ -0,0 +1,73 @@
+package database
+
+import (
+	"context"
+	"errors"
+	"time"
+
+	"github.com/jackc/pgx/v5"
+
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+// ListGitHubRPMRemotes returns every github_rpm remote so the syncer can sweep
+// them on each poll tick.
+func (db *DB) ListGitHubRPMRemotes(ctx context.Context) ([]models.Remote, error) {
+	rows, err := db.Pool.Query(ctx, `SELECT `+remoteCols+` FROM remotes WHERE package_type = $1 ORDER BY name`, models.PackageGitHubRPM)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var remotes []models.Remote
+	for rows.Next() {
+		var r models.Remote
+		if err := scanRemote(rows, &r); err != nil {
+			return nil, err
+		}
+		remotes = append(remotes, r)
+	}
+	return remotes, rows.Err()
+}
+
+// ClaimGitHubSyncLease atomically claims the per-remote sync lease. It succeeds
+// (claimed=true) only when the remote is due — never synced, or synced longer
+// than freshness ago — and no live lease is held by another replica. This bounds
+// total GitHub load to roughly one scan per freshness window regardless of how
+// many replicas poll. The returned etag is the stored releases-list ETag, shared
+// across replicas so a conditional request can short-circuit an unchanged repo.
+// A zero freshness (used for prime scans) ignores the recency gate and claims
+// whenever no live lease is held.
+func (db *DB) ClaimGitHubSyncLease(ctx context.Context, remoteName, owner string, freshness, lease time.Duration) (bool, string, error) {
+	row := db.Pool.QueryRow(ctx, `
+		INSERT INTO github_rpm_sync_state AS s (remote_name, sync_lease_owner, sync_lease_expires)
+		VALUES ($1, $2, now() + make_interval(secs => $4))
+		ON CONFLICT (remote_name) DO UPDATE
+			SET sync_lease_owner   = $2,
+			    sync_lease_expires = now() + make_interval(secs => $4)
+			WHERE (s.last_synced_at IS NULL OR s.last_synced_at < now() - make_interval(secs => $3))
+			  AND (s.sync_lease_expires IS NULL OR s.sync_lease_expires < now())
+		RETURNING s.etag
+	`, remoteName, owner, freshness.Seconds(), lease.Seconds())
+
+	var etag string
+	if err := row.Scan(&etag); err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return false, "", nil
+		}
+		return false, "", err
+	}
+	return true, etag, nil
+}
+
+// ReleaseGitHubSyncLease records the completed scan and frees the lease. Only the
+// owning replica may release; last_synced_at advances so the next poll waits a
+// full freshness window, and etag is persisted for the next conditional request.
+func (db *DB) ReleaseGitHubSyncLease(ctx context.Context, remoteName, owner, etag string, syncedAt time.Time) error {
+	_, err := db.Pool.Exec(ctx, `
+		UPDATE github_rpm_sync_state
+		   SET last_synced_at = $3, etag = $4, sync_lease_owner = '', sync_lease_expires = NULL
+		 WHERE remote_name = $1 AND sync_lease_owner = $2
+	`, remoteName, owner, syncedAt, etag)
+	return err
+}

internal/database/github_sync_test.go

@@ -0,0 +1,95 @@
+package database
+
+import (
+	"testing"
+	"time"
+
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+func seedGitHubRPMRemote(t *testing.T, name string) {
+	t.Helper()
+	if err := testDB.CreateRemote(ctx(), &models.Remote{
+		Name: name, PackageType: models.PackageGitHubRPM, RepoType: models.RepoTypeRemote,
+		BaseURL: "https://api.github.com/repos/acme/tools", ReleasesRemote: "github", MutableTTL: 3600,
+	}); err != nil {
+		t.Fatalf("seed github_rpm remote: %v", err)
+	}
+}
+
+// TestGitHubSyncLease exercises the real SQL: exactly one replica may hold the
+// lease, the recency window blocks a too-soon periodic re-claim, and a prime
+// (freshness 0) bypasses recency but still respects a live lease.
+func TestGitHubSyncLease(t *testing.T) {
+	requireDB(t)
+	name := "gh-lease-" + time.Now().Format("150405.000000")
+	seedGitHubRPMRemote(t, name)
+
+	const lease = 15 * time.Minute
+	freshness := time.Hour
+
+	// First claim on a never-synced remote wins; etag starts empty.
+	claimed, etag, err := testDB.ClaimGitHubSyncLease(ctx(), name, "replica-1", freshness, lease)
+	if err != nil || !claimed {
+		t.Fatalf("replica-1 first claim: claimed=%v err=%v", claimed, err)
+	}
+	if etag != "" {
+		t.Fatalf("initial etag should be empty, got %q", etag)
+	}
+
+	// A second replica cannot claim while the lease is held.
+	claimed2, _, err := testDB.ClaimGitHubSyncLease(ctx(), name, "replica-2", freshness, lease)
+	if err != nil {
+		t.Fatalf("replica-2 claim err: %v", err)
+	}
+	if claimed2 {
+		t.Fatal("replica-2 claimed while replica-1 holds the lease")
+	}
+
+	// Replica 1 finishes: record the sync and persist an etag.
+	if err := testDB.ReleaseGitHubSyncLease(ctx(), name, "replica-1", `"etag-1"`, time.Now()); err != nil {
+		t.Fatalf("release: %v", err)
+	}
+
+	// A periodic re-claim inside the freshness window is blocked by recency.
+	claimed3, _, err := testDB.ClaimGitHubSyncLease(ctx(), name, "replica-2", freshness, lease)
+	if err != nil {
+		t.Fatalf("replica-2 recency claim err: %v", err)
+	}
+	if claimed3 {
+		t.Fatal("periodic claim succeeded inside the freshness window")
+	}
+
+	// A prime (freshness 0) bypasses recency and reads the persisted etag.
+	claimed4, etag4, err := testDB.ClaimGitHubSyncLease(ctx(), name, "replica-2", 0, lease)
+	if err != nil || !claimed4 {
+		t.Fatalf("prime claim: claimed=%v err=%v", claimed4, err)
+	}
+	if etag4 != `"etag-1"` {
+		t.Fatalf("prime claim etag = %q, want persisted \"etag-1\"", etag4)
+	}
+}
+
+func TestListGitHubRPMRemotes(t *testing.T) {
+	requireDB(t)
+	name := "gh-list-" + time.Now().Format("150405.000000")
+	seedGitHubRPMRemote(t, name)
+	seedRemote(t, "generic-"+time.Now().Format("150405.000000"))
+
+	remotes, err := testDB.ListGitHubRPMRemotes(ctx())
+	if err != nil {
+		t.Fatalf("list: %v", err)
+	}
+	found := false
+	for _, r := range remotes {
+		if r.PackageType != models.PackageGitHubRPM {
+			t.Fatalf("non-github_rpm remote returned: %s (%s)", r.Name, r.PackageType)
+		}
+		if r.Name == name {
+			found = true
+		}
+	}
+	if !found {
+		t.Fatalf("seeded remote %q not returned", name)
+	}
+}

internal/database/local_files.go

@@ -10,6 +10,7 @@ import (
 	"github.com/jackc/pgx/v5/pgconn"
 
 	"git.unkin.net/unkin/artifactapi/internal/provider"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
 )
 
 type LocalFile struct {
@@ -37,6 +38,20 @@ func (db *DB) CreateLocalFile(ctx context.Context, repoName, filePath, contentHa
 	return nil
 }
 
+// UpsertLocalFile inserts a local file or repoints an existing path at a new
+// blob. Unlike CreateLocalFile it never errors on a duplicate path — it is for
+// mutable references such as Docker tags, where re-pushing a tag must move it to
+// the newly-pushed manifest rather than being rejected as an overwrite.
+func (db *DB) UpsertLocalFile(ctx context.Context, repoName, filePath, contentHash string) error {
+	_, err := db.Pool.Exec(ctx, `
+		INSERT INTO local_files (repo_name, file_path, content_hash)
+		VALUES ($1, $2, $3)
+		ON CONFLICT (repo_name, file_path)
+		DO UPDATE SET content_hash = EXCLUDED.content_hash, created_at = NOW()
+	`, repoName, filePath, contentHash)
+	return err
+}
+
 func (db *DB) GetLocalFile(ctx context.Context, repoName, filePath string) (*LocalFile, error) {
 	row := db.Pool.QueryRow(ctx, `
 		SELECT id, repo_name, file_path, content_hash, created_at
@@ -78,6 +93,40 @@ func (db *DB) ListLocalFiles(ctx context.Context, repoName string, limit, offset
 	return files, rows.Err()
 }
 
+// ListLocalArtifacts returns a repo's local files shaped as models.Artifact so
+// the UI's cached-objects view can render them the same way as remote artifacts.
+// Local files carry no access/fetch counters, so those are left at zero and the
+// timestamps are all derived from created_at.
+func (db *DB) ListLocalArtifacts(ctx context.Context, repoName string, limit, offset int) ([]models.Artifact, error) {
+	rows, err := db.Pool.Query(ctx, `
+		SELECT lf.id, lf.repo_name, lf.file_path, lf.content_hash,
+			lf.created_at, b.size_bytes, b.content_type
+		FROM local_files lf
+		JOIN blobs b ON lf.content_hash = b.content_hash
+		WHERE lf.repo_name = $1
+		ORDER BY lf.file_path
+		LIMIT $2 OFFSET $3
+	`, repoName, limit, offset)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var artifacts []models.Artifact
+	for rows.Next() {
+		var a models.Artifact
+		var createdAt time.Time
+		if err := rows.Scan(&a.ID, &a.RemoteName, &a.Path, &a.ContentHash, &createdAt, &a.SizeBytes, &a.ContentType); err != nil {
+			return nil, err
+		}
+		a.FirstSeenAt = createdAt
+		a.LastFetchedAt = createdAt
+		a.LastAccessedAt = createdAt
+		artifacts = append(artifacts, a)
+	}
+	return artifacts, rows.Err()
+}
+
 func (db *DB) ListLocalFilesByPrefix(ctx context.Context, repoName, prefix string) ([]LocalFile, error) {
 	rows, err := db.Pool.Query(ctx, `
 		SELECT id, repo_name, file_path, content_hash, created_at

internal/database/postgres.go

@@ -124,6 +124,60 @@ func (db *DB) migrate() error {
 		CREATE INDEX IF NOT EXISTS idx_access_log_remote_time ON access_log(remote_name, created_at);
 
 		ALTER TABLE remotes ADD COLUMN IF NOT EXISTS repo_type TEXT DEFAULT 'remote';
+		ALTER TABLE remotes ADD COLUMN IF NOT EXISTS upstream_dial_timeout INTEGER DEFAULT 0;
+		ALTER TABLE remotes ADD COLUMN IF NOT EXISTS upstream_tls_timeout INTEGER DEFAULT 0;
+		ALTER TABLE remotes ADD COLUMN IF NOT EXISTS upstream_response_header_timeout INTEGER DEFAULT 0;
+
+		CREATE TABLE IF NOT EXISTS rpm_metadata (
+			id              BIGSERIAL PRIMARY KEY,
+			repo_name       TEXT NOT NULL,
+			file_path       TEXT NOT NULL,
+			content_hash    TEXT NOT NULL,
+			name            TEXT NOT NULL,
+			epoch           INTEGER DEFAULT 0,
+			version         TEXT NOT NULL,
+			release         TEXT NOT NULL,
+			arch            TEXT NOT NULL,
+			summary         TEXT DEFAULT '',
+			description     TEXT DEFAULT '',
+			rpm_size        BIGINT DEFAULT 0,
+			installed_size  BIGINT DEFAULT 0,
+			license         TEXT DEFAULT '',
+			vendor          TEXT DEFAULT '',
+			build_group     TEXT DEFAULT '',
+			build_host      TEXT DEFAULT '',
+			source_rpm      TEXT DEFAULT '',
+			url             TEXT DEFAULT '',
+			packager        TEXT DEFAULT '',
+			requires        JSONB DEFAULT '[]',
+			provides        JSONB DEFAULT '[]',
+			conflicts       JSONB DEFAULT '[]',
+			obsoletes       JSONB DEFAULT '[]',
+			files           JSONB DEFAULT '[]',
+			changelogs      JSONB DEFAULT '[]',
+			created_at      TIMESTAMPTZ DEFAULT NOW(),
+			UNIQUE(repo_name, file_path)
+		);
+
+		CREATE INDEX IF NOT EXISTS idx_rpm_metadata_repo ON rpm_metadata(repo_name);
+
+		ALTER TABLE rpm_metadata ADD COLUMN IF NOT EXISTS conflicts JSONB DEFAULT '[]';
+		ALTER TABLE rpm_metadata ADD COLUMN IF NOT EXISTS obsoletes JSONB DEFAULT '[]';
+
+		CREATE TABLE IF NOT EXISTS github_rpm_sync_state (
+			remote_name        TEXT PRIMARY KEY,
+			etag               TEXT DEFAULT '',
+			last_synced_at     TIMESTAMPTZ,
+			sync_lease_owner   TEXT DEFAULT '',
+			sync_lease_expires TIMESTAMPTZ
+		);
+
+		CREATE TABLE IF NOT EXISTS signing_keys (
+			purpose             TEXT PRIMARY KEY,
+			private_key_armor   TEXT NOT NULL,
+			key_id              TEXT NOT NULL,
+			created_at          TIMESTAMPTZ DEFAULT NOW()
+		);
 	`)
 	return err
 }

internal/database/remotes.go

@@ -11,7 +11,9 @@ const remoteCols = `name, package_type, repo_type, base_url, description, userna
 	patterns, blocklist, mutable_patterns, immutable_patterns,
 	ban_tags_enabled, ban_tags,
 	quarantine_enabled, quarantine_days, stale_on_error,
-	releases_remote, managed_by, created_at, updated_at`
+	releases_remote, managed_by,
+	upstream_dial_timeout, upstream_tls_timeout, upstream_response_header_timeout,
+	created_at, updated_at`
 
 func scanRemote(scanner interface{ Scan(...any) error }, r *models.Remote) error {
 	return scanner.Scan(
@@ -20,7 +22,9 @@ func scanRemote(scanner interface{ Scan(...any) error }, r *models.Remote) error
 		&r.Patterns, &r.Blocklist, &r.MutablePatterns, &r.ImmutablePatterns,
 		&r.BanTagsEnabled, &r.BanTags,
 		&r.QuarantineEnabled, &r.QuarantineDays, &r.StaleOnError,
-		&r.ReleasesRemote, &r.ManagedBy, &r.CreatedAt, &r.UpdatedAt,
+		&r.ReleasesRemote, &r.ManagedBy,
+		&r.UpstreamDialTimeout, &r.UpstreamTLSTimeout, &r.UpstreamResponseHeaderTimeout,
+		&r.CreatedAt, &r.UpdatedAt,
 	)
 }
 
@@ -59,8 +63,9 @@ func (db *DB) CreateRemote(ctx context.Context, r *models.Remote) error {
 			patterns, blocklist, mutable_patterns, immutable_patterns,
 			ban_tags_enabled, ban_tags,
 			quarantine_enabled, quarantine_days, stale_on_error,
-			releases_remote, managed_by
-		) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21)
+			releases_remote, managed_by,
+			upstream_dial_timeout, upstream_tls_timeout, upstream_response_header_timeout
+		) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24)
 	`,
 		r.Name, r.PackageType, r.RepoType, r.BaseURL, r.Description, r.Username, r.Password,
 		r.ImmutableTTL, r.MutableTTL, r.CheckMutable,
@@ -68,6 +73,7 @@ func (db *DB) CreateRemote(ctx context.Context, r *models.Remote) error {
 		r.BanTagsEnabled, r.BanTags,
 		r.QuarantineEnabled, r.QuarantineDays, r.StaleOnError,
 		r.ReleasesRemote, r.ManagedBy,
+		r.UpstreamDialTimeout, r.UpstreamTLSTimeout, r.UpstreamResponseHeaderTimeout,
 	)
 	return err
 }
@@ -80,7 +86,9 @@ func (db *DB) UpdateRemote(ctx context.Context, r *models.Remote) error {
 			patterns=$11, blocklist=$12, mutable_patterns=$13, immutable_patterns=$14,
 			ban_tags_enabled=$15, ban_tags=$16,
 			quarantine_enabled=$17, quarantine_days=$18, stale_on_error=$19,
-			releases_remote=$20, managed_by=$21, updated_at=NOW()
+			releases_remote=$20, managed_by=$21,
+			upstream_dial_timeout=$22, upstream_tls_timeout=$23, upstream_response_header_timeout=$24,
+			updated_at=NOW()
 		WHERE name=$1
 	`,
 		r.Name, r.PackageType, r.RepoType, r.BaseURL, r.Description, r.Username, r.Password,
@@ -89,6 +97,7 @@ func (db *DB) UpdateRemote(ctx context.Context, r *models.Remote) error {
 		r.BanTagsEnabled, r.BanTags,
 		r.QuarantineEnabled, r.QuarantineDays, r.StaleOnError,
 		r.ReleasesRemote, r.ManagedBy,
+		r.UpstreamDialTimeout, r.UpstreamTLSTimeout, r.UpstreamResponseHeaderTimeout,
 	)
 	return err
 }

internal/database/rpm_metadata.go

@@ -0,0 +1,140 @@
+package database
+
+import (
+	"context"
+	"encoding/json"
+
+	"git.unkin.net/unkin/artifactapi/internal/provider"
+)
+
+func (db *DB) InsertRPMMetadata(ctx context.Context, meta *provider.RPMMetadata) error {
+	requiresJSON, _ := json.Marshal(meta.Requires)
+	providesJSON, _ := json.Marshal(meta.Provides)
+	conflictsJSON, _ := json.Marshal(meta.Conflicts)
+	obsoletesJSON, _ := json.Marshal(meta.Obsoletes)
+	filesJSON, _ := json.Marshal(meta.Files)
+	changelogsJSON, _ := json.Marshal(meta.Changelogs)
+
+	_, err := db.Pool.Exec(ctx, `
+		INSERT INTO rpm_metadata (
+			repo_name, file_path, content_hash,
+			name, epoch, version, release, arch,
+			summary, description, rpm_size, installed_size,
+			license, vendor, build_group, build_host, source_rpm, url, packager,
+			requires, provides, conflicts, obsoletes, files, changelogs
+		) VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25)
+		ON CONFLICT (repo_name, file_path) DO NOTHING
+	`,
+		meta.RepoName, meta.FilePath, meta.ContentHash,
+		meta.Name, meta.Epoch, meta.Version, meta.Release, meta.Arch,
+		meta.Summary, meta.Description, meta.RPMSize, meta.InstalledSize,
+		meta.License, meta.Vendor, meta.Group, meta.BuildHost, meta.SourceRPM, meta.URL, meta.Packager,
+		requiresJSON, providesJSON, conflictsJSON, obsoletesJSON, filesJSON, changelogsJSON,
+	)
+	return err
+}
+
+func (db *DB) DeleteRPMMetadata(ctx context.Context, repoName, filePath string) error {
+	_, err := db.Pool.Exec(ctx, `DELETE FROM rpm_metadata WHERE repo_name = $1 AND file_path = $2`, repoName, filePath)
+	return err
+}
+
+type RPMMetadataRow struct {
+	RepoName      string
+	FilePath      string
+	ContentHash   string
+	Name          string
+	Epoch         int
+	Version       string
+	Release       string
+	Arch          string
+	Summary       string
+	Description   string
+	RPMSize       int64
+	InstalledSize int64
+	License       string
+	Vendor        string
+	Group         string
+	BuildHost     string
+	SourceRPM     string
+	URL           string
+	Packager      string
+	Requires      json.RawMessage
+	Provides      json.RawMessage
+	Conflicts     json.RawMessage
+	Obsoletes     json.RawMessage
+	Files         json.RawMessage
+	Changelogs    json.RawMessage
+}
+
+func (db *DB) ListRPMMetadataEntries(ctx context.Context, repoName string) ([]provider.RPMMetadata, error) {
+	rows, err := db.ListRPMMetadata(ctx, repoName)
+	if err != nil {
+		return nil, err
+	}
+	result := make([]provider.RPMMetadata, len(rows))
+	for i, r := range rows {
+		meta := provider.RPMMetadata{
+			RepoName:      r.RepoName,
+			FilePath:      r.FilePath,
+			ContentHash:   r.ContentHash,
+			Name:          r.Name,
+			Epoch:         r.Epoch,
+			Version:       r.Version,
+			Release:       r.Release,
+			Arch:          r.Arch,
+			Summary:       r.Summary,
+			Description:   r.Description,
+			RPMSize:       r.RPMSize,
+			InstalledSize: r.InstalledSize,
+			License:       r.License,
+			Vendor:        r.Vendor,
+			Group:         r.Group,
+			BuildHost:     r.BuildHost,
+			SourceRPM:     r.SourceRPM,
+			URL:           r.URL,
+			Packager:      r.Packager,
+		}
+		json.Unmarshal(r.Requires, &meta.Requires)
+		json.Unmarshal(r.Provides, &meta.Provides)
+		json.Unmarshal(r.Conflicts, &meta.Conflicts)
+		json.Unmarshal(r.Obsoletes, &meta.Obsoletes)
+		json.Unmarshal(r.Files, &meta.Files)
+		json.Unmarshal(r.Changelogs, &meta.Changelogs)
+		result[i] = meta
+	}
+	return result, nil
+}
+
+func (db *DB) ListRPMMetadata(ctx context.Context, repoName string) ([]RPMMetadataRow, error) {
+	rows, err := db.Pool.Query(ctx, `
+		SELECT repo_name, file_path, content_hash,
+			name, epoch, version, release, arch,
+			summary, description, rpm_size, installed_size,
+			license, vendor, build_group, build_host, source_rpm, url, packager,
+			requires, provides, conflicts, obsoletes, files, changelogs
+		FROM rpm_metadata
+		WHERE repo_name = $1
+		ORDER BY name, epoch, version, release, arch
+	`, repoName)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var result []RPMMetadataRow
+	for rows.Next() {
+		var r RPMMetadataRow
+		if err := rows.Scan(
+			&r.RepoName, &r.FilePath, &r.ContentHash,
+			&r.Name, &r.Epoch, &r.Version, &r.Release, &r.Arch,
+			&r.Summary, &r.Description, &r.RPMSize, &r.InstalledSize,
+			&r.License, &r.Vendor, &r.Group, &r.BuildHost, &r.SourceRPM, &r.URL, &r.Packager,
+			&r.Requires, &r.Provides, &r.Conflicts, &r.Obsoletes, &r.Files, &r.Changelogs,
+		); err != nil {
+			return nil, err
+		}
+		result = append(result, r)
+	}
+	return result, rows.Err()
+}

internal/database/signing_keys.go

@@ -0,0 +1,35 @@
+package database
+
+import (
+	"context"
+	"errors"
+
+	"github.com/jackc/pgx/v5"
+)
+
+// GetSigningKey returns the stored armored private key and key id for a purpose.
+// found is false when no key has been generated yet.
+func (db *DB) GetSigningKey(ctx context.Context, purpose string) (armor, keyID string, found bool, err error) {
+	row := db.Pool.QueryRow(ctx, `
+		SELECT private_key_armor, key_id FROM signing_keys WHERE purpose = $1
+	`, purpose)
+	if err := row.Scan(&armor, &keyID); err != nil {
+		if errors.Is(err, pgx.ErrNoRows) {
+			return "", "", false, nil
+		}
+		return "", "", false, err
+	}
+	return armor, keyID, true, nil
+}
+
+// InsertSigningKeyIfAbsent stores a freshly generated key, doing nothing if
+// another replica already inserted one. Callers re-read with GetSigningKey to
+// pick up whichever key won the race.
+func (db *DB) InsertSigningKeyIfAbsent(ctx context.Context, purpose, armor, keyID string) error {
+	_, err := db.Pool.Exec(ctx, `
+		INSERT INTO signing_keys (purpose, private_key_armor, key_id)
+		VALUES ($1, $2, $3)
+		ON CONFLICT (purpose) DO NOTHING
+	`, purpose, armor, keyID)
+	return err
+}

internal/database/signing_keys_test.go

@@ -0,0 +1,31 @@
+package database
+
+import "testing"
+
+func TestSigningKeyRoundTripAndIdempotency(t *testing.T) {
+	requireDB(t)
+
+	const purpose = "terraform-provider-test"
+
+	// Absent to start.
+	if _, _, found, err := testDB.GetSigningKey(ctx(), purpose); err != nil || found {
+		t.Fatalf("expected no key, got found=%v err=%v", found, err)
+	}
+
+	if err := testDB.InsertSigningKeyIfAbsent(ctx(), purpose, "ARMOR-1", "KEYID1"); err != nil {
+		t.Fatal(err)
+	}
+
+	// A second insert must not overwrite (models the replica race).
+	if err := testDB.InsertSigningKeyIfAbsent(ctx(), purpose, "ARMOR-2", "KEYID2"); err != nil {
+		t.Fatal(err)
+	}
+
+	armor, keyID, found, err := testDB.GetSigningKey(ctx(), purpose)
+	if err != nil || !found {
+		t.Fatalf("expected key, found=%v err=%v", found, err)
+	}
+	if armor != "ARMOR-1" || keyID != "KEYID1" {
+		t.Errorf("key was overwritten: armor=%q key_id=%q", armor, keyID)
+	}
+}

internal/database/stats.go

@@ -30,6 +30,15 @@ func (db *DB) GetOverviewStats(ctx context.Context) (*models.OverviewStats, erro
 		return nil, err
 	}
 
+	err = db.Pool.QueryRow(ctx, `
+		SELECT COALESCE(SUM(size_bytes), 0)
+		FROM access_log
+		WHERE cache_hit = TRUE AND created_at > NOW() - INTERVAL '30 days'
+	`).Scan(&stats.BandwidthSaved30d)
+	if err != nil {
+		return nil, err
+	}
+
 	return &stats, nil
 }
 

internal/gc/gc.go

@@ -9,6 +9,16 @@ import (
 	"git.unkin.net/unkin/artifactapi/internal/storage"
 )
 
+// blobGracePeriod is how old an orphaned blob must be before GC will delete
+// it. This avoids racing in-flight dedup uploads that insert the blob row
+// before the referencing artifact/local_files row exists.
+const blobGracePeriod = 1 * time.Hour
+
+// uploadGracePeriod is how long a docker blob-upload staging object
+// (uploads/<uuid>) may sit idle before GC treats it as an abandoned push and
+// reaps it. Generous so a slow but live push is never cut off mid-flight.
+const uploadGracePeriod = 24 * time.Hour
+
 type Collector struct {
 	db       *database.DB
 	store    *storage.S3
@@ -38,7 +48,9 @@ func (c *Collector) Run(ctx context.Context) {
 func (c *Collector) sweep(ctx context.Context) {
 	start := time.Now()
 
-	orphaned, err := c.db.FindOrphanedBlobs(ctx)
+	c.sweepUploads(ctx)
+
+	orphaned, err := c.db.FindOrphanedBlobs(ctx, blobGracePeriod)
 	if err != nil {
 		slog.Error("gc: find orphaned blobs", "error", err)
 		return
@@ -65,3 +77,24 @@ func (c *Collector) sweep(ctx context.Context) {
 		)
 	}
 }
+
+// sweepUploads reaps docker blob-upload staging objects abandoned longer than
+// uploadGracePeriod (cancelled or interrupted pushes that never finalised).
+func (c *Collector) sweepUploads(ctx context.Context) {
+	stale, err := c.store.ListStaleObjects(ctx, "uploads/", time.Now().Add(-uploadGracePeriod))
+	if err != nil {
+		slog.Error("gc: list stale uploads", "error", err)
+		return
+	}
+	reaped := 0
+	for _, key := range stale {
+		if err := c.store.Delete(ctx, key); err != nil {
+			slog.Warn("gc: delete stale upload", "key", key, "error", err)
+			continue
+		}
+		reaped++
+	}
+	if reaped > 0 {
+		slog.Info("gc: reaped stale docker uploads", "count", reaped)
+	}
+}

internal/gc/gc_integration_test.go

@@ -0,0 +1,114 @@
+package gc
+
+import (
+	"bytes"
+	"context"
+	"os"
+	"testing"
+	"time"
+
+	"git.unkin.net/unkin/artifactapi/internal/database"
+	"git.unkin.net/unkin/artifactapi/internal/storage"
+	"git.unkin.net/unkin/artifactapi/internal/testsupport"
+)
+
+var (
+	testDB    *database.DB
+	testStore *storage.S3
+)
+
+func TestMain(m *testing.M) {
+	ctx := context.Background()
+	dsn, termPG, err := testsupport.StartPostgres(ctx)
+	if err != nil {
+		os.Exit(m.Run())
+	}
+	minio, termMinio, err := testsupport.StartMinio(ctx)
+	if err != nil {
+		termPG()
+		os.Exit(m.Run())
+	}
+	db, err := database.New(dsn)
+	if err != nil {
+		panic(err)
+	}
+	var s3 *storage.S3
+	for i := 0; i < 20; i++ {
+		if s3, err = storage.NewS3(minio.Endpoint, minio.AccessKey, minio.SecretKey, "gc-test", false, ""); err == nil {
+			break
+		}
+		time.Sleep(500 * time.Millisecond)
+	}
+	if err != nil {
+		panic(err)
+	}
+	testDB = db
+	testStore = s3
+
+	code := m.Run()
+	db.Close()
+	termMinio()
+	termPG()
+	if code != 0 {
+		os.Exit(code)
+	}
+}
+
+func TestSweepDeletesOldOrphan(t *testing.T) {
+	if testDB == nil {
+		t.Skip("Docker unavailable")
+	}
+	ctx := context.Background()
+	hash := "sha256:gcorphan"
+	key := storage.BlobKey("gcorphan")
+
+	if err := testStore.Upload(ctx, key, bytes.NewReader([]byte("orphan")), 6, "application/octet-stream"); err != nil {
+		t.Fatal(err)
+	}
+	if err := testDB.UpsertBlob(ctx, hash, key, 6, "application/octet-stream"); err != nil {
+		t.Fatal(err)
+	}
+	// Age the blob past the grace period.
+	if _, err := testDB.Pool.Exec(ctx, `UPDATE blobs SET created_at = now() - interval '2 hours' WHERE content_hash = $1`, hash); err != nil {
+		t.Fatal(err)
+	}
+
+	c := New(testDB, testStore, time.Hour)
+	c.sweep(ctx)
+
+	if exists, _ := testStore.Exists(ctx, key); exists {
+		t.Error("expected orphan object deleted from store")
+	}
+	orphans, _ := testDB.FindOrphanedBlobs(ctx, 0)
+	for _, b := range orphans {
+		if b.ContentHash == hash {
+			t.Error("expected orphan blob row deleted")
+		}
+	}
+}
+
+func TestSweepNoOrphans(t *testing.T) {
+	if testDB == nil {
+		t.Skip("Docker unavailable")
+	}
+	// A sweep with nothing to collect should be a clean no-op.
+	New(testDB, testStore, time.Hour).sweep(context.Background())
+}
+
+func TestRunStopsOnContextCancel(t *testing.T) {
+	if testDB == nil {
+		t.Skip("Docker unavailable")
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	done := make(chan struct{})
+	go func() {
+		New(testDB, testStore, time.Hour).Run(ctx)
+		close(done)
+	}()
+	cancel()
+	select {
+	case <-done:
+	case <-time.After(5 * time.Second):
+		t.Fatal("Run did not return after context cancel")
+	}
+}

internal/githubauth/app.go

@@ -0,0 +1,199 @@
+package githubauth
+
+import (
+	"context"
+	"crypto"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/json"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"strings"
+	"sync"
+	"time"
+)
+
+const (
+	defaultAPIBase = "https://api.github.com"
+
+	// jwtLifetime is how long the app JWT is valid. GitHub caps it at 10 minutes;
+	// 9 leaves headroom for clock skew.
+	jwtLifetime = 9 * time.Minute
+	// jwtBackdate backdates iat to tolerate the app server's clock running behind
+	// GitHub's, which otherwise rejects the JWT.
+	jwtBackdate = 60 * time.Second
+	// refreshSkew refreshes the installation token this long before it expires so
+	// a request never races an expiry.
+	refreshSkew = 5 * time.Minute
+)
+
+type httpDoer interface {
+	Do(*http.Request) (*http.Response, error)
+}
+
+// appCredential mints installation access tokens for a GitHub App. It signs a
+// short-lived RS256 JWT with the app private key, exchanges it for a ~1h
+// installation token, caches that token, and refreshes it shortly before expiry.
+// Refreshes are single-flighted by holding the mutex across the exchange, so
+// concurrent callers coalesce onto one HTTP request and reuse the cached token.
+type appCredential struct {
+	appID          string
+	installationID string
+	key            *rsa.PrivateKey
+	apiBase        string
+	client         httpDoer
+
+	mu     sync.Mutex
+	token  string
+	expiry time.Time
+}
+
+func newAppCredential(opts Options) (*appCredential, error) {
+	if opts.AppID == "" {
+		return nil, errors.New("github app: GITHUB_APP_ID is required")
+	}
+	if opts.InstallationID == "" {
+		return nil, errors.New("github app: GITHUB_APP_INSTALLATION_ID is required")
+	}
+	pemBytes, err := loadPrivateKeyPEM(opts)
+	if err != nil {
+		return nil, err
+	}
+	key, err := parseRSAPrivateKey(pemBytes)
+	if err != nil {
+		return nil, err
+	}
+
+	apiBase := opts.apiBaseURL
+	if apiBase == "" {
+		apiBase = defaultAPIBase
+	}
+	client := opts.httpClient
+	if client == nil {
+		client = &http.Client{Timeout: 30 * time.Second}
+	}
+
+	return &appCredential{
+		appID:          opts.AppID,
+		installationID: opts.InstallationID,
+		key:            key,
+		apiBase:        strings.TrimRight(apiBase, "/"),
+		client:         client,
+	}, nil
+}
+
+// Token returns a cached installation token, refreshing it under a single-flight
+// lock when it is missing or within refreshSkew of expiry.
+func (a *appCredential) Token(ctx context.Context) (string, error) {
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	if a.token != "" && time.Now().Before(a.expiry.Add(-refreshSkew)) {
+		return a.token, nil
+	}
+	if err := a.refreshLocked(ctx); err != nil {
+		return "", err
+	}
+	return a.token, nil
+}
+
+func (a *appCredential) refreshLocked(ctx context.Context) error {
+	jwt, err := mintJWT(a.appID, a.key, time.Now())
+	if err != nil {
+		return fmt.Errorf("github app: mint jwt: %w", err)
+	}
+
+	u := fmt.Sprintf("%s/app/installations/%s/access_tokens", a.apiBase, a.installationID)
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, u, nil)
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Authorization", "Bearer "+jwt)
+	req.Header.Set("Accept", "application/vnd.github+json")
+	req.Header.Set("X-GitHub-Api-Version", "2022-11-28")
+
+	resp, err := a.client.Do(req)
+	if err != nil {
+		return fmt.Errorf("github app: token exchange: %w", err)
+	}
+	defer resp.Body.Close()
+	body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
+	if resp.StatusCode != http.StatusCreated && resp.StatusCode != http.StatusOK {
+		// Never echo the body verbatim — it can contain sensitive material.
+		return fmt.Errorf("github app: token exchange status %d", resp.StatusCode)
+	}
+
+	var out struct {
+		Token     string    `json:"token"`
+		ExpiresAt time.Time `json:"expires_at"`
+	}
+	if err := json.Unmarshal(body, &out); err != nil {
+		return fmt.Errorf("github app: decode token response: %w", err)
+	}
+	if out.Token == "" {
+		return errors.New("github app: token exchange returned an empty token")
+	}
+	a.token = out.Token
+	a.expiry = out.ExpiresAt
+	if a.expiry.IsZero() {
+		// Defensive: assume the documented ~1h lifetime if GitHub omits it.
+		a.expiry = time.Now().Add(time.Hour)
+	}
+	return nil
+}
+
+// mintJWT builds and RS256-signs a GitHub App JWT (iss=app id, backdated iat,
+// ≤10m exp) using stdlib crypto — no third-party JWT dependency.
+func mintJWT(appID string, key *rsa.PrivateKey, now time.Time) (string, error) {
+	header := map[string]string{"alg": "RS256", "typ": "JWT"}
+	claims := map[string]any{
+		"iat": now.Add(-jwtBackdate).Unix(),
+		"exp": now.Add(jwtLifetime).Unix(),
+		"iss": appID,
+	}
+	hb, err := json.Marshal(header)
+	if err != nil {
+		return "", err
+	}
+	cb, err := json.Marshal(claims)
+	if err != nil {
+		return "", err
+	}
+	signingInput := b64url(hb) + "." + b64url(cb)
+	digest := sha256.Sum256([]byte(signingInput))
+	sig, err := rsa.SignPKCS1v15(rand.Reader, key, crypto.SHA256, digest[:])
+	if err != nil {
+		return "", err
+	}
+	return signingInput + "." + b64url(sig), nil
+}
+
+func b64url(b []byte) string {
+	return base64.RawURLEncoding.EncodeToString(b)
+}
+
+// parseRSAPrivateKey accepts PKCS#1 ("RSA PRIVATE KEY") and PKCS#8 ("PRIVATE
+// KEY") PEM, covering both GitHub App key export formats.
+func parseRSAPrivateKey(pemBytes []byte) (*rsa.PrivateKey, error) {
+	block, _ := pem.Decode(pemBytes)
+	if block == nil {
+		return nil, errors.New("github app: private key is not valid PEM")
+	}
+	if key, err := x509.ParsePKCS1PrivateKey(block.Bytes); err == nil {
+		return key, nil
+	}
+	keyAny, err := x509.ParsePKCS8PrivateKey(block.Bytes)
+	if err != nil {
+		return nil, errors.New("github app: private key is not a supported RSA PKCS#1/PKCS#8 key")
+	}
+	rsaKey, ok := keyAny.(*rsa.PrivateKey)
+	if !ok {
+		return nil, errors.New("github app: private key is not an RSA key")
+	}
+	return rsaKey, nil
+}

internal/githubauth/app_test.go

@@ -0,0 +1,207 @@
+package githubauth
+
+import (
+	"context"
+	"crypto"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha256"
+	"crypto/x509"
+	"encoding/base64"
+	"encoding/json"
+	"encoding/pem"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+)
+
+func testRSAKeyPEM(t *testing.T) string {
+	t.Helper()
+	key, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		t.Fatalf("generate key: %v", err)
+	}
+	der := x509.MarshalPKCS1PrivateKey(key)
+	return string(pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: der}))
+}
+
+// appFixture serves the installation-token exchange endpoint, records requests,
+// verifies the presented JWT against the app public key, and returns tokens with
+// a controllable expiry.
+type appFixture struct {
+	srv       *httptest.Server
+	pub       *rsa.PublicKey
+	mu        sync.Mutex
+	exchanges int
+	lastJWT   string
+	expiresAt func() time.Time
+	tokenSeq  int
+}
+
+func newAppFixture(t *testing.T, pemKey string) *appFixture {
+	t.Helper()
+	block, _ := pem.Decode([]byte(pemKey))
+	key, err := x509.ParsePKCS1PrivateKey(block.Bytes)
+	if err != nil {
+		t.Fatalf("parse test key: %v", err)
+	}
+	f := &appFixture{
+		pub:       &key.PublicKey,
+		expiresAt: func() time.Time { return time.Now().Add(time.Hour) },
+	}
+	mux := http.NewServeMux()
+	mux.HandleFunc("/app/installations/456/access_tokens", func(w http.ResponseWriter, r *http.Request) {
+		auth := r.Header.Get("Authorization")
+		jwt := strings.TrimPrefix(auth, "Bearer ")
+		f.mu.Lock()
+		f.exchanges++
+		f.lastJWT = jwt
+		f.tokenSeq++
+		seq := f.tokenSeq
+		exp := f.expiresAt()
+		f.mu.Unlock()
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusCreated)
+		json.NewEncoder(w).Encode(map[string]any{
+			"token":      fmt.Sprintf("ghs_installation_%d", seq),
+			"expires_at": exp.UTC().Format(time.RFC3339),
+		})
+	})
+	f.srv = httptest.NewServer(mux)
+	t.Cleanup(f.srv.Close)
+	return f
+}
+
+func (f *appFixture) verifyJWT(t *testing.T) {
+	t.Helper()
+	f.mu.Lock()
+	jwt := f.lastJWT
+	f.mu.Unlock()
+	parts := strings.Split(jwt, ".")
+	if len(parts) != 3 {
+		t.Fatalf("jwt not three-part: %q", jwt)
+	}
+	signingInput := parts[0] + "." + parts[1]
+	sig, err := base64.RawURLEncoding.DecodeString(parts[2])
+	if err != nil {
+		t.Fatalf("decode sig: %v", err)
+	}
+	digest := sha256.Sum256([]byte(signingInput))
+	if err := rsa.VerifyPKCS1v15(f.pub, crypto.SHA256, digest[:], sig); err != nil {
+		t.Fatalf("jwt signature invalid: %v", err)
+	}
+	var claims struct {
+		Iss string `json:"iss"`
+		Iat int64  `json:"iat"`
+		Exp int64  `json:"exp"`
+	}
+	cb, _ := base64.RawURLEncoding.DecodeString(parts[1])
+	if err := json.Unmarshal(cb, &claims); err != nil {
+		t.Fatalf("decode claims: %v", err)
+	}
+	if claims.Iss != "123" {
+		t.Fatalf("iss = %q, want 123", claims.Iss)
+	}
+	if claims.Exp-claims.Iat > int64((10*time.Minute)/time.Second) {
+		t.Fatalf("jwt lifetime exceeds 10m: iat=%d exp=%d", claims.Iat, claims.Exp)
+	}
+	if claims.Iat > time.Now().Unix() {
+		t.Fatalf("iat not backdated: %d", claims.Iat)
+	}
+}
+
+func newAppCred(t *testing.T, f *appFixture, pemKey string) *appCredential {
+	t.Helper()
+	c, err := newAppCredential(Options{
+		AppID:          "123",
+		InstallationID: "456",
+		PrivateKeyPEM:  pemKey,
+		apiBaseURL:     f.srv.URL,
+		httpClient:     f.srv.Client(),
+	})
+	if err != nil {
+		t.Fatalf("newAppCredential: %v", err)
+	}
+	return c
+}
+
+func TestApp_MintsJWTAndExchangesForInstallationToken(t *testing.T) {
+	pemKey := testRSAKeyPEM(t)
+	f := newAppFixture(t, pemKey)
+	c := newAppCred(t, f, pemKey)
+
+	tok, err := c.Token(context.Background())
+	if err != nil {
+		t.Fatalf("token: %v", err)
+	}
+	if tok != "ghs_installation_1" {
+		t.Fatalf("token = %q, want ghs_installation_1", tok)
+	}
+	if f.exchanges != 1 {
+		t.Fatalf("exchanges = %d, want 1", f.exchanges)
+	}
+	f.verifyJWT(t)
+}
+
+func TestApp_CachesInstallationToken(t *testing.T) {
+	pemKey := testRSAKeyPEM(t)
+	f := newAppFixture(t, pemKey)
+	c := newAppCred(t, f, pemKey)
+
+	for i := 0; i < 5; i++ {
+		if _, err := c.Token(context.Background()); err != nil {
+			t.Fatalf("token: %v", err)
+		}
+	}
+	if f.exchanges != 1 {
+		t.Fatalf("exchanges = %d, want 1 (token should be cached)", f.exchanges)
+	}
+}
+
+func TestApp_RefreshesNearExpiry(t *testing.T) {
+	pemKey := testRSAKeyPEM(t)
+	f := newAppFixture(t, pemKey)
+	// Token expires within refreshSkew, so every call must re-exchange.
+	f.expiresAt = func() time.Time { return time.Now().Add(2 * time.Minute) }
+	c := newAppCred(t, f, pemKey)
+
+	t1, err := c.Token(context.Background())
+	if err != nil {
+		t.Fatalf("token 1: %v", err)
+	}
+	t2, err := c.Token(context.Background())
+	if err != nil {
+		t.Fatalf("token 2: %v", err)
+	}
+	if f.exchanges != 2 {
+		t.Fatalf("exchanges = %d, want 2 (near-expiry token must refresh)", f.exchanges)
+	}
+	if t1 == t2 {
+		t.Fatalf("expected a fresh token after refresh, both = %q", t1)
+	}
+}
+
+func TestApp_ConcurrentTokenSingleFlights(t *testing.T) {
+	pemKey := testRSAKeyPEM(t)
+	f := newAppFixture(t, pemKey)
+	c := newAppCred(t, f, pemKey)
+
+	var wg sync.WaitGroup
+	for i := 0; i < 20; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			if _, err := c.Token(context.Background()); err != nil {
+				t.Errorf("token: %v", err)
+			}
+		}()
+	}
+	wg.Wait()
+	if f.exchanges != 1 {
+		t.Fatalf("exchanges = %d, want 1 (concurrent calls must coalesce)", f.exchanges)
+	}
+}

internal/githubauth/credential.go

@@ -0,0 +1,106 @@
+// Package githubauth provides the process-wide GitHub machine credential used to
+// authenticate every outbound GitHub request (releases scan, ranged asset header
+// fetches, and the generic-github byte proxy for private assets). The credential
+// is delivered via env/secret only — it is never stored per-remote in the DB,
+// never returned by any API, and never logged.
+package githubauth
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"strings"
+	"sync"
+)
+
+// Credential yields a bearer token for GitHub requests. Token may block to mint
+// or refresh (the GitHub App path); an empty string means "no auth", which only
+// happens when no credential is configured.
+type Credential interface {
+	Token(ctx context.Context) (string, error)
+}
+
+// Options is the raw, env-sourced auth configuration. Exactly one mode may be
+// configured: a static token, or a GitHub App (id + installation id + private
+// key). Partial App configuration is an error (fail closed); no fields at all is
+// fine and yields a nil credential (anonymous, current behavior).
+type Options struct {
+	// Token is a Personal Access Token (fine-grained or classic) sent verbatim
+	// as "Authorization: Bearer <token>".
+	Token string
+
+	// GitHub App fields. PrivateKeyPEM and PrivateKeyPath are alternatives; the
+	// inline PEM wins when both are set.
+	AppID          string
+	InstallationID string
+	PrivateKeyPEM  string
+	PrivateKeyPath string
+
+	// apiBaseURL overrides https://api.github.com for tests. Empty uses the real
+	// endpoint. httpClient likewise overrides the default client for tests.
+	apiBaseURL string
+	httpClient httpDoer
+}
+
+// New builds the process credential from options, validating that auth is either
+// fully configured or fully absent. It returns (nil, nil) when nothing is set.
+func New(opts Options) (Credential, error) {
+	hasToken := opts.Token != ""
+	hasAppField := opts.AppID != "" || opts.InstallationID != "" ||
+		opts.PrivateKeyPEM != "" || opts.PrivateKeyPath != ""
+
+	switch {
+	case !hasToken && !hasAppField:
+		return nil, nil // no auth configured — anonymous is fine
+	case hasToken && hasAppField:
+		return nil, errors.New("github auth: both a token and GitHub App fields are set; configure exactly one")
+	case hasToken:
+		return staticToken{token: opts.Token}, nil
+	default:
+		return newAppCredential(opts)
+	}
+}
+
+// staticToken is a fixed PAT credential.
+type staticToken struct{ token string }
+
+func (s staticToken) Token(context.Context) (string, error) { return s.token, nil }
+
+// server is the process-wide credential set once at startup. A nil value means
+// no server credential (anonymous). Access is guarded so a late SetServer in a
+// test is race-free.
+var (
+	serverMu sync.RWMutex
+	server   Credential
+)
+
+// SetServer installs the process credential. Call once during startup.
+func SetServer(c Credential) {
+	serverMu.Lock()
+	server = c
+	serverMu.Unlock()
+}
+
+// Server returns the process credential, or nil if none is configured.
+func Server() Credential {
+	serverMu.RLock()
+	defer serverMu.RUnlock()
+	return server
+}
+
+// loadPrivateKeyPEM resolves the App private key bytes from the inline PEM or a
+// file path, without ever returning the key material in an error message.
+func loadPrivateKeyPEM(opts Options) ([]byte, error) {
+	if strings.TrimSpace(opts.PrivateKeyPEM) != "" {
+		return []byte(opts.PrivateKeyPEM), nil
+	}
+	if opts.PrivateKeyPath != "" {
+		b, err := os.ReadFile(opts.PrivateKeyPath)
+		if err != nil {
+			return nil, fmt.Errorf("github app: read private key file: %w", err)
+		}
+		return b, nil
+	}
+	return nil, errors.New("github app: no private key configured")
+}

internal/githubauth/credential_test.go

@@ -0,0 +1,77 @@
+package githubauth
+
+import (
+	"context"
+	"testing"
+)
+
+func TestNew_NoConfigIsAnonymous(t *testing.T) {
+	c, err := New(Options{})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if c != nil {
+		t.Fatalf("expected nil credential when nothing configured, got %T", c)
+	}
+}
+
+func TestNew_TokenMode(t *testing.T) {
+	c, err := New(Options{Token: "ghp_example"})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	tok, err := c.Token(context.Background())
+	if err != nil {
+		t.Fatalf("token: %v", err)
+	}
+	if tok != "ghp_example" {
+		t.Fatalf("token = %q, want ghp_example", tok)
+	}
+}
+
+func TestNew_TokenAndAppConflict(t *testing.T) {
+	_, err := New(Options{Token: "ghp_example", AppID: "123"})
+	if err == nil {
+		t.Fatal("expected error when both token and app fields are set")
+	}
+}
+
+func TestNew_PartialAppFailsClosed(t *testing.T) {
+	cases := map[string]Options{
+		"app id without key":  {AppID: "123", InstallationID: "456"},
+		"key without app id":  {InstallationID: "456", PrivateKeyPEM: testRSAKeyPEM(t)},
+		"app id without inst": {AppID: "123", PrivateKeyPEM: testRSAKeyPEM(t)},
+	}
+	for name, opts := range cases {
+		t.Run(name, func(t *testing.T) {
+			if _, err := New(opts); err == nil {
+				t.Fatalf("expected fail-closed error for %q", name)
+			}
+		})
+	}
+}
+
+func TestNew_AppModeParsesKey(t *testing.T) {
+	c, err := New(Options{
+		AppID:          "123",
+		InstallationID: "456",
+		PrivateKeyPEM:  testRSAKeyPEM(t),
+	})
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if _, ok := c.(*appCredential); !ok {
+		t.Fatalf("expected *appCredential, got %T", c)
+	}
+}
+
+func TestNew_AppModeRejectsBadKey(t *testing.T) {
+	_, err := New(Options{
+		AppID:          "123",
+		InstallationID: "456",
+		PrivateKeyPEM:  "-----BEGIN RSA PRIVATE KEY-----\nnope\n-----END RSA PRIVATE KEY-----",
+	})
+	if err == nil {
+		t.Fatal("expected error for malformed private key")
+	}
+}

internal/provider/alpine/alpine_test.go

@@ -0,0 +1,60 @@
+package alpine
+
+import (
+	"context"
+	"testing"
+
+	"git.unkin.net/unkin/artifactapi/internal/provider"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+func TestType(t *testing.T) {
+	if (&Provider{}).Type() != models.PackageAlpine {
+		t.Fatal("wrong type")
+	}
+}
+
+func TestClassify(t *testing.T) {
+	p := &Provider{}
+	if p.Classify("v3.19/main/x86_64/APKINDEX.tar.gz") != provider.Mutable {
+		t.Error("APKINDEX should be mutable")
+	}
+	if p.Classify("v3.19/main/x86_64/curl-8.0-r0.apk") != provider.Immutable {
+		t.Error("apk should be immutable")
+	}
+}
+
+func TestContentType(t *testing.T) {
+	p := &Provider{}
+	cases := map[string]string{
+		"pkg.apk":          "application/vnd.android.package-archive",
+		"APKINDEX.tar.gz":  "application/gzip",
+		"something.random": "application/octet-stream",
+	}
+	for path, want := range cases {
+		if got := p.ContentType(path); got != want {
+			t.Errorf("ContentType(%q) = %q, want %q", path, got, want)
+		}
+	}
+}
+
+func TestUpstreamURL(t *testing.T) {
+	p := &Provider{}
+	got := p.UpstreamURL(models.Remote{BaseURL: "https://dl-cdn.alpinelinux.org/alpine/"}, "/v3.19/main/x86_64/curl.apk")
+	if got != "https://dl-cdn.alpinelinux.org/alpine/v3.19/main/x86_64/curl.apk" {
+		t.Errorf("got %q", got)
+	}
+}
+
+func TestRewriteResponse(t *testing.T) {
+	if out, err := (&Provider{}).RewriteResponse([]byte("x"), models.Remote{}, "http://proxy"); out != nil || err != nil {
+		t.Error("alpine never rewrites")
+	}
+}
+
+func TestAuthHeaders(t *testing.T) {
+	h, _ := (&Provider{}).AuthHeaders(context.Background(), models.Remote{Username: "u", Password: "p"})
+	if h.Get("Authorization") == "" {
+		t.Error("expected auth header")
+	}
+}

internal/provider/docker/docker_extra_test.go

@@ -0,0 +1,53 @@
+package docker
+
+import (
+	"context"
+	"testing"
+
+	"git.unkin.net/unkin/artifactapi/internal/provider"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+func TestDockerClassifyBranches(t *testing.T) {
+	p := &Provider{}
+	if p.Classify("library/nginx/tags/list") != provider.Mutable {
+		t.Error("tags/list should be mutable")
+	}
+	if p.Classify("library/nginx/manifests/latest") != provider.Mutable {
+		t.Error("tag manifest should be mutable")
+	}
+	if p.Classify("library/nginx/manifests/sha256:abcdef") != provider.Immutable {
+		t.Error("digest manifest should be immutable")
+	}
+	if p.Classify("library/nginx/blobs/sha256:abc") != provider.Immutable {
+		t.Error("blob should be immutable")
+	}
+}
+
+func TestDockerContentType(t *testing.T) {
+	p := &Provider{}
+	if p.ContentType("x/blobs/sha256:abc") != "application/octet-stream" {
+		t.Error("blob content type")
+	}
+	if p.ContentType("x/manifests/latest") != "application/vnd.docker.distribution.manifest.v2+json" {
+		t.Error("manifest content type")
+	}
+	if p.ContentType("x/tags/list") != "application/json" {
+		t.Error("default content type")
+	}
+}
+
+func TestDockerRewriteAndAuth(t *testing.T) {
+	p := &Provider{}
+	if out, err := p.RewriteResponse([]byte("x"), models.Remote{}, "http://p"); out != nil || err != nil {
+		t.Error("docker never rewrites")
+	}
+	h, _ := p.AuthHeaders(context.Background(), models.Remote{Username: "u", Password: "p"})
+	if h.Get("Authorization") == "" {
+		t.Error("expected basic auth header")
+	}
+	h, _ = p.AuthHeaders(context.Background(), models.Remote{})
+	if h.Get("Authorization") != "" {
+		t.Error("no creds, no header")
+	}
+}

internal/provider/generic/generic.go

@@ -4,9 +4,11 @@ import (
 	"context"
 	"encoding/base64"
 	"net/http"
+	"net/url"
 	"path"
 	"strings"
 
+	"git.unkin.net/unkin/artifactapi/internal/githubauth"
 	"git.unkin.net/unkin/artifactapi/internal/provider"
 	"git.unkin.net/unkin/artifactapi/pkg/models"
 )
@@ -59,10 +61,42 @@ func (p *Provider) RewriteResponse(_ []byte, _ models.Remote, _ string) ([]byte,
 	return nil, nil
 }
 
-func (p *Provider) AuthHeaders(_ context.Context, remote models.Remote) (http.Header, error) {
+// AuthHeaders authenticates outbound requests. A per-remote username/password
+// (Basic auth) takes precedence. Otherwise, when the remote points at a GitHub
+// host (e.g. a releases_remote proxying private release assets), the process-wide
+// GitHub credential is attached as a bearer token so private downloads work.
+func (p *Provider) AuthHeaders(ctx context.Context, remote models.Remote) (http.Header, error) {
 	h := http.Header{}
 	if remote.Username != "" {
 		h.Set("Authorization", "Basic "+base64.StdEncoding.EncodeToString([]byte(remote.Username+":"+remote.Password)))
+		return h, nil
+	}
+	if isGitHubHost(remote.BaseURL) {
+		if c := githubauth.Server(); c != nil {
+			tok, err := c.Token(ctx)
+			if err != nil {
+				return nil, err
+			}
+			if tok != "" {
+				h.Set("Authorization", "Bearer "+tok)
+			}
+		}
 	}
 	return h, nil
 }
+
+// isGitHubHost reports whether rawURL targets a GitHub API/download host that
+// accepts the server credential. objects.githubusercontent.com is deliberately
+// excluded: release-asset downloads 302-redirect there with a pre-signed URL
+// that must not carry an Authorization header.
+func isGitHubHost(rawURL string) bool {
+	u, err := url.Parse(rawURL)
+	if err != nil {
+		return false
+	}
+	switch strings.ToLower(u.Hostname()) {
+	case "github.com", "www.github.com", "api.github.com", "codeload.github.com", "uploads.github.com":
+		return true
+	}
+	return false
+}

internal/provider/generic/generic_extra_test.go

@@ -0,0 +1,13 @@
+package generic
+
+import (
+	"testing"
+
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+func TestGenericRewriteResponse(t *testing.T) {
+	if out, err := (&Provider{}).RewriteResponse([]byte("x"), models.Remote{}, "http://p"); out != nil || err != nil {
+		t.Error("generic never rewrites")
+	}
+}

internal/provider/generic/generic_test.go

@@ -4,11 +4,56 @@ import (
 	"context"
 	"testing"
 
+	"git.unkin.net/unkin/artifactapi/internal/githubauth"
 	"git.unkin.net/unkin/artifactapi/internal/provider"
 	"git.unkin.net/unkin/artifactapi/internal/provider/generic"
 	"git.unkin.net/unkin/artifactapi/pkg/models"
 )
 
+type staticCred string
+
+func (s staticCred) Token(context.Context) (string, error) { return string(s), nil }
+
+func TestProvider_AuthHeaders_GitHubServerCredential(t *testing.T) {
+	githubauth.SetServer(staticCred("ghs_server"))
+	t.Cleanup(func() { githubauth.SetServer(nil) })
+
+	p := &generic.Provider{}
+	h, err := p.AuthHeaders(context.Background(), models.Remote{BaseURL: "https://github.com"})
+	if err != nil {
+		t.Fatalf("auth headers: %v", err)
+	}
+	if h.Get("Authorization") != "Bearer ghs_server" {
+		t.Fatalf("Authorization = %q, want Bearer ghs_server", h.Get("Authorization"))
+	}
+}
+
+func TestProvider_AuthHeaders_NonGitHubHostNoServerCredential(t *testing.T) {
+	githubauth.SetServer(staticCred("ghs_server"))
+	t.Cleanup(func() { githubauth.SetServer(nil) })
+
+	p := &generic.Provider{}
+	h, _ := p.AuthHeaders(context.Background(), models.Remote{BaseURL: "https://example.com/downloads"})
+	if h.Get("Authorization") != "" {
+		t.Fatalf("server credential must not be sent to non-github host, got %q", h.Get("Authorization"))
+	}
+}
+
+func TestProvider_AuthHeaders_PerRemoteOverridesServerCredential(t *testing.T) {
+	githubauth.SetServer(staticCred("ghs_server"))
+	t.Cleanup(func() { githubauth.SetServer(nil) })
+
+	p := &generic.Provider{}
+	h, _ := p.AuthHeaders(context.Background(), models.Remote{
+		BaseURL:  "https://github.com",
+		Username: "user",
+		Password: "pass",
+	})
+	if got := h.Get("Authorization"); got != "Basic dXNlcjpwYXNz" {
+		t.Fatalf("per-remote Basic auth must win, got %q", got)
+	}
+}
+
 func TestProvider_Type(t *testing.T) {
 	p := &generic.Provider{}
 	if p.Type() != models.PackageGeneric {

internal/provider/goproxy/goproxy_extra_test.go

@@ -0,0 +1,27 @@
+package goproxy
+
+import (
+	"context"
+	"testing"
+
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+func TestGoProxyURLAuthRewrite(t *testing.T) {
+	p := &Provider{}
+	if got := p.UpstreamURL(models.Remote{BaseURL: "https://proxy.golang.org/"}, "/mod/@v/list"); got != "https://proxy.golang.org/mod/@v/list" {
+		t.Errorf("upstream url %q", got)
+	}
+	if out, err := p.RewriteResponse([]byte("x"), models.Remote{}, "http://p"); out != nil || err != nil {
+		t.Error("goproxy never rewrites")
+	}
+	if h, _ := p.AuthHeaders(context.Background(), models.Remote{Username: "u", Password: "p"}); h.Get("Authorization") == "" {
+		t.Error("expected basic auth header")
+	}
+	if got := p.ContentType("mod/@v/v1.0.0.info"); got != "application/json" {
+		t.Errorf("info content type %q", got)
+	}
+	if got := p.ContentType("mod/@v/v1.0.0.mod"); got != "text/plain" {
+		t.Errorf("mod content type %q", got)
+	}
+}

internal/provider/helm/helm_extra_test.go

@@ -0,0 +1,18 @@
+package helm
+
+import "testing"
+
+func TestHelmContentTypeBranches(t *testing.T) {
+	p := &Provider{}
+	for path, want := range map[string]string{
+		"charts/x-1.0.0.tgz": "application/gzip",
+		"x.tar.gz":           "application/gzip",
+		"index.yaml":         "text/yaml",
+		"x.yml":              "text/yaml",
+		"other":              "application/octet-stream",
+	} {
+		if got := p.ContentType(path); got != want {
+			t.Errorf("ContentType(%q)=%q want %q", path, got, want)
+		}
+	}
+}

internal/provider/npm/npm_test.go

@@ -0,0 +1,78 @@
+package npm
+
+import (
+	"context"
+	"testing"
+
+	"git.unkin.net/unkin/artifactapi/internal/provider"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+func TestType(t *testing.T) {
+	if (&Provider{}).Type() != models.PackageNPM {
+		t.Fatal("wrong type")
+	}
+}
+
+func TestClassify(t *testing.T) {
+	p := &Provider{}
+	if p.Classify("pkg/-/pkg-1.0.0.tgz") != provider.Immutable {
+		t.Error("tgz should be immutable")
+	}
+	if p.Classify("pkg") != provider.Mutable {
+		t.Error("metadata should be mutable")
+	}
+}
+
+func TestContentType(t *testing.T) {
+	p := &Provider{}
+	if p.ContentType("pkg/-/pkg-1.0.0.tgz") != "application/gzip" {
+		t.Error("tgz content type")
+	}
+	if p.ContentType("pkg") != "application/json" {
+		t.Error("metadata content type")
+	}
+}
+
+func TestUpstreamURL(t *testing.T) {
+	p := &Provider{}
+	got := p.UpstreamURL(models.Remote{BaseURL: "https://registry.npmjs.org/"}, "/pkg")
+	if got != "https://registry.npmjs.org/pkg" {
+		t.Errorf("got %q", got)
+	}
+}
+
+func TestRewriteResponse(t *testing.T) {
+	p := &Provider{}
+	remote := models.Remote{Name: "npmjs", BaseURL: "https://registry.npmjs.org"}
+
+	if out, _ := p.RewriteResponse([]byte(`{"a":1}`), remote, ""); out != nil {
+		t.Error("empty proxyBaseURL should be a no-op")
+	}
+	if out, _ := p.RewriteResponse([]byte("not json"), remote, "http://proxy"); out != nil {
+		t.Error("invalid json should be a no-op")
+	}
+	body := []byte(`{"tarball":"https://registry.npmjs.org/pkg/-/pkg-1.0.0.tgz"}`)
+	out, err := p.RewriteResponse(body, remote, "http://proxy")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(out) != `{"tarball":"http://proxy/api/v1/remote/npmjs/pkg/-/pkg-1.0.0.tgz"}` {
+		t.Errorf("rewrite: %s", out)
+	}
+	if out, _ := p.RewriteResponse([]byte(`{"x":"unrelated"}`), remote, "http://proxy"); out != nil {
+		t.Error("no matching base URL should be a no-op")
+	}
+}
+
+func TestAuthHeaders(t *testing.T) {
+	p := &Provider{}
+	h, _ := p.AuthHeaders(context.Background(), models.Remote{Username: "u", Password: "pw"})
+	if h.Get("Authorization") == "" {
+		t.Error("expected auth header when credentials set")
+	}
+	h, _ = p.AuthHeaders(context.Background(), models.Remote{})
+	if h.Get("Authorization") != "" {
+		t.Error("expected no auth header without credentials")
+	}
+}

internal/provider/provider.go

@@ -3,6 +3,7 @@ package provider
 import (
 	"context"
 	"fmt"
+	"io"
 	"net/http"
 
 	"git.unkin.net/unkin/artifactapi/pkg/models"
@@ -44,6 +45,97 @@ type LocalIndexer interface {
 	GenerateLocalIndex(ctx context.Context, files FileStore, repoName, path string) ([]byte, error)
 }
 
+type BlobReader interface {
+	Download(ctx context.Context, key string) (io.ReadCloser, int64, error)
+}
+
+type PostUploadHook interface {
+	AfterUpload(ctx context.Context, repoName, storagePath, contentHash string, blobs BlobReader, db MetadataStore)
+}
+
+// PostDeleteHook lets a provider clean up derived state (e.g. RPM metadata that
+// feeds generated repodata) after a local file is removed.
+type PostDeleteHook interface {
+	AfterDelete(ctx context.Context, repoName, storagePath string, db MetadataDeleter) error
+}
+
+type MetadataStore interface {
+	InsertRPMMetadata(ctx context.Context, meta *RPMMetadata) error
+}
+
+// RemoteServer lets a remote provider fully answer a request itself instead of
+// going through the byte-proxy engine. It is the remote-side analog of
+// LocalIndexer: a metadata-only remote (e.g. github_rpm) uses it to synthesize
+// repodata from derived per-asset metadata and to redirect package downloads to
+// a backend remote, without ever precaching the packages. Returning false lets
+// the normal proxy path take over.
+type RemoteServer interface {
+	ServeRemote(w http.ResponseWriter, r *http.Request, remote models.Remote, path, proxyBaseURL string, store RemoteMetadataStore) bool
+}
+
+// RemoteMetadataStore is the persistence surface a RemoteServer needs to cache
+// and read the metadata it derives per upstream asset. *database.DB satisfies it.
+type RemoteMetadataStore interface {
+	RPMMetadataReader
+	MetadataStore
+	MetadataDeleter
+}
+
+type MetadataDeleter interface {
+	DeleteRPMMetadata(ctx context.Context, repoName, filePath string) error
+}
+
+type RPMMetadataReader interface {
+	ListRPMMetadataEntries(ctx context.Context, repoName string) ([]RPMMetadata, error)
+}
+
+type RPMMetadata struct {
+	RepoName      string
+	FilePath      string
+	ContentHash   string
+	Name          string
+	Epoch         int
+	Version       string
+	Release       string
+	Arch          string
+	Summary       string
+	Description   string
+	RPMSize       int64
+	InstalledSize int64
+	License       string
+	Vendor        string
+	Group         string
+	BuildHost     string
+	SourceRPM     string
+	URL           string
+	Packager      string
+	Requires      []RPMDep
+	Provides      []RPMDep
+	Conflicts     []RPMDep
+	Obsoletes     []RPMDep
+	Files         []RPMFile
+	Changelogs    []RPMChangelog
+}
+
+type RPMDep struct {
+	Name    string `json:"name"`
+	Flags   string `json:"flags,omitempty"`
+	Epoch   string `json:"epoch,omitempty"`
+	Version string `json:"version,omitempty"`
+	Release string `json:"release,omitempty"`
+}
+
+type RPMFile struct {
+	Path string `json:"path"`
+	Type string `json:"type,omitempty"`
+}
+
+type RPMChangelog struct {
+	Author string `json:"author"`
+	Date   int64  `json:"date"`
+	Text   string `json:"text"`
+}
+
 type IndexMerger interface {
 	MergeIndexes(members []MemberIndex, proxyBaseURL string) ([]byte, error)
 }

internal/provider/puppet/puppet_test.go

@@ -0,0 +1,78 @@
+package puppet
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"git.unkin.net/unkin/artifactapi/internal/provider"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+func TestType(t *testing.T) {
+	if (&Provider{}).Type() != models.PackagePuppet {
+		t.Fatal("wrong type")
+	}
+}
+
+func TestClassify(t *testing.T) {
+	p := &Provider{}
+	if p.Classify("v3/modules/puppetlabs-stdlib") != provider.Mutable {
+		t.Error("modules should be mutable")
+	}
+	if p.Classify("v3/releases?module=x") != provider.Mutable {
+		t.Error("releases should be mutable")
+	}
+	if p.Classify("v3/files/puppetlabs-stdlib-1.0.0.tar.gz") != provider.Immutable {
+		t.Error("files should be immutable")
+	}
+}
+
+func TestContentType(t *testing.T) {
+	p := &Provider{}
+	if p.ContentType("x/mod-1.0.0.tar.gz") != "application/gzip" {
+		t.Error("tar.gz")
+	}
+	if p.ContentType("v3/modules/x") != "application/json" {
+		t.Error("v3 json")
+	}
+	if p.ContentType("other") != "application/octet-stream" {
+		t.Error("default")
+	}
+}
+
+func TestUpstreamURL(t *testing.T) {
+	got := (&Provider{}).UpstreamURL(models.Remote{BaseURL: "https://forgeapi.puppet.com/"}, "/v3/modules/x")
+	if got != "https://forgeapi.puppet.com/v3/modules/x" {
+		t.Errorf("got %q", got)
+	}
+}
+
+func TestRewriteResponse(t *testing.T) {
+	p := &Provider{}
+	remote := models.Remote{Name: "forge", BaseURL: "https://forgeapi.puppet.com"}
+
+	if out, _ := p.RewriteResponse([]byte("x"), remote, ""); out != nil {
+		t.Error("empty proxyBaseURL is a no-op")
+	}
+
+	body := []byte(`{"file_uri":"/v3/files/mod.tar.gz","home":"https://forgeapi.puppet.com/x"}`)
+	out, err := p.RewriteResponse(body, remote, "http://proxy")
+	if err != nil {
+		t.Fatal(err)
+	}
+	s := string(out)
+	if !strings.Contains(s, "http://proxy/api/v1/remote/forge/v3/files/mod.tar.gz") {
+		t.Errorf("v3/files not rewritten: %s", s)
+	}
+	if !strings.Contains(s, "http://proxy/api/v1/remote/forge/x") {
+		t.Errorf("base URL not rewritten: %s", s)
+	}
+}
+
+func TestAuthHeaders(t *testing.T) {
+	h, _ := (&Provider{}).AuthHeaders(context.Background(), models.Remote{})
+	if h.Get("Authorization") != "" {
+		t.Error("no credentials, no header")
+	}
+}

internal/provider/pypi/pypi_test.go

@@ -0,0 +1,177 @@
+package pypi
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"git.unkin.net/unkin/artifactapi/internal/provider"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+// fakeFileStore is an in-memory provider.FileStore for exercising local index
+// generation without a database.
+type fakeFileStore struct {
+	packages []string
+	files    map[string][]provider.FileEntry
+}
+
+func (f *fakeFileStore) ListPackages(_ context.Context, _ string) ([]string, error) {
+	return f.packages, nil
+}
+
+func (f *fakeFileStore) ListFilesByPrefix(_ context.Context, _, prefix string) ([]provider.FileEntry, error) {
+	return f.files[prefix], nil
+}
+
+func TestTypeClassifyContentType(t *testing.T) {
+	p := &Provider{}
+	if p.Type() != models.PackagePyPI {
+		t.Fatal("type")
+	}
+	if p.Classify("simple/foo/") != provider.Mutable {
+		t.Error("simple index should be mutable")
+	}
+	if p.Classify("packages/foo-1.0.whl") != provider.Immutable {
+		t.Error("wheel should be immutable")
+	}
+	cases := map[string]string{
+		"foo-1.0-py3-none-any.whl": "application/zip",
+		"foo-1.0.zip":              "application/zip",
+		"foo-1.0.tar.gz":           "application/gzip",
+		"simple/foo/":              "text/html",
+		"weird":                    "application/octet-stream",
+	}
+	for path, want := range cases {
+		if got := p.ContentType(path); got != want {
+			t.Errorf("ContentType(%q)=%q want %q", path, got, want)
+		}
+	}
+}
+
+func TestUpstreamURL(t *testing.T) {
+	p := &Provider{}
+	if got := p.UpstreamURL(models.Remote{BaseURL: "https://files.example.com"}, "packages/foo.whl"); got != "https://files.example.com/packages/foo.whl" {
+		t.Errorf("got %q", got)
+	}
+	if got := p.UpstreamURL(models.Remote{BaseURL: "https://x"}, "simple/foo/"); got != "https://pypi.org/simple/foo/" {
+		t.Errorf("simple should hit pypi.org, got %q", got)
+	}
+}
+
+func TestValidateUpload(t *testing.T) {
+	p := &Provider{}
+	sp, ct, err := p.ValidateUpload("numpy-1.26.0-cp311-cp311-linux_x86_64.whl")
+	if err != nil || sp != "numpy/numpy-1.26.0-cp311-cp311-linux_x86_64.whl" || ct != "application/zip" {
+		t.Errorf("wheel: sp=%q ct=%q err=%v", sp, ct, err)
+	}
+	sp, ct, err = p.ValidateUpload("requests-2.31.0.tar.gz")
+	if err != nil || sp != "requests/requests-2.31.0.tar.gz" || ct != "application/gzip" {
+		t.Errorf("sdist: sp=%q ct=%q err=%v", sp, ct, err)
+	}
+	if _, _, err := p.ValidateUpload("not-a-package.txt"); err == nil {
+		t.Error("expected error for bad extension")
+	}
+}
+
+func TestPackageNameParsing(t *testing.T) {
+	if got := packageFromWheel("Foo_Bar-1.0-py3-none-any.whl"); got != "foo-bar" {
+		t.Errorf("wheel name = %q", got)
+	}
+	if got := packageFromWheel("noseparator.whl"); got != "" {
+		t.Errorf("expected empty for unparseable wheel, got %q", got)
+	}
+	if got := packageFromSdist("My.Pkg-2.0.tar.gz"); got != "my-pkg" {
+		t.Errorf("sdist name = %q", got)
+	}
+	if got := packageFromSdist("noseparator.zip"); got != "" {
+		t.Errorf("expected empty, got %q", got)
+	}
+}
+
+func TestUploadResponse(t *testing.T) {
+	resp := (&Provider{}).UploadResponse("foo/foo-1.0.whl", "sha256:abc", 123)
+	if resp["filename"] != "foo-1.0.whl" || resp["package"] != "foo" || resp["content_hash"] != "sha256:abc" {
+		t.Errorf("unexpected upload response: %v", resp)
+	}
+}
+
+func TestRewriteResponse(t *testing.T) {
+	p := &Provider{}
+	if out, _ := p.RewriteResponse([]byte("x"), models.Remote{Name: "pypi"}, ""); out != nil {
+		t.Error("empty proxyBaseURL is a no-op")
+	}
+	body := []byte(`<a href="https://files.pythonhosted.org/packages/foo.whl">foo.whl</a>`)
+	out, err := p.RewriteResponse(body, models.Remote{Name: "pypi"}, "http://proxy")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(out), "http://proxy/api/v1/remote/pypi/") {
+		t.Errorf("not rewritten: %s", out)
+	}
+}
+
+func TestGenerateLocalIndex(t *testing.T) {
+	p := &Provider{}
+	fs := &fakeFileStore{
+		packages: []string{"foo", "bar"},
+		files: map[string][]provider.FileEntry{
+			"foo/": {{FilePath: "foo/foo-1.0-py3-none-any.whl", ContentHash: "sha256:aaa"}},
+		},
+	}
+	list, err := p.GenerateLocalIndex(context.Background(), fs, "local", "simple/")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(list), "foo") || !strings.Contains(string(list), "bar") {
+		t.Errorf("package list missing entries: %s", list)
+	}
+
+	files, err := p.GenerateLocalIndex(context.Background(), fs, "local", "simple/foo/")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(files), "foo-1.0-py3-none-any.whl") {
+		t.Errorf("file list missing wheel: %s", files)
+	}
+
+	if _, err := p.GenerateLocalIndex(context.Background(), fs, "local", "notsimple"); err == nil {
+		t.Error("expected error for non-simple path")
+	}
+}
+
+func TestServeLocalIndexHTTP(t *testing.T) {
+	p := &Provider{}
+	fs := &fakeFileStore{
+		packages: []string{"foo"},
+		files: map[string][]provider.FileEntry{
+			"foo/": {{FilePath: "foo/foo-1.0-py3-none-any.whl", ContentHash: "sha256:aaa"}},
+		},
+	}
+	serve := func(path string) (*httptest.ResponseRecorder, bool) {
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/"+path, nil)
+		handled := p.ServeLocalIndex(w, r, fs, "local", path)
+		return w, handled
+	}
+
+	if w, ok := serve("simple/"); !ok || w.Code != 200 || !strings.Contains(w.Body.String(), "foo") {
+		t.Errorf("simple index: handled=%v code=%d body=%s", ok, w.Code, w.Body.String())
+	}
+	if w, ok := serve("simple/foo/"); !ok || w.Code != 200 || !strings.Contains(w.Body.String(), "foo-1.0-py3-none-any.whl") {
+		t.Errorf("package index: handled=%v code=%d body=%s", ok, w.Code, w.Body.String())
+	}
+	// Non-simple paths are not handled.
+	if _, ok := serve("packages/foo.whl"); ok {
+		t.Error("non-index path should not be handled")
+	}
+}
+
+func TestAuthHeaders(t *testing.T) {
+	h, _ := (&Provider{}).AuthHeaders(context.Background(), models.Remote{Username: "u", Password: "p"})
+	if h.Get("Authorization") == "" {
+		t.Error("expected auth header")
+	}
+}

internal/provider/rpm/github.go

@@ -0,0 +1,732 @@
+package rpm
+
+import (
+	"bytes"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log/slog"
+	"net/http"
+	"net/url"
+	"regexp"
+	"strings"
+	"sync"
+	"time"
+
+	rpmlib "github.com/cavaliergopher/rpm"
+	"golang.org/x/time/rate"
+
+	"git.unkin.net/unkin/artifactapi/internal/githubauth"
+	"git.unkin.net/unkin/artifactapi/internal/provider"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+// gitHubProvider is the process-wide singleton. The background Syncer binds its
+// shared rate limiter and work queue onto this instance so the request path and
+// the syncer drive the same derive machinery.
+var gitHubProvider = newGitHubProvider()
+
+func init() {
+	provider.Register(gitHubProvider)
+}
+
+// Tuning knobs for the no-precache header fetch. Fields (not consts) so tests
+// can shrink them against small fixtures.
+const (
+	defaultHeaderRangeInitial = 1 << 20  // 1 MiB — covers the header of almost every RPM
+	defaultHeaderRangeMax     = 16 << 20 // 16 MiB — give up past this and skip the asset
+	defaultReleasePageCap     = 10       // 100 releases/page * 10 pages
+
+	// defaultScanTimeout bounds a detached background scan (which may do one
+	// ranged fetch per asset across every release) so it can never run forever.
+	defaultScanTimeout = 10 * time.Minute
+	// defaultServeTimeout bounds a repodata DB read served on a detached context.
+	defaultServeTimeout = 30 * time.Second
+
+	// defaultColdWait bounds how long a repodata request blocks waiting for a
+	// just-enqueued prime to populate an empty cache before returning a
+	// retryable 503. Kept short so a client never hangs on a rate-limited derive
+	// of a large repo; small repos usually prime within this window.
+	defaultColdWait = 8 * time.Second
+)
+
+// GitHubProvider is a metadata-only remote: it scans a GitHub repo's releases
+// for .rpm assets, derives per-asset RPM metadata via a ranged header fetch
+// (never downloading whole packages), synthesizes yum repodata from that cached
+// metadata, and redirects package downloads to a backend "releases_remote"
+// (the generic github.com remote) that serves the actual bytes.
+type GitHubProvider struct {
+	client *http.Client
+
+	headerInitial int64
+	headerMax     int64
+	pageCap       int
+	scanTimeout   time.Duration
+	serveTimeout  time.Duration
+	coldWait      time.Duration
+
+	// limiter, when set by the Syncer, gates every GitHub HTTP call (releases
+	// list + each ranged asset fetch) through a single process-wide token bucket.
+	// nil means unlimited (direct provider use / unit tests).
+	limiter *rate.Limiter
+	// syncer, when set, routes freshness refresh and cold-start priming through
+	// the shared background work queue instead of an inline per-replica scan.
+	syncer *Syncer
+
+	// serverCred overrides the process-wide GitHub credential for this provider
+	// instance. nil falls back to githubauth.Server(); set directly in tests.
+	serverCred githubauth.Credential
+
+	mu       sync.Mutex
+	scanning map[string]bool
+	lastScan map[string]time.Time
+}
+
+func newGitHubProvider() *GitHubProvider {
+	return &GitHubProvider{
+		client:        &http.Client{},
+		headerInitial: defaultHeaderRangeInitial,
+		headerMax:     defaultHeaderRangeMax,
+		pageCap:       defaultReleasePageCap,
+		scanTimeout:   defaultScanTimeout,
+		serveTimeout:  defaultServeTimeout,
+		coldWait:      defaultColdWait,
+		scanning:      map[string]bool{},
+		lastScan:      map[string]time.Time{},
+	}
+}
+
+// limiterWait blocks until the shared rate limiter grants a token, or returns
+// the context error if it is canceled first. A nil limiter is a no-op.
+func (p *GitHubProvider) limiterWait(ctx context.Context) error {
+	if p.limiter == nil {
+		return nil
+	}
+	return p.limiter.Wait(ctx)
+}
+
+func (p *GitHubProvider) Type() models.PackageType { return models.PackageGitHubRPM }
+
+// Classify/ContentType/UpstreamURL/RewriteResponse/AuthHeaders satisfy the
+// Provider interface. The proxy engine never reaches them for this type because
+// ServeRemote handles every request, but they must exist for registry lookup.
+func (p *GitHubProvider) Classify(path string) provider.Mutability {
+	if strings.HasPrefix(path, "repodata/") {
+		return provider.Mutable
+	}
+	return provider.Immutable
+}
+
+func (p *GitHubProvider) ContentType(path string) string {
+	switch {
+	case strings.HasSuffix(path, ".rpm"):
+		return "application/x-rpm"
+	case strings.HasSuffix(path, ".xml.gz"):
+		return "application/gzip"
+	case strings.HasSuffix(path, ".xml"):
+		return "application/xml"
+	}
+	return "application/octet-stream"
+}
+
+func (p *GitHubProvider) UpstreamURL(remote models.Remote, path string) string {
+	return strings.TrimRight(remote.BaseURL, "/") + "/" + strings.TrimLeft(path, "/")
+}
+
+func (p *GitHubProvider) RewriteResponse(_ []byte, _ models.Remote, _ string) ([]byte, error) {
+	return nil, nil
+}
+
+func (p *GitHubProvider) AuthHeaders(ctx context.Context, remote models.Remote) (http.Header, error) {
+	return p.githubHeaders(ctx, remote, false)
+}
+
+// ServeRemote answers a request against a github_rpm remote. It refreshes the
+// derived metadata (bounded by mutable_ttl), serves synthesized repodata, and
+// 302-redirects .rpm downloads to the backend releases_remote. Returns false
+// only for paths it does not own, letting the normal proxy path take over.
+func (p *GitHubProvider) ServeRemote(w http.ResponseWriter, r *http.Request, remote models.Remote, path, proxyBaseURL string, store provider.RemoteMetadataStore) bool {
+	p.onRequest(remote, store)
+
+	if strings.HasPrefix(path, "repodata/") {
+		// Serve repodata on a context detached from the inbound request: a
+		// client disconnect (e.g. dnf makecache timing out) must never cancel
+		// the metadata DB read and surface as a 500.
+		sctx, cancel := context.WithTimeout(context.WithoutCancel(r.Context()), p.serveTimeout)
+		defer cancel()
+		sr := r.WithContext(sctx)
+
+		// Cold start: with the syncer wired, an empty cache means the prime has
+		// not landed yet. Enqueue it and wait briefly rather than serving empty
+		// repodata; if it still has not primed, return a retryable 503.
+		if p.syncer != nil && !p.ensurePrimed(sctx, remote, store) {
+			w.Header().Set("Retry-After", "5")
+			http.Error(w, "metadata is being prepared, retry shortly", http.StatusServiceUnavailable)
+			return true
+		}
+
+		tail := strings.TrimPrefix(path, "repodata/")
+		lp := &Provider{}
+		switch {
+		case tail == "repomd.xml":
+			lp.serveRepomd(w, sr, store, remote.Name)
+		case strings.HasSuffix(tail, "-primary.xml.gz"):
+			lp.servePrimary(w, sr, store, remote.Name)
+		case strings.HasSuffix(tail, "-filelists.xml.gz"):
+			lp.serveFilelists(w, sr, store, remote.Name)
+		case strings.HasSuffix(tail, "-other.xml.gz"):
+			lp.serveOther(w, sr, store, remote.Name)
+		default:
+			http.Error(w, "not found", http.StatusNotFound)
+		}
+		return true
+	}
+
+	if strings.HasSuffix(path, ".rpm") {
+		if remote.ReleasesRemote == "" {
+			http.Error(w, "github_rpm remote has no releases_remote configured for downloads", http.StatusInternalServerError)
+			return true
+		}
+		loc := strings.TrimRight(proxyBaseURL, "/") + "/api/v1/remote/" + remote.ReleasesRemote + "/" + strings.TrimLeft(path, "/")
+		http.Redirect(w, r, loc, http.StatusFound)
+		return true
+	}
+
+	return false
+}
+
+// onRequest keeps a remote's derived metadata fresh off the request path. With
+// the background syncer wired it enqueues a deduped, rate-limited, lease-gated
+// refresh and returns immediately; the request always serves the current cache.
+// Without a syncer (direct provider use / unit tests) it falls back to the
+// legacy inline single-flight scan.
+func (p *GitHubProvider) onRequest(remote models.Remote, store provider.RemoteMetadataStore) {
+	if p.syncer != nil {
+		p.syncer.enqueue(remote, false)
+		return
+	}
+	p.refresh(remote, store)
+}
+
+// ensurePrimed returns true once the remote has at least one cached metadata
+// row. On an empty cache it enqueues a prime and polls briefly for it to land,
+// so the very first client after a remote is created gets real repodata instead
+// of an empty index or a blocking multi-minute derive. Returns false if the
+// cache is still empty after the bounded wait.
+func (p *GitHubProvider) ensurePrimed(ctx context.Context, remote models.Remote, store provider.RemoteMetadataStore) bool {
+	if !p.cacheEmpty(ctx, store, remote.Name) {
+		return true
+	}
+	if p.syncer != nil {
+		p.syncer.enqueue(remote, true)
+	}
+
+	deadline := time.Now().Add(p.coldWait)
+	for time.Now().Before(deadline) {
+		select {
+		case <-ctx.Done():
+			return false
+		case <-time.After(400 * time.Millisecond):
+		}
+		if !p.cacheEmpty(ctx, store, remote.Name) {
+			return true
+		}
+	}
+	return false
+}
+
+func (p *GitHubProvider) cacheEmpty(ctx context.Context, store provider.RemoteMetadataStore, name string) bool {
+	rows, err := store.ListRPMMetadataEntries(ctx, name)
+	if err != nil {
+		// Treat a failed read as "not empty" so a transient DB error becomes a
+		// normal serve attempt (which reports its own error) rather than a 503.
+		return false
+	}
+	return len(rows) == 0
+}
+
+// refresh brings the derived metadata up to date without coupling the scan to
+// the inbound request. When the cache is stale it single-flights a scan: if the
+// cache already holds rows the scan runs in the background and the caller serves
+// the current cache immediately; only a completely empty cache blocks on a
+// bounded first scan (so the first client sees packages rather than an empty or
+// 500 repodata).
+func (p *GitHubProvider) refresh(remote models.Remote, store provider.RemoteMetadataStore) {
+	ttl := time.Duration(remote.MutableTTL) * time.Second
+	if ttl <= 0 {
+		ttl = 5 * time.Minute
+	}
+
+	p.mu.Lock()
+	last, ok := p.lastScan[remote.Name]
+	fresh := ok && time.Since(last) < ttl
+	if fresh || p.scanning[remote.Name] {
+		p.mu.Unlock()
+		return
+	}
+	p.scanning[remote.Name] = true
+	p.mu.Unlock()
+
+	empty := true
+	if rows, err := store.ListRPMMetadataEntries(context.Background(), remote.Name); err == nil {
+		empty = len(rows) == 0
+	}
+
+	if empty {
+		p.runScan(remote, store)
+		return
+	}
+	go p.runScan(remote, store)
+}
+
+// runScan derives metadata on a detached, bounded context so a client cancel
+// can neither abort the shared derive nor poison the metadata read. The caller
+// must have already claimed the single-flight slot (scanning[name] = true).
+func (p *GitHubProvider) runScan(remote models.Remote, store provider.RemoteMetadataStore) {
+	defer func() {
+		p.mu.Lock()
+		delete(p.scanning, remote.Name)
+		p.mu.Unlock()
+	}()
+
+	ctx, cancel := context.WithTimeout(context.Background(), p.scanTimeout)
+	defer cancel()
+
+	if err := p.scan(ctx, remote, store); err != nil {
+		// Keep serving whatever metadata is already cached rather than 500ing.
+		slog.Error("github_rpm: release scan failed", "remote", remote.Name, "error", err)
+		return
+	}
+
+	p.mu.Lock()
+	p.lastScan[remote.Name] = time.Now()
+	p.mu.Unlock()
+}
+
+// scan runs a full unconditional derive. Retained for the legacy inline refresh
+// path and existing tests; the syncer uses scanWithState to pass and receive the
+// releases-list ETag.
+func (p *GitHubProvider) scan(ctx context.Context, remote models.Remote, store provider.RemoteMetadataStore) error {
+	_, _, err := p.scanWithState(ctx, remote, store, "")
+	return err
+}
+
+// scanWithState derives metadata incrementally. It sends the prior releases-list
+// ETag as a conditional request: a 304 means nothing changed, so it returns
+// (etag, changed=false) without a single asset fetch. On a 200 it diffs the
+// release assets against the cache, derives only new/changed assets, prunes
+// assets that disappeared, and returns the new ETag.
+func (p *GitHubProvider) scanWithState(ctx context.Context, remote models.Remote, store provider.RemoteMetadataStore, etag string) (newEtag string, changed bool, err error) {
+	releases, newEtag, notModified, err := p.fetchReleases(ctx, remote, etag)
+	if err != nil {
+		return etag, false, err
+	}
+	if notModified {
+		return etag, false, nil
+	}
+
+	existing, err := store.ListRPMMetadataEntries(ctx, remote.Name)
+	if err != nil {
+		return newEtag, false, err
+	}
+	existingByPath := make(map[string]provider.RPMMetadata, len(existing))
+	for _, m := range existing {
+		existingByPath[m.FilePath] = m
+	}
+
+	allow, err := compilePatterns(remote.Patterns)
+	if err != nil {
+		return newEtag, false, err
+	}
+
+	seen := map[string]bool{}
+	for _, rel := range releases {
+		if rel.Draft {
+			continue
+		}
+		for _, asset := range rel.Assets {
+			if !strings.HasSuffix(strings.ToLower(asset.Name), ".rpm") {
+				continue
+			}
+			if !matchesAny(allow, asset.Name) {
+				continue
+			}
+			fp := assetPath(asset)
+			if fp == "" {
+				continue
+			}
+			seen[fp] = true
+
+			if cur, ok := existingByPath[fp]; ok {
+				// Assets are effectively immutable; only re-derive when the
+				// upstream digest is known and no longer matches what we cached.
+				if asset.Digest == "" || cur.ContentHash == asset.Digest {
+					continue
+				}
+				_ = store.DeleteRPMMetadata(ctx, remote.Name, fp)
+			}
+
+			meta, err := p.deriveAsset(ctx, remote, asset, fp)
+			if err != nil {
+				slog.Warn("github_rpm: derive asset failed", "remote", remote.Name, "asset", asset.Name, "error", err)
+				continue
+			}
+			if err := store.InsertRPMMetadata(ctx, meta); err != nil {
+				slog.Error("github_rpm: insert metadata failed", "remote", remote.Name, "asset", asset.Name, "error", err)
+				continue
+			}
+			slog.Info("github_rpm: derived asset", "remote", remote.Name, "name", meta.Name, "version", meta.Version, "arch", meta.Arch)
+		}
+	}
+
+	for fp := range existingByPath {
+		if !seen[fp] {
+			_ = store.DeleteRPMMetadata(ctx, remote.Name, fp)
+		}
+	}
+	return newEtag, true, nil
+}
+
+type ghRelease struct {
+	TagName string    `json:"tag_name"`
+	Draft   bool      `json:"draft"`
+	Assets  []ghAsset `json:"assets"`
+}
+
+type ghAsset struct {
+	Name               string `json:"name"`
+	Size               int64  `json:"size"`
+	BrowserDownloadURL string `json:"browser_download_url"`
+	Digest             string `json:"digest"`
+}
+
+// fetchReleases lists a repo's releases. It sends the prior ETag as
+// If-None-Match on page 1 (the newest releases, where a new one first appears):
+// a 304 there means the repo is unchanged, so it returns notModified without
+// paging further — GitHub does not count 304 conditional responses against the
+// rate limit, making an unchanged repo nearly free. On a 200 it captures the
+// page-1 ETag and pages through the rest normally. Every call waits on the
+// shared limiter first.
+func (p *GitHubProvider) fetchReleases(ctx context.Context, remote models.Remote, etag string) (all []ghRelease, newEtag string, notModified bool, err error) {
+	base := strings.TrimRight(remote.BaseURL, "/") + "/releases"
+	for page := 1; page <= p.pageCap; page++ {
+		u := fmt.Sprintf("%s?per_page=100&page=%d", base, page)
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, u, nil)
+		if err != nil {
+			return nil, "", false, err
+		}
+		hdr, err := p.githubHeaders(ctx, remote, true)
+		if err != nil {
+			return nil, "", false, err
+		}
+		copyHeaders(req, hdr)
+		if page == 1 && etag != "" {
+			req.Header.Set("If-None-Match", etag)
+		}
+
+		if err := p.limiterWait(ctx); err != nil {
+			return nil, "", false, err
+		}
+		resp, err := p.client.Do(req)
+		if err != nil {
+			return nil, "", false, err
+		}
+		if page == 1 && resp.StatusCode == http.StatusNotModified {
+			io.Copy(io.Discard, resp.Body)
+			resp.Body.Close()
+			return nil, etag, true, nil
+		}
+		body, err := io.ReadAll(resp.Body)
+		respEtag := resp.Header.Get("ETag")
+		resp.Body.Close()
+		if err != nil {
+			return nil, "", false, err
+		}
+		if resp.StatusCode != http.StatusOK {
+			return nil, "", false, fmt.Errorf("github releases API %s: status %d", u, resp.StatusCode)
+		}
+		if page == 1 {
+			newEtag = respEtag
+		}
+		var releases []ghRelease
+		if err := json.Unmarshal(body, &releases); err != nil {
+			return nil, "", false, fmt.Errorf("decode releases: %w", err)
+		}
+		if len(releases) == 0 {
+			break
+		}
+		all = append(all, releases...)
+		if len(releases) < 100 {
+			break
+		}
+	}
+	return all, newEtag, false, nil
+}
+
+func (p *GitHubProvider) deriveAsset(ctx context.Context, remote models.Remote, asset ghAsset, fp string) (*provider.RPMMetadata, error) {
+	pkg, err := p.fetchHeader(ctx, remote, asset.BrowserDownloadURL)
+	if err != nil {
+		return nil, err
+	}
+
+	meta := &provider.RPMMetadata{
+		RepoName:      remote.Name,
+		FilePath:      fp,
+		Name:          pkg.Name(),
+		Epoch:         pkg.Epoch(),
+		Version:       pkg.Version(),
+		Release:       pkg.Release(),
+		Arch:          pkg.Architecture(),
+		Summary:       pkg.Summary(),
+		Description:   pkg.Description(),
+		RPMSize:       asset.Size,
+		InstalledSize: int64(pkg.Size()),
+		License:       pkg.License(),
+		Vendor:        pkg.Vendor(),
+		Group:         firstGroup(pkg.Groups()),
+		BuildHost:     pkg.BuildHost(),
+		SourceRPM:     pkg.SourceRPM(),
+		URL:           pkg.URL(),
+		Packager:      pkg.Packager(),
+	}
+
+	for _, d := range pkg.Requires() {
+		meta.Requires = append(meta.Requires, rpmDepFromEntry(d))
+	}
+	for _, d := range pkg.Provides() {
+		meta.Provides = append(meta.Provides, rpmDepFromEntry(d))
+	}
+	for _, d := range pkg.Conflicts() {
+		meta.Conflicts = append(meta.Conflicts, rpmDepFromEntry(d))
+	}
+	for _, d := range pkg.Obsoletes() {
+		meta.Obsoletes = append(meta.Obsoletes, rpmDepFromEntry(d))
+	}
+	for _, f := range pkg.Files() {
+		rf := provider.RPMFile{Path: f.Name()}
+		if f.IsDir() {
+			rf.Type = "dir"
+		}
+		meta.Files = append(meta.Files, rf)
+	}
+
+	if meta.Requires == nil {
+		meta.Requires = []provider.RPMDep{}
+	}
+	if meta.Provides == nil {
+		meta.Provides = []provider.RPMDep{}
+	}
+	if meta.Conflicts == nil {
+		meta.Conflicts = []provider.RPMDep{}
+	}
+	if meta.Obsoletes == nil {
+		meta.Obsoletes = []provider.RPMDep{}
+	}
+	if meta.Files == nil {
+		meta.Files = []provider.RPMFile{}
+	}
+	meta.Changelogs = []provider.RPMChangelog{}
+
+	// The primary.xml pkgid checksum must be the sha256 of the whole package.
+	// Prefer GitHub's asset digest so we never download the body; only when it
+	// is absent (or not sha256) do we stream the asset once to compute it.
+	if h, ok := sha256FromDigest(asset.Digest); ok {
+		meta.ContentHash = "sha256:" + h
+	} else {
+		h, err := p.computeSHA256(ctx, remote, asset.BrowserDownloadURL)
+		if err != nil {
+			return nil, fmt.Errorf("compute sha256: %w", err)
+		}
+		meta.ContentHash = "sha256:" + h
+	}
+
+	return meta, nil
+}
+
+// fetchHeader pulls only the front of the package with a ranged GET and parses
+// the RPM header from it. The header sits before the payload, so a small prefix
+// is enough; on a truncated-header parse error it doubles the range and retries.
+func (p *GitHubProvider) fetchHeader(ctx context.Context, remote models.Remote, downloadURL string) (*rpmlib.Package, error) {
+	n := p.headerInitial
+	for {
+		body, full, err := p.rangeGet(ctx, remote, downloadURL, n)
+		if err != nil {
+			return nil, err
+		}
+		pkg, perr := rpmlib.Read(bytes.NewReader(body))
+		if perr == nil {
+			return pkg, nil
+		}
+		truncated := errors.Is(perr, io.ErrUnexpectedEOF) || errors.Is(perr, io.EOF)
+		if truncated && !full && n < p.headerMax {
+			n *= 2
+			if n > p.headerMax {
+				n = p.headerMax
+			}
+			continue
+		}
+		return nil, fmt.Errorf("parse rpm header: %w", perr)
+	}
+}
+
+// rangeGet returns the first n bytes of downloadURL. full is true when the
+// response body was shorter than n (i.e. we already have the whole object).
+func (p *GitHubProvider) rangeGet(ctx context.Context, remote models.Remote, downloadURL string, n int64) ([]byte, bool, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, downloadURL, nil)
+	if err != nil {
+		return nil, false, err
+	}
+	hdr, err := p.githubHeaders(ctx, remote, false)
+	if err != nil {
+		return nil, false, err
+	}
+	copyHeaders(req, hdr)
+	req.Header.Set("Range", fmt.Sprintf("bytes=0-%d", n-1))
+
+	if err := p.limiterWait(ctx); err != nil {
+		return nil, false, err
+	}
+	resp, err := p.client.Do(req)
+	if err != nil {
+		return nil, false, err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK && resp.StatusCode != http.StatusPartialContent {
+		return nil, false, fmt.Errorf("range GET %s: status %d", downloadURL, resp.StatusCode)
+	}
+
+	body, err := io.ReadAll(io.LimitReader(resp.Body, n))
+	if err != nil {
+		return nil, false, err
+	}
+	full := int64(len(body)) < n
+	return body, full, nil
+}
+
+func (p *GitHubProvider) computeSHA256(ctx context.Context, remote models.Remote, downloadURL string) (string, error) {
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, downloadURL, nil)
+	if err != nil {
+		return "", err
+	}
+	hdr, err := p.githubHeaders(ctx, remote, false)
+	if err != nil {
+		return "", err
+	}
+	copyHeaders(req, hdr)
+
+	if err := p.limiterWait(ctx); err != nil {
+		return "", err
+	}
+	resp, err := p.client.Do(req)
+	if err != nil {
+		return "", err
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		return "", fmt.Errorf("GET %s: status %d", downloadURL, resp.StatusCode)
+	}
+
+	h := sha256.New()
+	if _, err := io.Copy(h, resp.Body); err != nil {
+		return "", err
+	}
+	return hex.EncodeToString(h.Sum(nil)), nil
+}
+
+// assetPath is the package's location relative to github.com — the path the
+// backend releases_remote (base https://github.com) proxies. It doubles as the
+// rpm_metadata key and the <location href> in primary.xml.
+func assetPath(asset ghAsset) string {
+	u, err := url.Parse(asset.BrowserDownloadURL)
+	if err != nil {
+		return ""
+	}
+	return strings.TrimPrefix(u.Path, "/")
+}
+
+func sha256FromDigest(digest string) (string, bool) {
+	if strings.HasPrefix(digest, "sha256:") {
+		return strings.TrimPrefix(digest, "sha256:"), true
+	}
+	return "", false
+}
+
+// githubHeaders builds the outbound headers for a GitHub request, attaching a
+// bearer credential when one is available. A per-remote credential wins; absent
+// that, the process-wide server credential is used; absent both, the request is
+// unauthenticated (anonymous, subject to the 60/hr cap).
+func (p *GitHubProvider) githubHeaders(ctx context.Context, remote models.Remote, api bool) (http.Header, error) {
+	h := http.Header{}
+	if api {
+		h.Set("Accept", "application/vnd.github+json")
+		h.Set("X-GitHub-Api-Version", "2022-11-28")
+	}
+	tok, err := p.githubToken(ctx, remote)
+	if err != nil {
+		return nil, err
+	}
+	if tok != "" {
+		h.Set("Authorization", "Bearer "+tok)
+	}
+	return h, nil
+}
+
+// githubToken resolves the bearer token for a remote. Precedence: a per-remote
+// credential (password, then username) overrides the server credential.
+func (p *GitHubProvider) githubToken(ctx context.Context, remote models.Remote) (string, error) {
+	if remote.Password != "" {
+		return remote.Password, nil
+	}
+	if remote.Username != "" {
+		return remote.Username, nil
+	}
+	if c := p.serverCredential(); c != nil {
+		return c.Token(ctx)
+	}
+	return "", nil
+}
+
+// serverCredential returns this provider's server credential, defaulting to the
+// process-wide one installed at startup.
+func (p *GitHubProvider) serverCredential() githubauth.Credential {
+	if p.serverCred != nil {
+		return p.serverCred
+	}
+	return githubauth.Server()
+}
+
+func copyHeaders(req *http.Request, h http.Header) {
+	for k, vals := range h {
+		for _, v := range vals {
+			req.Header.Add(k, v)
+		}
+	}
+}
+
+func compilePatterns(patterns []string) ([]*regexp.Regexp, error) {
+	var out []*regexp.Regexp
+	for _, p := range patterns {
+		re, err := regexp.Compile(p)
+		if err != nil {
+			return nil, fmt.Errorf("invalid pattern %q: %w", p, err)
+		}
+		out = append(out, re)
+	}
+	return out, nil
+}
+
+func matchesAny(res []*regexp.Regexp, s string) bool {
+	if len(res) == 0 {
+		return true
+	}
+	for _, re := range res {
+		if re.MatchString(s) {
+			return true
+		}
+	}
+	return false
+}

internal/provider/rpm/github_auth_test.go

@@ -0,0 +1,134 @@
+package rpm
+
+import (
+	"context"
+	"encoding/json"
+	"strings"
+	"testing"
+
+	"git.unkin.net/unkin/artifactapi/internal/githubauth"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+// staticCred is a test Credential yielding a fixed token.
+type staticCred string
+
+func (s staticCred) Token(context.Context) (string, error) { return string(s), nil }
+
+func TestGitHubServerCredentialAttachedToReleasesAndAssets(t *testing.T) {
+	fx := newGitHubFixture(t, true)
+	p := newTestProvider()
+	p.serverCred = staticCred("ghp_server_secret")
+	store := newFakeStore()
+
+	if err := p.scan(context.Background(), fx.remote(), store); err != nil {
+		t.Fatalf("scan: %v", err)
+	}
+	if got := fx.releaseAuth; got != "Bearer ghp_server_secret" {
+		t.Fatalf("releases Authorization = %q, want Bearer ghp_server_secret", got)
+	}
+	if got := fx.assetAuth; got != "Bearer ghp_server_secret" {
+		t.Fatalf("asset Authorization = %q, want Bearer ghp_server_secret", got)
+	}
+}
+
+func TestGitHubPerRemoteCredentialOverridesServer(t *testing.T) {
+	fx := newGitHubFixture(t, true)
+	p := newTestProvider()
+	p.serverCred = staticCred("ghp_server_secret")
+	store := newFakeStore()
+
+	remote := fx.remote()
+	remote.Password = "ghp_remote_wins"
+
+	if err := p.scan(context.Background(), remote, store); err != nil {
+		t.Fatalf("scan: %v", err)
+	}
+	if got := fx.releaseAuth; got != "Bearer ghp_remote_wins" {
+		t.Fatalf("releases Authorization = %q, want per-remote token to win", got)
+	}
+	if got := fx.assetAuth; got != "Bearer ghp_remote_wins" {
+		t.Fatalf("asset Authorization = %q, want per-remote token to win", got)
+	}
+}
+
+func TestGitHubNoCredentialSendsNoAuthHeader(t *testing.T) {
+	fx := newGitHubFixture(t, true)
+	p := newTestProvider() // serverCred nil, package Server() unset in unit tests
+	store := newFakeStore()
+
+	if err := p.scan(context.Background(), fx.remote(), store); err != nil {
+		t.Fatalf("scan: %v", err)
+	}
+	if fx.releaseAuth != "" {
+		t.Fatalf("expected no Authorization header, got %q", fx.releaseAuth)
+	}
+	if fx.assetAuth != "" {
+		t.Fatalf("expected no asset Authorization header, got %q", fx.assetAuth)
+	}
+	// Requests still succeed anonymously.
+	if rows, _ := store.ListRPMMetadataEntries(context.Background(), "acme-rpm"); len(rows) != 1 {
+		t.Fatalf("anonymous scan should still derive metadata, got %d rows", len(rows))
+	}
+}
+
+func TestGitHubETag304FlowWithAuth(t *testing.T) {
+	fx := newGitHubFixture(t, true)
+	fx.etag = `"v1"`
+	p := newTestProvider()
+	p.serverCred = staticCred("ghp_server_secret")
+	store := newFakeStore()
+
+	etag, changed, err := p.scanWithState(context.Background(), fx.remote(), store, "")
+	if err != nil {
+		t.Fatalf("first scan: %v", err)
+	}
+	if !changed || etag != `"v1"` {
+		t.Fatalf("first scan changed=%v etag=%q, want true and \"v1\"", changed, etag)
+	}
+
+	// Re-scan with the captured ETag: a 304 means no change and no asset fetch.
+	etag2, changed2, err := p.scanWithState(context.Background(), fx.remote(), store, etag)
+	if err != nil {
+		t.Fatalf("second scan: %v", err)
+	}
+	if changed2 {
+		t.Fatal("expected no change on 304")
+	}
+	if etag2 != `"v1"` {
+		t.Fatalf("etag = %q, want preserved \"v1\"", etag2)
+	}
+	if fx.notModHit != 1 {
+		t.Fatalf("expected exactly one 304 response, got %d", fx.notModHit)
+	}
+	// The conditional request still carried the credential.
+	if fx.releaseAuth != "Bearer ghp_server_secret" {
+		t.Fatalf("conditional request Authorization = %q, want the server credential", fx.releaseAuth)
+	}
+}
+
+// TestGitHubCredentialAbsentFromRemoteJSON asserts the server credential never
+// appears in a remote's serialized API representation, and per-remote secrets
+// stay redacted by the models.Remote json:"-" tags.
+func TestGitHubCredentialAbsentFromRemoteJSON(t *testing.T) {
+	githubauth.SetServer(staticCred("ghp_super_secret_server_token"))
+	t.Cleanup(func() { githubauth.SetServer(nil) })
+
+	remote := models.Remote{
+		Name:        "acme-rpm",
+		PackageType: models.PackageGitHubRPM,
+		BaseURL:     "https://api.github.com/repos/acme/tools",
+		Username:    "per_remote_user",
+		Password:    "per_remote_secret",
+	}
+	b, err := json.Marshal(remote)
+	if err != nil {
+		t.Fatalf("marshal remote: %v", err)
+	}
+	js := string(b)
+	for _, secret := range []string{"ghp_super_secret_server_token", "per_remote_secret", "per_remote_user"} {
+		if strings.Contains(js, secret) {
+			t.Fatalf("credential %q leaked into remote JSON: %s", secret, js)
+		}
+	}
+}

internal/provider/rpm/github_test.go

@@ -0,0 +1,387 @@
+package rpm
+
+import (
+	"compress/gzip"
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strconv"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"git.unkin.net/unkin/artifactapi/internal/provider"
+	"git.unkin.net/unkin/artifactapi/internal/testsupport"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+// fakeStore is an in-memory provider.RemoteMetadataStore keyed by file_path,
+// mirroring the (repo_name, file_path) uniqueness of the real table.
+type fakeStore struct {
+	mu   sync.Mutex
+	rows map[string]provider.RPMMetadata
+}
+
+func newFakeStore() *fakeStore { return &fakeStore{rows: map[string]provider.RPMMetadata{}} }
+
+func (f *fakeStore) InsertRPMMetadata(_ context.Context, m *provider.RPMMetadata) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if _, ok := f.rows[m.FilePath]; ok {
+		return nil // ON CONFLICT DO NOTHING
+	}
+	f.rows[m.FilePath] = *m
+	return nil
+}
+
+func (f *fakeStore) DeleteRPMMetadata(_ context.Context, _, filePath string) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	delete(f.rows, filePath)
+	return nil
+}
+
+func (f *fakeStore) ListRPMMetadataEntries(ctx context.Context, _ string) ([]provider.RPMMetadata, error) {
+	// Mirror pgx: a canceled/expired context fails the read. This is what
+	// poisons the repodata response if the read runs on the inbound request.
+	if err := ctx.Err(); err != nil {
+		return nil, err
+	}
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	out := make([]provider.RPMMetadata, 0, len(f.rows))
+	for _, m := range f.rows {
+		out = append(out, m)
+	}
+	return out, nil
+}
+
+// githubFixture serves the releases API and the .rpm asset downloads (with
+// Range support) for a set of packages. digest controls whether the asset
+// carries a sha256 digest (no-download path) or not (compute path).
+type githubFixture struct {
+	srv         *httptest.Server
+	rpmBytes    map[string][]byte // asset filename -> bytes
+	rangeHit    map[string]int    // asset filename -> number of ranged GETs
+	fullHit     map[string]int    // asset filename -> number of full GETs
+	etag        string            // when set, served as ETag; matching If-None-Match yields 304
+	releasesHit int               // total releases-list requests (200 + 304)
+	notModHit   int               // releases-list requests answered 304
+	releaseAuth string            // Authorization header seen on the last releases request
+	assetAuth   string            // Authorization header seen on the last asset request
+	mu          sync.Mutex
+}
+
+func newGitHubFixture(t *testing.T, withDigest bool) *githubFixture {
+	t.Helper()
+	f := &githubFixture{
+		rpmBytes: map[string][]byte{},
+		rangeHit: map[string]int{},
+		fullHit:  map[string]int{},
+	}
+	f.rpmBytes["demo-1.2-3.x86_64.rpm"] = testsupport.MinimalRPM("demo", "1.2", "3", "x86_64")
+
+	mux := http.NewServeMux()
+	mux.HandleFunc("/repos/acme/tools/releases", func(w http.ResponseWriter, r *http.Request) {
+		page := r.URL.Query().Get("page")
+		if page != "" && page != "1" {
+			w.Write([]byte("[]"))
+			return
+		}
+		f.mu.Lock()
+		f.releasesHit++
+		f.releaseAuth = r.Header.Get("Authorization")
+		etag := f.etag
+		if etag != "" && r.Header.Get("If-None-Match") == etag {
+			f.notModHit++
+			f.mu.Unlock()
+			w.WriteHeader(http.StatusNotModified)
+			return
+		}
+		f.mu.Unlock()
+		if etag != "" {
+			w.Header().Set("ETag", etag)
+		}
+		var assets []map[string]any
+		for name := range f.rpmBytes {
+			a := map[string]any{
+				"name":                 name,
+				"size":                 len(f.rpmBytes[name]),
+				"browser_download_url": f.srv.URL + "/acme/tools/releases/download/v1.2-3/" + name,
+			}
+			if withDigest {
+				sum := sha256.Sum256(f.rpmBytes[name])
+				a["digest"] = "sha256:" + hex.EncodeToString(sum[:])
+			}
+			assets = append(assets, a)
+		}
+		rel := []map[string]any{{"tag_name": "v1.2-3", "draft": false, "assets": assets}}
+		json.NewEncoder(w).Encode(rel)
+	})
+	mux.HandleFunc("/acme/tools/releases/download/", func(w http.ResponseWriter, r *http.Request) {
+		name := r.URL.Path[strings.LastIndex(r.URL.Path, "/")+1:]
+		body, ok := f.rpmBytes[name]
+		if !ok {
+			http.Error(w, "not found", 404)
+			return
+		}
+		rng := r.Header.Get("Range")
+		f.mu.Lock()
+		f.assetAuth = r.Header.Get("Authorization")
+		if rng != "" {
+			f.rangeHit[name]++
+		} else {
+			f.fullHit[name]++
+		}
+		f.mu.Unlock()
+
+		if rng == "" {
+			w.WriteHeader(200)
+			w.Write(body)
+			return
+		}
+		// Parse "bytes=0-N".
+		var end int
+		fmt.Sscanf(rng, "bytes=0-%d", &end)
+		if end >= len(body)-1 {
+			end = len(body) - 1
+		}
+		w.Header().Set("Content-Range", fmt.Sprintf("bytes 0-%d/%d", end, len(body)))
+		w.Header().Set("Content-Length", strconv.Itoa(end+1))
+		w.WriteHeader(http.StatusPartialContent)
+		w.Write(body[:end+1])
+	})
+	f.srv = httptest.NewServer(mux)
+	t.Cleanup(f.srv.Close)
+	return f
+}
+
+func (f *githubFixture) remote() models.Remote {
+	return models.Remote{
+		Name:           "acme-rpm",
+		PackageType:    models.PackageGitHubRPM,
+		BaseURL:        f.srv.URL + "/repos/acme/tools",
+		ReleasesRemote: "github",
+		MutableTTL:     3600,
+	}
+}
+
+func newTestProvider() *GitHubProvider {
+	p := newGitHubProvider()
+	p.headerInitial = 32 // force the ranged-fetch retry loop against the tiny fixture
+	p.headerMax = 1 << 20
+	return p
+}
+
+func TestGitHubScanDerivesMetadataFromHeaderAndDigest(t *testing.T) {
+	fx := newGitHubFixture(t, true)
+	p := newTestProvider()
+	store := newFakeStore()
+
+	if err := p.scan(context.Background(), fx.remote(), store); err != nil {
+		t.Fatalf("scan: %v", err)
+	}
+
+	metas, _ := store.ListRPMMetadataEntries(context.Background(), "acme-rpm")
+	if len(metas) != 1 {
+		t.Fatalf("want 1 metadata row, got %d", len(metas))
+	}
+	m := metas[0]
+	if m.Name != "demo" || m.Version != "1.2" || m.Release != "3" || m.Arch != "x86_64" {
+		t.Fatalf("bad NEVRA: %+v", m)
+	}
+	// location href / redirect key must be the github-relative download path.
+	wantPath := "acme/tools/releases/download/v1.2-3/demo-1.2-3.x86_64.rpm"
+	if m.FilePath != wantPath {
+		t.Fatalf("FilePath = %q, want %q", m.FilePath, wantPath)
+	}
+	if int(m.RPMSize) != len(fx.rpmBytes["demo-1.2-3.x86_64.rpm"]) {
+		t.Fatalf("RPMSize = %d, want %d", m.RPMSize, len(fx.rpmBytes["demo-1.2-3.x86_64.rpm"]))
+	}
+	// Digest present => checksum from digest, no full download.
+	sum := sha256.Sum256(fx.rpmBytes["demo-1.2-3.x86_64.rpm"])
+	if m.ContentHash != "sha256:"+hex.EncodeToString(sum[:]) {
+		t.Fatalf("ContentHash = %q, want digest", m.ContentHash)
+	}
+	if fx.fullHit["demo-1.2-3.x86_64.rpm"] != 0 {
+		t.Fatalf("expected no full download when digest present, got %d", fx.fullHit["demo-1.2-3.x86_64.rpm"])
+	}
+	if fx.rangeHit["demo-1.2-3.x86_64.rpm"] == 0 {
+		t.Fatalf("expected ranged header fetch")
+	}
+}
+
+func TestGitHubChecksumComputedWhenDigestAbsent(t *testing.T) {
+	fx := newGitHubFixture(t, false)
+	p := newTestProvider()
+	store := newFakeStore()
+
+	if err := p.scan(context.Background(), fx.remote(), store); err != nil {
+		t.Fatalf("scan: %v", err)
+	}
+	metas, _ := store.ListRPMMetadataEntries(context.Background(), "acme-rpm")
+	if len(metas) != 1 {
+		t.Fatalf("want 1 row, got %d", len(metas))
+	}
+	sum := sha256.Sum256(fx.rpmBytes["demo-1.2-3.x86_64.rpm"])
+	if metas[0].ContentHash != "sha256:"+hex.EncodeToString(sum[:]) {
+		t.Fatalf("computed checksum mismatch: %q", metas[0].ContentHash)
+	}
+	if fx.fullHit["demo-1.2-3.x86_64.rpm"] == 0 {
+		t.Fatalf("expected a full download to compute sha256 when digest absent")
+	}
+}
+
+func TestGitHubServeRemoteRepodataAndRedirect(t *testing.T) {
+	fx := newGitHubFixture(t, true)
+	p := newTestProvider()
+	store := newFakeStore()
+	remote := fx.remote()
+	const proxyBase = "https://artifactapi.example"
+
+	// repomd.xml is served and triggers the initial scan.
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/remote/acme-rpm/repodata/repomd.xml", nil)
+	if !p.ServeRemote(rec, req, remote, "repodata/repomd.xml", proxyBase, store) {
+		t.Fatal("ServeRemote did not handle repomd.xml")
+	}
+	if rec.Code != 200 || !strings.Contains(rec.Body.String(), "<repomd") {
+		t.Fatalf("repomd bad: code=%d body=%s", rec.Code, rec.Body.String())
+	}
+
+	// primary.xml.gz must carry the package with a location href that is the
+	// github-relative download path (so it resolves back to this remote and
+	// redirects to the backend).
+	rec = httptest.NewRecorder()
+	req = httptest.NewRequest(http.MethodGet, "/x", nil)
+	if !p.ServeRemote(rec, req, remote, "repodata/abc-primary.xml.gz", proxyBase, store) {
+		t.Fatal("ServeRemote did not handle primary")
+	}
+	gz, err := gzip.NewReader(rec.Body)
+	if err != nil {
+		t.Fatalf("gzip: %v", err)
+	}
+	xmlBytes, _ := io.ReadAll(gz)
+	primary := string(xmlBytes)
+	if !strings.Contains(primary, `<name>demo</name>`) {
+		t.Fatalf("primary missing package: %s", primary)
+	}
+	if !strings.Contains(primary, `<location href="acme/tools/releases/download/v1.2-3/demo-1.2-3.x86_64.rpm"/>`) {
+		t.Fatalf("primary missing/incorrect location href: %s", primary)
+	}
+
+	// A .rpm request redirects to the backend releases_remote.
+	rec = httptest.NewRecorder()
+	pkgPath := "acme/tools/releases/download/v1.2-3/demo-1.2-3.x86_64.rpm"
+	req = httptest.NewRequest(http.MethodGet, "/api/v1/remote/acme-rpm/"+pkgPath, nil)
+	if !p.ServeRemote(rec, req, remote, pkgPath, proxyBase, store) {
+		t.Fatal("ServeRemote did not handle .rpm")
+	}
+	if rec.Code != http.StatusFound {
+		t.Fatalf("want 302, got %d", rec.Code)
+	}
+	wantLoc := proxyBase + "/api/v1/remote/github/" + pkgPath
+	if got := rec.Header().Get("Location"); got != wantLoc {
+		t.Fatalf("Location = %q, want %q", got, wantLoc)
+	}
+}
+
+// TestGitHubServeRemoteCanceledRequestServesCache reproduces the cold-makecache
+// 500: when the inbound request context is already canceled (dnf timed out and
+// disconnected), the repodata read must not be run on that context and turned
+// into a 500. With the cache already warm, the handler serves it as 200.
+// Before the fix the read used r.Context() and returned 500; after the fix it
+// runs on a detached context and serves the cached repomd.
+func TestGitHubServeRemoteCanceledRequestServesCache(t *testing.T) {
+	fx := newGitHubFixture(t, true)
+	p := newTestProvider()
+	store := newFakeStore()
+	remote := fx.remote()
+
+	// Warm the cache and mark the scan fresh so ServeRemote does not re-derive.
+	if err := p.scan(context.Background(), remote, store); err != nil {
+		t.Fatalf("warm scan: %v", err)
+	}
+	p.mu.Lock()
+	p.lastScan[remote.Name] = time.Now()
+	p.mu.Unlock()
+
+	// Inbound request whose context is already canceled (client went away).
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/remote/acme-rpm/repodata/repomd.xml", nil).WithContext(ctx)
+
+	if !p.ServeRemote(rec, req, remote, "repodata/repomd.xml", "https://x", store) {
+		t.Fatal("ServeRemote did not handle repomd.xml")
+	}
+	if rec.Code != http.StatusOK {
+		t.Fatalf("canceled request must serve cache, not error; got code=%d body=%s", rec.Code, rec.Body.String())
+	}
+	if !strings.Contains(rec.Body.String(), "<repomd") {
+		t.Fatalf("expected repomd served from cache, got %s", rec.Body.String())
+	}
+}
+
+func TestGitHubServeRemoteRedirectRequiresReleasesRemote(t *testing.T) {
+	fx := newGitHubFixture(t, true)
+	p := newTestProvider()
+	store := newFakeStore()
+	remote := fx.remote()
+	remote.ReleasesRemote = ""
+
+	rec := httptest.NewRecorder()
+	pkgPath := "acme/tools/releases/download/v1.2-3/demo-1.2-3.x86_64.rpm"
+	req := httptest.NewRequest(http.MethodGet, "/x", nil)
+	if !p.ServeRemote(rec, req, remote, pkgPath, "https://x", store) {
+		t.Fatal("expected handled")
+	}
+	if rec.Code != http.StatusInternalServerError {
+		t.Fatalf("want 500 when releases_remote unset, got %d", rec.Code)
+	}
+}
+
+func TestGitHubScanPrunesRemovedAssets(t *testing.T) {
+	fx := newGitHubFixture(t, true)
+	p := newTestProvider()
+	store := newFakeStore()
+
+	if err := p.scan(context.Background(), fx.remote(), store); err != nil {
+		t.Fatalf("scan: %v", err)
+	}
+	if rows, _ := store.ListRPMMetadataEntries(context.Background(), "acme-rpm"); len(rows) != 1 {
+		t.Fatalf("want 1 row after first scan, got %d", len(rows))
+	}
+
+	// Remove the asset upstream; a rescan must prune the stale metadata row.
+	delete(fx.rpmBytes, "demo-1.2-3.x86_64.rpm")
+	if err := p.scan(context.Background(), fx.remote(), store); err != nil {
+		t.Fatalf("rescan: %v", err)
+	}
+	if rows, _ := store.ListRPMMetadataEntries(context.Background(), "acme-rpm"); len(rows) != 0 {
+		t.Fatalf("want 0 rows after prune, got %d", len(rows))
+	}
+}
+
+func TestGitHubAssetPatternFilter(t *testing.T) {
+	fx := newGitHubFixture(t, true)
+	fx.rpmBytes["other-9-9.aarch64.rpm"] = testsupport.MinimalRPM("other", "9", "9", "aarch64")
+	p := newTestProvider()
+	store := newFakeStore()
+	remote := fx.remote()
+	remote.Patterns = []string{`^demo-.*\.x86_64\.rpm$`}
+
+	if err := p.scan(context.Background(), remote, store); err != nil {
+		t.Fatalf("scan: %v", err)
+	}
+	rows, _ := store.ListRPMMetadataEntries(context.Background(), "acme-rpm")
+	if len(rows) != 1 || rows[0].Name != "demo" {
+		t.Fatalf("pattern filter failed, rows=%+v", rows)
+	}
+}

internal/provider/rpm/rpm.go

@@ -1,13 +1,25 @@
 package rpm
 
 import (
+	"bytes"
+	"compress/gzip"
 	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/xml"
+	"errors"
+	"fmt"
+	"log/slog"
 	"net/http"
 	"regexp"
 	"strings"
+	"time"
+
+	rpmlib "github.com/cavaliergopher/rpm"
 
 	"git.unkin.net/unkin/artifactapi/internal/auth"
 	"git.unkin.net/unkin/artifactapi/internal/provider"
+	"git.unkin.net/unkin/artifactapi/internal/storage"
 	"git.unkin.net/unkin/artifactapi/pkg/models"
 )
 
@@ -55,3 +67,429 @@ func (p *Provider) RewriteResponse(_ []byte, _ models.Remote, _ string) ([]byte,
 func (p *Provider) AuthHeaders(_ context.Context, remote models.Remote) (http.Header, error) {
 	return auth.BasicHeaders(remote), nil
 }
+
+func (p *Provider) ValidateUpload(filePath string) (storagePath, contentType string, err error) {
+	filename := filePath
+	if idx := strings.LastIndex(filePath, "/"); idx >= 0 {
+		filename = filePath[idx+1:]
+	}
+
+	if !strings.HasSuffix(strings.ToLower(filename), ".rpm") {
+		return "", "", fmt.Errorf("file must be an .rpm package")
+	}
+
+	return "Packages/" + filename, "application/x-rpm", nil
+}
+
+func (p *Provider) UploadResponse(storagePath, contentHash string, sizeBytes int64) map[string]any {
+	filename := strings.TrimPrefix(storagePath, "Packages/")
+	return map[string]any{
+		"filename":     filename,
+		"content_hash": contentHash,
+		"size_bytes":   sizeBytes,
+	}
+}
+
+func (p *Provider) AfterUpload(ctx context.Context, repoName, storagePath, contentHash string, blobs provider.BlobReader, db provider.MetadataStore) {
+	s3Key := storage.BlobKey(strings.TrimPrefix(contentHash, "sha256:"))
+
+	reader, blobSize, err := blobs.Download(ctx, s3Key)
+	if err != nil {
+		slog.Error("rpm metadata: download failed", "repo", repoName, "path", storagePath, "error", err)
+		return
+	}
+	defer reader.Close()
+
+	pkg, err := rpmlib.Read(reader)
+	if err != nil {
+		slog.Error("rpm metadata: parse failed", "repo", repoName, "path", storagePath, "error", err)
+		return
+	}
+
+	meta := &provider.RPMMetadata{
+		RepoName:      repoName,
+		FilePath:      storagePath,
+		ContentHash:   contentHash,
+		Name:          pkg.Name(),
+		Epoch:         pkg.Epoch(),
+		Version:       pkg.Version(),
+		Release:       pkg.Release(),
+		Arch:          pkg.Architecture(),
+		Summary:       pkg.Summary(),
+		Description:   pkg.Description(),
+		RPMSize:       blobSize,
+		InstalledSize: int64(pkg.Size()),
+		License:       pkg.License(),
+		Vendor:        pkg.Vendor(),
+		Group:         firstGroup(pkg.Groups()),
+		BuildHost:     pkg.BuildHost(),
+		SourceRPM:     pkg.SourceRPM(),
+		URL:           pkg.URL(),
+		Packager:      pkg.Packager(),
+	}
+
+	for _, req := range pkg.Requires() {
+		meta.Requires = append(meta.Requires, rpmDepFromEntry(req))
+	}
+	for _, prov := range pkg.Provides() {
+		meta.Provides = append(meta.Provides, rpmDepFromEntry(prov))
+	}
+	for _, con := range pkg.Conflicts() {
+		meta.Conflicts = append(meta.Conflicts, rpmDepFromEntry(con))
+	}
+	for _, obs := range pkg.Obsoletes() {
+		meta.Obsoletes = append(meta.Obsoletes, rpmDepFromEntry(obs))
+	}
+
+	if meta.Requires == nil {
+		meta.Requires = []provider.RPMDep{}
+	}
+	if meta.Provides == nil {
+		meta.Provides = []provider.RPMDep{}
+	}
+	if meta.Conflicts == nil {
+		meta.Conflicts = []provider.RPMDep{}
+	}
+	if meta.Obsoletes == nil {
+		meta.Obsoletes = []provider.RPMDep{}
+	}
+	meta.Files = []provider.RPMFile{}
+	meta.Changelogs = []provider.RPMChangelog{}
+
+	if err := db.InsertRPMMetadata(ctx, meta); err != nil {
+		slog.Error("rpm metadata: insert failed", "repo", repoName, "path", storagePath, "error", err)
+		return
+	}
+
+	slog.Info("rpm metadata: parsed", "repo", repoName, "name", meta.Name, "version", meta.Version, "arch", meta.Arch)
+}
+
+func (p *Provider) AfterDelete(ctx context.Context, repoName, storagePath string, db provider.MetadataDeleter) error {
+	if err := db.DeleteRPMMetadata(ctx, repoName, storagePath); err != nil {
+		slog.Error("rpm metadata: delete failed", "repo", repoName, "path", storagePath, "error", err)
+		return err
+	}
+	slog.Info("rpm metadata: deleted", "repo", repoName, "path", storagePath)
+	return nil
+}
+
+func rpmDepFromEntry(e rpmlib.Dependency) provider.RPMDep {
+	dep := provider.RPMDep{Name: e.Name()}
+	if e.Flags() != 0 {
+		dep.Flags = rpmFlagString(e.Flags())
+		dep.Version = e.Version()
+		dep.Release = e.Release()
+		if e.Epoch() > 0 {
+			dep.Epoch = fmt.Sprintf("%d", e.Epoch())
+		}
+	}
+	return dep
+}
+
+func rpmFlagString(f int) string {
+	switch {
+	case f&0x08 != 0 && f&0x04 != 0:
+		return "GE"
+	case f&0x02 != 0 && f&0x04 != 0:
+		return "LE"
+	case f&0x08 != 0:
+		return "GT"
+	case f&0x02 != 0:
+		return "LT"
+	case f&0x04 != 0:
+		return "EQ"
+	default:
+		return ""
+	}
+}
+
+func firstGroup(groups []string) string {
+	if len(groups) > 0 {
+		return groups[0]
+	}
+	return "Unspecified"
+}
+
+func (p *Provider) ServeLocalIndex(w http.ResponseWriter, r *http.Request, files provider.FileStore, repoName, path string) bool {
+	if !strings.HasPrefix(path, "repodata/") {
+		return false
+	}
+
+	rpmReader, ok := files.(provider.RPMMetadataReader)
+	if !ok {
+		http.Error(w, "rpm metadata not available", http.StatusInternalServerError)
+		return true
+	}
+
+	tail := strings.TrimPrefix(path, "repodata/")
+
+	switch {
+	case tail == "repomd.xml":
+		p.serveRepomd(w, r, rpmReader, repoName)
+	case strings.HasSuffix(tail, "-primary.xml.gz"):
+		p.servePrimary(w, r, rpmReader, repoName)
+	case strings.HasSuffix(tail, "-filelists.xml.gz"):
+		p.serveFilelists(w, r, rpmReader, repoName)
+	case strings.HasSuffix(tail, "-other.xml.gz"):
+		p.serveOther(w, r, rpmReader, repoName)
+	default:
+		http.Error(w, "not found", http.StatusNotFound)
+	}
+	return true
+}
+
+func (p *Provider) GenerateLocalIndex(ctx context.Context, files provider.FileStore, repoName, path string) ([]byte, error) {
+	return nil, fmt.Errorf("rpm local index generation for virtual repos not supported")
+}
+
+// readMetadataEntries loads the repo's derived metadata, translating the read
+// error into an HTTP response. A canceled/deadline-exceeded context (typically a
+// client that went away) becomes a retryable 503 rather than a hard 500, so a
+// dnf disconnect never looks like a server fault. ok is false when a response
+// has already been written.
+func readMetadataEntries(w http.ResponseWriter, r *http.Request, reader provider.RPMMetadataReader, repoName string) ([]provider.RPMMetadata, bool) {
+	metas, err := reader.ListRPMMetadataEntries(r.Context(), repoName)
+	if err != nil {
+		if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
+			slog.Warn("rpm: metadata read canceled", "repo", repoName, "error", err)
+			http.Error(w, "metadata read canceled", http.StatusServiceUnavailable)
+			return nil, false
+		}
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return nil, false
+	}
+	return metas, true
+}
+
+func (p *Provider) serveRepomd(w http.ResponseWriter, r *http.Request, reader provider.RPMMetadataReader, repoName string) {
+	metas, ok := readMetadataEntries(w, r, reader, repoName)
+	if !ok {
+		return
+	}
+
+	primary := generatePrimaryXMLGZ(metas)
+	filelists := generateFilelistsXMLGZ(metas)
+	other := generateOtherXMLGZ(metas)
+
+	primaryHash := sha256Hex(primary)
+	filelistsHash := sha256Hex(filelists)
+	otherHash := sha256Hex(other)
+
+	repomd := generateRepomd(primaryHash, len(primary), filelistsHash, len(filelists), otherHash, len(other))
+
+	w.Header().Set("Content-Type", "application/xml")
+	w.WriteHeader(http.StatusOK)
+	w.Write(repomd)
+}
+
+func (p *Provider) servePrimary(w http.ResponseWriter, r *http.Request, reader provider.RPMMetadataReader, repoName string) {
+	metas, ok := readMetadataEntries(w, r, reader, repoName)
+	if !ok {
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/gzip")
+	w.WriteHeader(http.StatusOK)
+	w.Write(generatePrimaryXMLGZ(metas))
+}
+
+func (p *Provider) serveFilelists(w http.ResponseWriter, r *http.Request, reader provider.RPMMetadataReader, repoName string) {
+	metas, ok := readMetadataEntries(w, r, reader, repoName)
+	if !ok {
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/gzip")
+	w.WriteHeader(http.StatusOK)
+	w.Write(generateFilelistsXMLGZ(metas))
+}
+
+func (p *Provider) serveOther(w http.ResponseWriter, r *http.Request, reader provider.RPMMetadataReader, repoName string) {
+	metas, ok := readMetadataEntries(w, r, reader, repoName)
+	if !ok {
+		return
+	}
+
+	w.Header().Set("Content-Type", "application/gzip")
+	w.WriteHeader(http.StatusOK)
+	w.Write(generateOtherXMLGZ(metas))
+}
+
+func generateRepomd(primaryHash string, primarySize int, filelistsHash string, filelistsSize int, otherHash string, otherSize int) []byte {
+	ts := fmt.Sprintf("%d", time.Now().Unix())
+	var b bytes.Buffer
+	b.WriteString(xml.Header)
+	b.WriteString(`<repomd xmlns="http://linux.duke.edu/metadata/repo" xmlns:rpm="http://linux.duke.edu/metadata/rpm">` + "\n")
+	fmt.Fprintf(&b, "  <revision>%s</revision>\n", ts)
+
+	writeRepomdData(&b, "primary", primaryHash, primarySize, ts)
+	writeRepomdData(&b, "filelists", filelistsHash, filelistsSize, ts)
+	writeRepomdData(&b, "other", otherHash, otherSize, ts)
+
+	b.WriteString("</repomd>\n")
+	return b.Bytes()
+}
+
+func writeRepomdData(b *bytes.Buffer, dtype, hash string, size int, ts string) {
+	fmt.Fprintf(b, "  <data type=\"%s\">\n", dtype)
+	fmt.Fprintf(b, "    <checksum type=\"sha256\">%s</checksum>\n", hash)
+	fmt.Fprintf(b, "    <location href=\"repodata/%s-%s.xml.gz\"/>\n", hash, dtype)
+	fmt.Fprintf(b, "    <timestamp>%s</timestamp>\n", ts)
+	fmt.Fprintf(b, "    <size>%d</size>\n", size)
+	fmt.Fprintf(b, "  </data>\n")
+}
+
+func generatePrimaryXMLGZ(metas []provider.RPMMetadata) []byte {
+	var xmlBuf bytes.Buffer
+	xmlBuf.WriteString(xml.Header)
+	fmt.Fprintf(&xmlBuf, "<metadata xmlns=\"http://linux.duke.edu/metadata/common\" xmlns:rpm=\"http://linux.duke.edu/metadata/rpm\" packages=\"%d\">\n", len(metas))
+
+	for _, m := range metas {
+		pkgHash := strings.TrimPrefix(m.ContentHash, "sha256:")
+		fmt.Fprintf(&xmlBuf, "<package type=\"rpm\">\n")
+		fmt.Fprintf(&xmlBuf, "  <name>%s</name>\n", xmlEscape(m.Name))
+		fmt.Fprintf(&xmlBuf, "  <arch>%s</arch>\n", xmlEscape(m.Arch))
+		fmt.Fprintf(&xmlBuf, "  <version epoch=\"%d\" ver=\"%s\" rel=\"%s\"/>\n", m.Epoch, xmlEscape(m.Version), xmlEscape(m.Release))
+		fmt.Fprintf(&xmlBuf, "  <checksum type=\"sha256\" pkgid=\"YES\">%s</checksum>\n", pkgHash)
+		fmt.Fprintf(&xmlBuf, "  <summary>%s</summary>\n", xmlEscape(m.Summary))
+		fmt.Fprintf(&xmlBuf, "  <description>%s</description>\n", xmlEscape(m.Description))
+		if m.Packager != "" {
+			fmt.Fprintf(&xmlBuf, "  <packager>%s</packager>\n", xmlEscape(m.Packager))
+		}
+		if m.URL != "" {
+			fmt.Fprintf(&xmlBuf, "  <url>%s</url>\n", xmlEscape(m.URL))
+		}
+		fmt.Fprintf(&xmlBuf, "  <time file=\"%d\" build=\"0\"/>\n", time.Now().Unix())
+		fmt.Fprintf(&xmlBuf, "  <size package=\"%d\" installed=\"%d\" archive=\"0\"/>\n", m.RPMSize, m.InstalledSize)
+		fmt.Fprintf(&xmlBuf, "  <location href=\"%s\"/>\n", xmlEscape(m.FilePath))
+		fmt.Fprintf(&xmlBuf, "  <format>\n")
+		if m.License != "" {
+			fmt.Fprintf(&xmlBuf, "    <rpm:license>%s</rpm:license>\n", xmlEscape(m.License))
+		}
+		if m.Vendor != "" {
+			fmt.Fprintf(&xmlBuf, "    <rpm:vendor>%s</rpm:vendor>\n", xmlEscape(m.Vendor))
+		}
+		fmt.Fprintf(&xmlBuf, "    <rpm:group>%s</rpm:group>\n", xmlEscape(m.Group))
+		if m.BuildHost != "" {
+			fmt.Fprintf(&xmlBuf, "    <rpm:buildhost>%s</rpm:buildhost>\n", xmlEscape(m.BuildHost))
+		}
+		if m.SourceRPM != "" {
+			fmt.Fprintf(&xmlBuf, "    <rpm:sourcerpm>%s</rpm:sourcerpm>\n", xmlEscape(m.SourceRPM))
+		}
+
+		if len(m.Provides) > 0 {
+			xmlBuf.WriteString("    <rpm:provides>\n")
+			for _, d := range m.Provides {
+				writeRPMEntry(&xmlBuf, d)
+			}
+			xmlBuf.WriteString("    </rpm:provides>\n")
+		}
+		if len(m.Requires) > 0 {
+			xmlBuf.WriteString("    <rpm:requires>\n")
+			for _, d := range m.Requires {
+				writeRPMEntry(&xmlBuf, d)
+			}
+			xmlBuf.WriteString("    </rpm:requires>\n")
+		}
+		if len(m.Conflicts) > 0 {
+			xmlBuf.WriteString("    <rpm:conflicts>\n")
+			for _, d := range m.Conflicts {
+				writeRPMEntry(&xmlBuf, d)
+			}
+			xmlBuf.WriteString("    </rpm:conflicts>\n")
+		}
+		if len(m.Obsoletes) > 0 {
+			xmlBuf.WriteString("    <rpm:obsoletes>\n")
+			for _, d := range m.Obsoletes {
+				writeRPMEntry(&xmlBuf, d)
+			}
+			xmlBuf.WriteString("    </rpm:obsoletes>\n")
+		}
+
+		fmt.Fprintf(&xmlBuf, "  </format>\n")
+		fmt.Fprintf(&xmlBuf, "</package>\n")
+	}
+	xmlBuf.WriteString("</metadata>\n")
+
+	return gzipBytes(xmlBuf.Bytes())
+}
+
+func generateFilelistsXMLGZ(metas []provider.RPMMetadata) []byte {
+	var xmlBuf bytes.Buffer
+	xmlBuf.WriteString(xml.Header)
+	fmt.Fprintf(&xmlBuf, "<filelists xmlns=\"http://linux.duke.edu/metadata/filelists\" packages=\"%d\">\n", len(metas))
+
+	for _, m := range metas {
+		pkgHash := strings.TrimPrefix(m.ContentHash, "sha256:")
+		fmt.Fprintf(&xmlBuf, "<package pkgid=\"%s\" name=\"%s\" arch=\"%s\">\n", pkgHash, xmlEscape(m.Name), xmlEscape(m.Arch))
+		fmt.Fprintf(&xmlBuf, "  <version epoch=\"%d\" ver=\"%s\" rel=\"%s\"/>\n", m.Epoch, xmlEscape(m.Version), xmlEscape(m.Release))
+		for _, f := range m.Files {
+			if f.Type != "" {
+				fmt.Fprintf(&xmlBuf, "  <file type=\"%s\">%s</file>\n", f.Type, xmlEscape(f.Path))
+			} else {
+				fmt.Fprintf(&xmlBuf, "  <file>%s</file>\n", xmlEscape(f.Path))
+			}
+		}
+		xmlBuf.WriteString("</package>\n")
+	}
+	xmlBuf.WriteString("</filelists>\n")
+
+	return gzipBytes(xmlBuf.Bytes())
+}
+
+func generateOtherXMLGZ(metas []provider.RPMMetadata) []byte {
+	var xmlBuf bytes.Buffer
+	xmlBuf.WriteString(xml.Header)
+	fmt.Fprintf(&xmlBuf, "<otherdata xmlns=\"http://linux.duke.edu/metadata/other\" packages=\"%d\">\n", len(metas))
+
+	for _, m := range metas {
+		pkgHash := strings.TrimPrefix(m.ContentHash, "sha256:")
+		fmt.Fprintf(&xmlBuf, "<package pkgid=\"%s\" name=\"%s\" arch=\"%s\">\n", pkgHash, xmlEscape(m.Name), xmlEscape(m.Arch))
+		fmt.Fprintf(&xmlBuf, "  <version epoch=\"%d\" ver=\"%s\" rel=\"%s\"/>\n", m.Epoch, xmlEscape(m.Version), xmlEscape(m.Release))
+		for _, cl := range m.Changelogs {
+			fmt.Fprintf(&xmlBuf, "  <changelog author=\"%s\" date=\"%d\">%s</changelog>\n",
+				xmlEscape(cl.Author), cl.Date, xmlEscape(cl.Text))
+		}
+		xmlBuf.WriteString("</package>\n")
+	}
+	xmlBuf.WriteString("</otherdata>\n")
+
+	return gzipBytes(xmlBuf.Bytes())
+}
+
+func writeRPMEntry(b *bytes.Buffer, d provider.RPMDep) {
+	if d.Flags != "" {
+		fmt.Fprintf(b, "      <rpm:entry name=\"%s\" flags=\"%s\"", xmlEscape(d.Name), d.Flags)
+		if d.Epoch != "" {
+			fmt.Fprintf(b, " epoch=\"%s\"", d.Epoch)
+		}
+		if d.Version != "" {
+			fmt.Fprintf(b, " ver=\"%s\"", xmlEscape(d.Version))
+		}
+		if d.Release != "" {
+			fmt.Fprintf(b, " rel=\"%s\"", xmlEscape(d.Release))
+		}
+		b.WriteString("/>\n")
+	} else {
+		fmt.Fprintf(b, "      <rpm:entry name=\"%s\"/>\n", xmlEscape(d.Name))
+	}
+}
+
+func xmlEscape(s string) string {
+	var b bytes.Buffer
+	xml.EscapeText(&b, []byte(s))
+	return b.String()
+}
+
+func gzipBytes(data []byte) []byte {
+	var buf bytes.Buffer
+	gz := gzip.NewWriter(&buf)
+	gz.Write(data)
+	gz.Close()
+	return buf.Bytes()
+}
+
+func sha256Hex(data []byte) string {
+	h := sha256.Sum256(data)
+	return hex.EncodeToString(h[:])
+}

internal/provider/rpm/rpm_meta_test.go

@@ -0,0 +1,276 @@
+package rpm
+
+import (
+	"bytes"
+	"compress/gzip"
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"git.unkin.net/unkin/artifactapi/internal/provider"
+	"git.unkin.net/unkin/artifactapi/internal/testsupport"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+type fakeBlobReader struct{ data []byte }
+
+func (f fakeBlobReader) Download(_ context.Context, _ string) (io.ReadCloser, int64, error) {
+	return io.NopCloser(bytes.NewReader(f.data)), int64(len(f.data)), nil
+}
+
+type fakeMetaStore struct{ inserted *provider.RPMMetadata }
+
+func (f *fakeMetaStore) InsertRPMMetadata(_ context.Context, m *provider.RPMMetadata) error {
+	f.inserted = m
+	return nil
+}
+
+type fakeRPMReader struct{ metas []provider.RPMMetadata }
+
+func (f fakeRPMReader) ListRPMMetadataEntries(_ context.Context, _ string) ([]provider.RPMMetadata, error) {
+	return f.metas, nil
+}
+func (f fakeRPMReader) ListFilesByPrefix(_ context.Context, _, _ string) ([]provider.FileEntry, error) {
+	return nil, nil
+}
+func (f fakeRPMReader) ListPackages(_ context.Context, _ string) ([]string, error) { return nil, nil }
+
+func TestRPMPureFuncs(t *testing.T) {
+	p := &Provider{}
+	if p.Type() != models.PackageRPM {
+		t.Error("type")
+	}
+	if p.Classify("repodata/repomd.xml") != provider.Mutable {
+		t.Error("repomd should be mutable")
+	}
+	if p.Classify("Packages/foo.rpm") != provider.Immutable {
+		t.Error("rpm should be immutable")
+	}
+	if p.ContentType("x.rpm") != "application/x-rpm" {
+		t.Error("rpm content type")
+	}
+	if got := p.UpstreamURL(models.Remote{BaseURL: "https://mirror/"}, "/Packages/x.rpm"); got != "https://mirror/Packages/x.rpm" {
+		t.Errorf("upstream url %q", got)
+	}
+	if out, _ := p.RewriteResponse(nil, models.Remote{}, "http://p"); out != nil {
+		t.Error("rpm never rewrites")
+	}
+	h, _ := p.AuthHeaders(context.Background(), models.Remote{Username: "u", Password: "p"})
+	if h.Get("Authorization") == "" {
+		t.Error("auth header")
+	}
+}
+
+func TestRPMValidateUpload(t *testing.T) {
+	p := &Provider{}
+	sp, ct, err := p.ValidateUpload("dir/foo-1.0.noarch.rpm")
+	if err != nil || sp != "Packages/foo-1.0.noarch.rpm" || ct != "application/x-rpm" {
+		t.Errorf("sp=%q ct=%q err=%v", sp, ct, err)
+	}
+	if _, _, err := p.ValidateUpload("foo.txt"); err == nil {
+		t.Error("expected error for non-rpm")
+	}
+	resp := p.UploadResponse("Packages/foo.rpm", "sha256:abc", 10)
+	if resp["content_hash"] != "sha256:abc" {
+		t.Errorf("upload response %v", resp)
+	}
+}
+
+func TestRPMAfterUpload(t *testing.T) {
+	data := testsupport.MinimalRPM("e2e-testpkg", "1.0", "1", "noarch")
+	store := &fakeMetaStore{}
+	(&Provider{}).AfterUpload(context.Background(), "myrepo", "Packages/e2e-testpkg-1.0-1.noarch.rpm",
+		"sha256:deadbeef", fakeBlobReader{data: data}, store)
+
+	m := store.inserted
+	if m == nil {
+		t.Fatal("no metadata inserted")
+	}
+	if m.Name != "e2e-testpkg" || m.Version != "1.0" || m.Release != "1" || m.Arch != "noarch" {
+		t.Errorf("unexpected metadata: %+v", m)
+	}
+	if m.RPMSize != int64(len(data)) {
+		t.Errorf("RPMSize = %d, want %d", m.RPMSize, len(data))
+	}
+	if len(m.Provides) == 0 {
+		t.Error("expected the package to provide itself")
+	}
+}
+
+type errBlobReader struct{}
+
+func (errBlobReader) Download(_ context.Context, _ string) (io.ReadCloser, int64, error) {
+	return nil, 0, io.ErrUnexpectedEOF
+}
+
+func TestRPMAfterUploadErrors(t *testing.T) {
+	// Download failure: no metadata inserted, no panic.
+	store := &fakeMetaStore{}
+	(&Provider{}).AfterUpload(context.Background(), "r", "p", "sha256:x", errBlobReader{}, store)
+	if store.inserted != nil {
+		t.Error("no metadata should be inserted on download error")
+	}
+	// Parse failure: garbage bytes are not a valid RPM.
+	store2 := &fakeMetaStore{}
+	(&Provider{}).AfterUpload(context.Background(), "r", "p", "sha256:x", fakeBlobReader{data: []byte("not an rpm")}, store2)
+	if store2.inserted != nil {
+		t.Error("no metadata should be inserted on parse error")
+	}
+}
+
+func TestRPMServeRepodata(t *testing.T) {
+	p := &Provider{}
+	reader := fakeRPMReader{metas: []provider.RPMMetadata{{
+		Name: "e2e-testpkg", Version: "1.0", Release: "1", Arch: "noarch",
+		Summary:     "test & <special>",
+		ContentHash: "sha256:abc",
+		Requires:    []provider.RPMDep{{Name: "libc", Flags: "GE", Version: "2.0"}},
+		Provides:    []provider.RPMDep{{Name: "e2e-testpkg"}},
+		Files:       []provider.RPMFile{{Path: "/usr/share/e2e/README", Type: "file"}},
+		Changelogs:  []provider.RPMChangelog{{Author: "e2e", Date: 1, Text: "init"}},
+	}}}
+
+	serve := func(path string) *httptest.ResponseRecorder {
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/"+path, nil)
+		if !p.ServeLocalIndex(w, r, reader, "myrepo", path) {
+			t.Fatalf("ServeLocalIndex returned false for %q", path)
+		}
+		return w
+	}
+
+	if w := serve("repodata/repomd.xml"); w.Code != 200 || !strings.Contains(w.Body.String(), "<repomd") {
+		t.Errorf("repomd: code=%d body=%s", w.Code, w.Body.String())
+	}
+	for _, name := range []string{"repodata/h-primary.xml.gz", "repodata/h-filelists.xml.gz", "repodata/h-other.xml.gz"} {
+		w := serve(name)
+		if w.Code != 200 {
+			t.Errorf("%s: code %d", name, w.Code)
+		}
+		if _, err := gzip.NewReader(bytes.NewReader(w.Body.Bytes())); err != nil {
+			t.Errorf("%s: not gzip: %v", name, err)
+		}
+	}
+	// Unknown repodata file -> 404.
+	if w := serve("repodata/bogus"); w.Code != http.StatusNotFound {
+		t.Errorf("bogus repodata: code %d", w.Code)
+	}
+	// Non-repodata path -> not handled.
+	w := httptest.NewRecorder()
+	r := httptest.NewRequest(http.MethodGet, "/Packages/x.rpm", nil)
+	if p.ServeLocalIndex(w, r, reader, "myrepo", "Packages/x.rpm") {
+		t.Error("expected ServeLocalIndex false for non-repodata path")
+	}
+}
+
+type errRPMReader struct{}
+
+func (errRPMReader) ListRPMMetadataEntries(context.Context, string) ([]provider.RPMMetadata, error) {
+	return nil, io.ErrUnexpectedEOF
+}
+func (errRPMReader) ListFilesByPrefix(context.Context, string, string) ([]provider.FileEntry, error) {
+	return nil, nil
+}
+func (errRPMReader) ListPackages(context.Context, string) ([]string, error) { return nil, nil }
+
+func TestRPMServeMetadataError(t *testing.T) {
+	p := &Provider{}
+	for _, path := range []string{"repodata/repomd.xml", "repodata/h-primary.xml.gz", "repodata/h-filelists.xml.gz", "repodata/h-other.xml.gz"} {
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/"+path, nil)
+		p.ServeLocalIndex(w, r, errRPMReader{}, "repo", path)
+		if w.Code != 500 {
+			t.Errorf("%s with failing reader = %d, want 500", path, w.Code)
+		}
+	}
+}
+
+func TestRPMFullMetadataXML(t *testing.T) {
+	// A fully-populated entry exercises every optional-field branch in the
+	// primary/filelists/other XML generators.
+	metas := []provider.RPMMetadata{{
+		Name: "full", Epoch: 1, Version: "2.0", Release: "3", Arch: "x86_64",
+		Summary: "s", Description: "d", License: "MIT", Vendor: "acme",
+		Group: "System", BuildHost: "build.example.com", SourceRPM: "full-2.0.src.rpm",
+		URL: "https://example.com", Packager: "pkgr", ContentHash: "sha256:abc",
+		RPMSize: 100, InstalledSize: 200,
+		Requires:   []provider.RPMDep{{Name: "libc", Flags: "GE", Epoch: "0", Version: "2.0", Release: "1"}},
+		Provides:   []provider.RPMDep{{Name: "full", Flags: "EQ", Version: "2.0"}},
+		Files:      []provider.RPMFile{{Path: "/usr/bin/full", Type: "file"}, {Path: "/etc/full", Type: "dir"}},
+		Changelogs: []provider.RPMChangelog{{Author: "a", Date: 100, Text: "changed"}},
+	}}
+	for _, gen := range []func([]provider.RPMMetadata) []byte{generatePrimaryXMLGZ, generateFilelistsXMLGZ, generateOtherXMLGZ} {
+		zr, err := gzip.NewReader(bytes.NewReader(gen(metas)))
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := io.ReadAll(zr); err != nil {
+			t.Error(err)
+		}
+	}
+}
+
+func TestRPMPrimaryXMLContents(t *testing.T) {
+	// Exercise xmlEscape and dependency entry writing through the gzip'd XML.
+	metas := []provider.RPMMetadata{{
+		Name: "pkg", Version: "1", Release: "1", Arch: "x86_64", Summary: "a & b",
+		Requires: []provider.RPMDep{{Name: "dep", Flags: "EQ", Version: "1.0", Epoch: "0"}},
+	}}
+	gz := generatePrimaryXMLGZ(metas)
+	zr, err := gzip.NewReader(bytes.NewReader(gz))
+	if err != nil {
+		t.Fatal(err)
+	}
+	out, _ := io.ReadAll(zr)
+	s := string(out)
+	if !strings.Contains(s, "a &amp; b") {
+		t.Errorf("summary not xml-escaped: %s", s)
+	}
+	if !strings.Contains(s, "<name>pkg</name>") {
+		t.Errorf("package name missing: %s", s)
+	}
+}
+
+func TestRPMContentTypeAndHelpers(t *testing.T) {
+	p := &Provider{}
+	for path, want := range map[string]string{
+		"x.rpm":                     "application/x-rpm",
+		"repodata/repomd.xml":       "application/xml",
+		"repodata/h-primary.xml.gz": "application/xml",
+		"repodata/h-primary.xml.xz": "application/xml",
+		"Packages/other":            "application/octet-stream",
+	} {
+		if got := p.ContentType(path); got != want {
+			t.Errorf("ContentType(%q)=%q want %q", path, got, want)
+		}
+	}
+
+	for flag, want := range map[int]string{
+		0x08 | 0x04: "GE",
+		0x02 | 0x04: "LE",
+		0x08:        "GT",
+		0x02:        "LT",
+		0x04:        "EQ",
+		0x00:        "",
+	} {
+		if got := rpmFlagString(flag); got != want {
+			t.Errorf("rpmFlagString(%d)=%q want %q", flag, got, want)
+		}
+	}
+
+	if firstGroup(nil) != "Unspecified" {
+		t.Error("empty groups should be Unspecified")
+	}
+	if firstGroup([]string{"System", "Base"}) != "System" {
+		t.Error("firstGroup should return the first")
+	}
+}
+
+func TestGenerateLocalIndexUnsupported(t *testing.T) {
+	if _, err := (&Provider{}).GenerateLocalIndex(context.Background(), fakeRPMReader{}, "r", "simple/"); err == nil {
+		t.Error("expected unsupported error")
+	}
+}

internal/provider/rpm/syncer.go

@@ -0,0 +1,256 @@
+package rpm
+
+import (
+	"context"
+	"crypto/rand"
+	"encoding/hex"
+	"log/slog"
+	"os"
+	"sync"
+	"time"
+
+	"golang.org/x/time/rate"
+
+	"git.unkin.net/unkin/artifactapi/internal/provider"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+const (
+	// syncLeaseDuration is how long a claimed sync lease is held before it is
+	// considered abandoned. It comfortably exceeds a scan's own timeout so a live
+	// scan never loses its lease, while a crashed replica's lease still expires.
+	syncLeaseDuration = 15 * time.Minute
+	// defaultSyncFreshness is the periodic re-check interval used when a remote's
+	// mutable_ttl is unset.
+	defaultSyncFreshness = 5 * time.Minute
+	// jobQueueDepth bounds the pending work queue; enqueues past it are dropped
+	// (a later poll re-enqueues), never blocking the caller.
+	jobQueueDepth = 256
+)
+
+// SyncStore is the persistence surface the syncer needs: the metadata cache it
+// primes plus the shared sync-state coordination (remote enumeration and the
+// per-remote lease). *database.DB satisfies it.
+type SyncStore interface {
+	provider.RemoteMetadataStore
+	ListGitHubRPMRemotes(ctx context.Context) ([]models.Remote, error)
+	ClaimGitHubSyncLease(ctx context.Context, remoteName, owner string, freshness, lease time.Duration) (claimed bool, etag string, err error)
+	ReleaseGitHubSyncLease(ctx context.Context, remoteName, owner, etag string, syncedAt time.Time) error
+}
+
+// SyncConfig tunes the shared syncer. Zero values fall back to safe defaults.
+type SyncConfig struct {
+	RatePerSec   float64       // global GitHub request rate (req/s)
+	Burst        int           // token-bucket burst
+	Workers      int           // concurrent scan workers
+	PollInterval time.Duration // base scheduler tick; per-remote cadence is mutable_ttl
+}
+
+type syncJob struct {
+	remote models.Remote
+	prime  bool
+}
+
+// Syncer is the single per-process background worker that keeps every
+// github_rpm remote's derived metadata fresh. It owns a deduped work queue, a
+// pool of workers, and a global token-bucket rate limiter shared across all
+// remotes and bound onto the github provider so every GitHub call it makes
+// passes through the same bucket. Periodic checks are gated by a shared DB lease
+// so, across replicas, only one performs each scan.
+type Syncer struct {
+	store   SyncStore
+	prov    *GitHubProvider
+	limiter *rate.Limiter
+	cfg     SyncConfig
+	owner   string
+
+	jobs   chan syncJob
+	mu     sync.Mutex
+	active map[string]bool // remotes queued or in-flight, for dedup/coalescing
+}
+
+// NewSyncer builds the syncer bound to the process-wide github provider
+// singleton. Call Run to start it.
+func NewSyncer(store SyncStore, cfg SyncConfig) *Syncer {
+	return newSyncer(store, gitHubProvider, cfg)
+}
+
+func newSyncer(store SyncStore, prov *GitHubProvider, cfg SyncConfig) *Syncer {
+	if cfg.RatePerSec <= 0 {
+		cfg.RatePerSec = 1
+	}
+	if cfg.Burst <= 0 {
+		cfg.Burst = 5
+	}
+	if cfg.Workers <= 0 {
+		cfg.Workers = 3
+	}
+	if cfg.PollInterval <= 0 {
+		cfg.PollInterval = 60 * time.Second
+	}
+
+	lim := rate.NewLimiter(rate.Limit(cfg.RatePerSec), cfg.Burst)
+	s := &Syncer{
+		store:   store,
+		prov:    prov,
+		limiter: lim,
+		cfg:     cfg,
+		owner:   leaseOwner(),
+		jobs:    make(chan syncJob, jobQueueDepth),
+		active:  map[string]bool{},
+	}
+	// Bind the shared limiter and back-reference so the request path routes
+	// through this syncer and every derive HTTP call is rate limited.
+	prov.limiter = lim
+	prov.syncer = s
+	return s
+}
+
+// Run starts the worker pool and the periodic scheduler and blocks until ctx is
+// canceled, at which point it drains in-flight scans and returns.
+func (s *Syncer) Run(ctx context.Context) {
+	slog.Info("github_rpm syncer started",
+		"rate_per_sec", s.cfg.RatePerSec, "burst", s.cfg.Burst,
+		"workers", s.cfg.Workers, "poll_interval", s.cfg.PollInterval, "owner", s.owner)
+
+	var wg sync.WaitGroup
+	for i := 0; i < s.cfg.Workers; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			s.worker(ctx)
+		}()
+	}
+
+	ticker := time.NewTicker(s.cfg.PollInterval)
+	defer ticker.Stop()
+
+	s.schedule(ctx) // sweep at boot so existing remotes are checked immediately
+	for {
+		select {
+		case <-ctx.Done():
+			wg.Wait()
+			slog.Info("github_rpm syncer stopped")
+			return
+		case <-ticker.C:
+			s.schedule(ctx)
+		}
+	}
+}
+
+// schedule enqueues a periodic check for every github_rpm remote. The DB lease
+// (claimed in the worker) enforces the per-remote mutable_ttl cadence and cross
+// replica coordination, so enqueuing every tick is cheap: a not-yet-due remote
+// simply fails to claim and is skipped.
+func (s *Syncer) schedule(ctx context.Context) {
+	remotes, err := s.store.ListGitHubRPMRemotes(ctx)
+	if err != nil {
+		slog.Error("github_rpm syncer: list remotes", "error", err)
+		return
+	}
+	for _, r := range remotes {
+		s.enqueue(r, false)
+	}
+}
+
+// EnqueuePrime queues an immediate background prime for a freshly created
+// remote so its metadata is derived without blocking the create call.
+func (s *Syncer) EnqueuePrime(remote models.Remote) {
+	if s == nil {
+		return
+	}
+	s.enqueue(remote, true)
+}
+
+// enqueue adds a job unless the remote is already queued or in-flight, coalescing
+// duplicate requests down to one scan. It never blocks: a full queue drops the
+// job (a later poll re-enqueues it) after clearing the dedup slot.
+func (s *Syncer) enqueue(remote models.Remote, prime bool) {
+	s.mu.Lock()
+	if s.active[remote.Name] {
+		s.mu.Unlock()
+		return
+	}
+	s.active[remote.Name] = true
+	s.mu.Unlock()
+
+	select {
+	case s.jobs <- syncJob{remote: remote, prime: prime}:
+	default:
+		s.mu.Lock()
+		delete(s.active, remote.Name)
+		s.mu.Unlock()
+	}
+}
+
+func (s *Syncer) worker(ctx context.Context) {
+	for {
+		select {
+		case <-ctx.Done():
+			return
+		case job := <-s.jobs:
+			s.process(ctx, job)
+		}
+	}
+}
+
+// process claims the shared lease and, if won, runs an incremental scan. The
+// lease bounds total GitHub load to one scan per freshness window across all
+// replicas; losing the claim (another replica scanning, or not yet due) is a
+// no-op.
+func (s *Syncer) process(ctx context.Context, job syncJob) {
+	defer func() {
+		s.mu.Lock()
+		delete(s.active, job.remote.Name)
+		s.mu.Unlock()
+	}()
+
+	freshness := time.Duration(job.remote.MutableTTL) * time.Second
+	if freshness <= 0 {
+		freshness = defaultSyncFreshness
+	}
+	if job.prime {
+		freshness = 0 // prime ignores the recency gate but still respects a live lease
+	}
+
+	claimed, etag, err := s.store.ClaimGitHubSyncLease(ctx, job.remote.Name, s.owner, freshness, syncLeaseDuration)
+	if err != nil {
+		slog.Error("github_rpm syncer: claim lease", "remote", job.remote.Name, "error", err)
+		return
+	}
+	if !claimed {
+		return
+	}
+
+	scanCtx, cancel := context.WithTimeout(ctx, s.prov.scanTimeout)
+	defer cancel()
+
+	newEtag, changed, scanErr := s.prov.scanWithState(scanCtx, job.remote, s.store, etag)
+	releaseEtag := etag
+	if scanErr == nil {
+		releaseEtag = newEtag
+	} else {
+		slog.Error("github_rpm syncer: scan failed", "remote", job.remote.Name, "error", scanErr)
+	}
+
+	// Release on a detached context so a clean shutdown mid-scan still frees the
+	// lease and advances last_synced_at (otherwise it simply expires).
+	relCtx, relCancel := context.WithTimeout(context.WithoutCancel(ctx), 10*time.Second)
+	defer relCancel()
+	if err := s.store.ReleaseGitHubSyncLease(relCtx, job.remote.Name, s.owner, releaseEtag, time.Now()); err != nil {
+		slog.Warn("github_rpm syncer: release lease", "remote", job.remote.Name, "error", err)
+	}
+
+	if scanErr == nil && changed {
+		slog.Info("github_rpm syncer: refreshed", "remote", job.remote.Name, "prime", job.prime)
+	}
+}
+
+// leaseOwner is a per-replica identity for the lease: hostname plus a random
+// suffix so restarts and colocated replicas never collide.
+func leaseOwner() string {
+	host, _ := os.Hostname()
+	var b [6]byte
+	_, _ = rand.Read(b[:])
+	return host + "-" + hex.EncodeToString(b[:])
+}

internal/provider/rpm/syncer_test.go

@@ -0,0 +1,312 @@
+package rpm
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"testing"
+	"time"
+
+	"golang.org/x/time/rate"
+
+	"git.unkin.net/unkin/artifactapi/internal/provider"
+	"git.unkin.net/unkin/artifactapi/internal/testsupport"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+// fakeSyncStore is an in-memory SyncStore: the metadata cache (via the embedded
+// fakeStore) plus the shared sync-state lease, whose claim mirrors the atomic
+// semantics of the real SQL (recency gate AND no live lease).
+type fakeSyncStore struct {
+	*fakeStore
+
+	mu         sync.Mutex
+	remotes    []models.Remote
+	leaseOwner map[string]string
+	leaseExp   map[string]time.Time
+	lastSynced map[string]time.Time
+	etags      map[string]string
+}
+
+func newFakeSyncStore() *fakeSyncStore {
+	return &fakeSyncStore{
+		fakeStore:  newFakeStore(),
+		leaseOwner: map[string]string{},
+		leaseExp:   map[string]time.Time{},
+		lastSynced: map[string]time.Time{},
+		etags:      map[string]string{},
+	}
+}
+
+func (f *fakeSyncStore) ListGitHubRPMRemotes(_ context.Context) ([]models.Remote, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	return append([]models.Remote(nil), f.remotes...), nil
+}
+
+func (f *fakeSyncStore) ClaimGitHubSyncLease(_ context.Context, name, owner string, freshness, lease time.Duration) (bool, string, error) {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	now := time.Now()
+	ls, hasLS := f.lastSynced[name]
+	exp, hasExp := f.leaseExp[name]
+	freshOK := !hasLS || now.Sub(ls) >= freshness
+	leaseOK := !hasExp || exp.Before(now)
+	if freshOK && leaseOK {
+		f.leaseOwner[name] = owner
+		f.leaseExp[name] = now.Add(lease)
+		return true, f.etags[name], nil
+	}
+	return false, "", nil
+}
+
+func (f *fakeSyncStore) ReleaseGitHubSyncLease(_ context.Context, name, owner, etag string, syncedAt time.Time) error {
+	f.mu.Lock()
+	defer f.mu.Unlock()
+	if f.leaseOwner[name] != owner {
+		return nil
+	}
+	f.lastSynced[name] = syncedAt
+	f.etags[name] = etag
+	delete(f.leaseOwner, name)
+	delete(f.leaseExp, name)
+	return nil
+}
+
+func testSyncConfig() SyncConfig {
+	return SyncConfig{RatePerSec: 1000, Burst: 100, Workers: 1, PollInterval: time.Hour}
+}
+
+// (a) A 304 conditional response must derive nothing: no asset header GETs and
+// changed=false, so an unchanged repo is nearly free.
+func TestSyncerConditionalNotModifiedSkipsDerive(t *testing.T) {
+	fx := newGitHubFixture(t, true)
+	fx.etag = `"v1"`
+	p := newTestProvider()
+	store := newFakeStore()
+	remote := fx.remote()
+
+	etag1, changed, err := p.scanWithState(context.Background(), remote, store, "")
+	if err != nil {
+		t.Fatalf("first scan: %v", err)
+	}
+	if !changed || etag1 != `"v1"` {
+		t.Fatalf("first scan changed=%v etag=%q, want true and \"v1\"", changed, etag1)
+	}
+	priorRange := fx.rangeHit["demo-1.2-3.x86_64.rpm"]
+	if priorRange == 0 {
+		t.Fatal("first scan should have fetched the asset header")
+	}
+
+	etag2, changed2, err := p.scanWithState(context.Background(), remote, store, etag1)
+	if err != nil {
+		t.Fatalf("second scan: %v", err)
+	}
+	if changed2 {
+		t.Fatal("304 scan must report changed=false")
+	}
+	if etag2 != etag1 {
+		t.Fatalf("etag changed across 304: %q -> %q", etag1, etag2)
+	}
+	if fx.notModHit != 1 {
+		t.Fatalf("want exactly one 304 releases response, got %d", fx.notModHit)
+	}
+	if got := fx.rangeHit["demo-1.2-3.x86_64.rpm"]; got != priorRange {
+		t.Fatalf("304 scan re-fetched asset header: %d -> %d", priorRange, got)
+	}
+}
+
+// (b) On a real change, only the newly added asset is derived; assets already
+// cached are never re-fetched.
+func TestSyncerIncrementalDerivesOnlyNewAsset(t *testing.T) {
+	fx := newGitHubFixture(t, true)
+	fx.etag = `"v1"`
+	p := newTestProvider()
+	store := newFakeStore()
+	remote := fx.remote()
+
+	if _, _, err := p.scanWithState(context.Background(), remote, store, ""); err != nil {
+		t.Fatalf("first scan: %v", err)
+	}
+	demoRange := fx.rangeHit["demo-1.2-3.x86_64.rpm"]
+
+	// Add a new asset and bump the ETag so the conditional request returns 200.
+	fx.rpmBytes["other-9-9.aarch64.rpm"] = testsupport.MinimalRPM("other", "9", "9", "aarch64")
+	fx.etag = `"v2"`
+
+	if _, changed, err := p.scanWithState(context.Background(), remote, store, `"v1"`); err != nil || !changed {
+		t.Fatalf("second scan changed=%v err=%v", changed, err)
+	}
+
+	rows, _ := store.ListRPMMetadataEntries(context.Background(), remote.Name)
+	if len(rows) != 2 {
+		t.Fatalf("want 2 cached rows after incremental derive, got %d", len(rows))
+	}
+	if got := fx.rangeHit["demo-1.2-3.x86_64.rpm"]; got != demoRange {
+		t.Fatalf("already-cached asset was re-fetched: %d -> %d", demoRange, got)
+	}
+	if fx.rangeHit["other-9-9.aarch64.rpm"] == 0 {
+		t.Fatal("newly added asset was not derived")
+	}
+}
+
+// (c) The shared limiter caps the request rate: three gated releases calls at
+// one token per 120ms cannot complete faster than ~2 gaps.
+func TestRateLimiterCapsRequestRate(t *testing.T) {
+	fx := newGitHubFixture(t, true)
+	p := newTestProvider()
+	p.limiter = rate.NewLimiter(rate.Every(120*time.Millisecond), 1)
+	remote := fx.remote()
+
+	start := time.Now()
+	for i := 0; i < 3; i++ {
+		if _, _, _, err := p.fetchReleases(context.Background(), remote, ""); err != nil {
+			t.Fatalf("fetchReleases %d: %v", i, err)
+		}
+	}
+	if elapsed := time.Since(start); elapsed < 200*time.Millisecond {
+		t.Fatalf("rate limiter did not throttle: 3 calls took %v, want >= 200ms", elapsed)
+	}
+}
+
+// (d) Concurrent enqueues for the same remote coalesce to a single queued job.
+func TestSyncerEnqueueDedup(t *testing.T) {
+	store := newFakeSyncStore()
+	p := newTestProvider()
+	s := newSyncer(store, p, testSyncConfig())
+	remote := models.Remote{Name: "acme-rpm", PackageType: models.PackageGitHubRPM, MutableTTL: 3600}
+
+	var wg sync.WaitGroup
+	for i := 0; i < 10; i++ {
+		wg.Add(1)
+		go func() { defer wg.Done(); s.enqueue(remote, false) }()
+	}
+	wg.Wait()
+
+	if got := len(s.jobs); got != 1 {
+		t.Fatalf("want exactly 1 coalesced job, got %d", got)
+	}
+}
+
+// (e) Prime-on-create enqueues a prime job.
+func TestSyncerEnqueuePrime(t *testing.T) {
+	store := newFakeSyncStore()
+	p := newTestProvider()
+	s := newSyncer(store, p, testSyncConfig())
+	remote := models.Remote{Name: "acme-rpm", PackageType: models.PackageGitHubRPM, MutableTTL: 3600}
+
+	s.EnqueuePrime(remote)
+	select {
+	case job := <-s.jobs:
+		if !job.prime || job.remote.Name != "acme-rpm" {
+			t.Fatalf("bad prime job: %+v", job)
+		}
+	default:
+		t.Fatal("EnqueuePrime did not enqueue a job")
+	}
+}
+
+// (f) A held lease prevents a second replica from scanning: with the lease owned
+// by another replica, process claims nothing and makes zero GitHub calls.
+func TestSyncerLeasePreventsSecondReplica(t *testing.T) {
+	fx := newGitHubFixture(t, true)
+	fx.etag = `"v1"`
+	store := newFakeSyncStore()
+	p := newTestProvider()
+	s := newSyncer(store, p, testSyncConfig())
+	remote := fx.remote()
+
+	// Replica 1 holds the lease.
+	claimed, _, err := store.ClaimGitHubSyncLease(context.Background(), remote.Name, "replica-1", time.Duration(remote.MutableTTL)*time.Second, syncLeaseDuration)
+	if err != nil || !claimed {
+		t.Fatalf("replica-1 claim: claimed=%v err=%v", claimed, err)
+	}
+
+	// Replica 2 (this syncer) tries to process the same remote; it must skip.
+	s.process(context.Background(), syncJob{remote: remote})
+
+	if fx.releasesHit != 0 {
+		t.Fatalf("second replica scanned while lease held: %d releases calls", fx.releasesHit)
+	}
+	if rows, _ := store.ListRPMMetadataEntries(context.Background(), remote.Name); len(rows) != 0 {
+		t.Fatalf("second replica derived metadata while lease held: %d rows", len(rows))
+	}
+}
+
+// With the syncer wired and the cache empty, a repodata request enqueues a
+// prime and, when it has not landed within the bounded cold wait, returns a
+// retryable 503 rather than serving empty repodata (and without regressing the
+// detached-context serve).
+func TestServeRemoteColdStartReturns503(t *testing.T) {
+	fx := newGitHubFixture(t, true)
+	store := newFakeSyncStore()
+	p := newTestProvider()
+	p.coldWait = 300 * time.Millisecond
+	_ = newSyncer(store, p, testSyncConfig()) // binds p.syncer, but no workers running
+	remote := fx.remote()
+
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/remote/acme-rpm/repodata/repomd.xml", nil)
+	if !p.ServeRemote(rec, req, remote, "repodata/repomd.xml", "https://x", store) {
+		t.Fatal("ServeRemote did not handle repomd.xml")
+	}
+	if rec.Code != http.StatusServiceUnavailable {
+		t.Fatalf("cold empty cache must return 503, got %d", rec.Code)
+	}
+	if rec.Header().Get("Retry-After") == "" {
+		t.Fatal("503 should carry Retry-After")
+	}
+	// The prime was enqueued.
+	if got := len(p.syncer.jobs); got != 1 {
+		t.Fatalf("cold start did not enqueue a prime, jobs=%d", got)
+	}
+}
+
+// With the cache warm, the same request serves repodata immediately (no 503).
+func TestServeRemoteWarmCacheServesImmediately(t *testing.T) {
+	fx := newGitHubFixture(t, true)
+	store := newFakeSyncStore()
+	p := newTestProvider()
+	_ = newSyncer(store, p, testSyncConfig())
+	remote := fx.remote()
+
+	if err := p.scan(context.Background(), remote, store); err != nil {
+		t.Fatalf("warm scan: %v", err)
+	}
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/remote/acme-rpm/repodata/repomd.xml", nil)
+	if !p.ServeRemote(rec, req, remote, "repodata/repomd.xml", "https://x", store) {
+		t.Fatal("ServeRemote did not handle repomd.xml")
+	}
+	if rec.Code != http.StatusOK {
+		t.Fatalf("warm cache must serve 200, got %d body=%s", rec.Code, rec.Body.String())
+	}
+}
+
+// A prime job (freshness 0) runs even right after a sync, deriving metadata,
+// while a periodic job at the same moment is gated by the recency window.
+func TestSyncerPrimeBypassesRecencyPeriodicDoesNot(t *testing.T) {
+	fx := newGitHubFixture(t, true)
+	fx.etag = `"v1"`
+	store := newFakeSyncStore()
+	p := newTestProvider()
+	s := newSyncer(store, p, testSyncConfig())
+	remote := fx.remote()
+
+	var _ provider.RemoteMetadataStore = store
+
+	// Prime derives despite no prior sync.
+	s.process(context.Background(), syncJob{remote: remote, prime: true})
+	if rows, _ := store.ListRPMMetadataEntries(context.Background(), remote.Name); len(rows) != 1 {
+		t.Fatalf("prime did not derive: %d rows", len(rows))
+	}
+	releasesAfterPrime := fx.releasesHit
+
+	// A periodic job immediately after is gated by mutable_ttl recency: no new
+	// releases call.
+	s.process(context.Background(), syncJob{remote: remote, prime: false})
+	if fx.releasesHit != releasesAfterPrime {
+		t.Fatalf("periodic scan ran inside recency window: %d -> %d releases calls", releasesAfterPrime, fx.releasesHit)
+	}
+}

internal/provider/terraform/terraform.go

@@ -26,6 +26,27 @@ var providerZipRe = regexp.MustCompile(
 
 var semverRe = regexp.MustCompile(`^[0-9]+\.[0-9]+\.[0-9]+(?:-[a-zA-Z0-9.]+)?$`)
 
+// ParsedProviderZip describes a terraform-provider-{type}_{version}_{os}_{arch}.zip
+// filename. Ok is false when the name doesn't match that convention.
+type ParsedProviderZip struct {
+	Type    string
+	Version string
+	OS      string
+	Arch    string
+	Ok      bool
+}
+
+// ParseProviderZip extracts the type, version and platform from a provider zip
+// filename (the base name, not a full path). It's the canonical parser shared by
+// the network-mirror index and the provider registry handler.
+func ParseProviderZip(filename string) ParsedProviderZip {
+	m := providerZipRe.FindStringSubmatch(filename)
+	if m == nil {
+		return ParsedProviderZip{}
+	}
+	return ParsedProviderZip{Type: m[1], Version: m[2], OS: m[3], Arch: m[4], Ok: true}
+}
+
 type Provider struct{}
 
 func (p *Provider) Type() models.PackageType { return models.PackageTerraform }

internal/provider/terraform/terraform_extra_test.go

@@ -0,0 +1,171 @@
+package terraform
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+
+	"git.unkin.net/unkin/artifactapi/internal/provider"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+type fakeFileStore struct{ entries []provider.FileEntry }
+
+func (f fakeFileStore) ListFilesByPrefix(_ context.Context, _, prefix string) ([]provider.FileEntry, error) {
+	var out []provider.FileEntry
+	for _, e := range f.entries {
+		if strings.HasPrefix(e.FilePath, prefix) {
+			out = append(out, e)
+		}
+	}
+	return out, nil
+}
+func (f fakeFileStore) ListPackages(_ context.Context, _ string) ([]string, error) { return nil, nil }
+
+func TestTFPureFuncs(t *testing.T) {
+	p := &Provider{}
+	if p.Classify("hashicorp/aws/versions") != provider.Mutable {
+		t.Error("versions should be mutable")
+	}
+	if p.Classify("hashicorp/aws/terraform-provider-aws_1.0.0_linux_amd64.zip") != provider.Immutable {
+		t.Error("zip should be immutable")
+	}
+	if got := p.UpstreamURL(models.Remote{BaseURL: "https://registry.terraform.io"}, "hashicorp/aws/versions"); got != "https://registry.terraform.io/v1/providers/hashicorp/aws/versions" {
+		t.Errorf("upstream url %q", got)
+	}
+	h, _ := p.AuthHeaders(context.Background(), models.Remote{Username: "u", Password: "p"})
+	if h.Get("Authorization") == "" {
+		t.Error("auth header")
+	}
+	_ = p.ContentType("x.json")
+}
+
+func TestTFValidateUpload(t *testing.T) {
+	p := &Provider{}
+	sp, ct, err := p.ValidateUpload("hashicorp/aws/terraform-provider-aws_1.2.3_linux_amd64.zip")
+	if err != nil || sp != "hashicorp/aws/terraform-provider-aws_1.2.3_linux_amd64.zip" || ct != "application/zip" {
+		t.Errorf("valid: sp=%q ct=%q err=%v", sp, ct, err)
+	}
+	if _, _, err := p.ValidateUpload("too/few"); err == nil {
+		t.Error("expected error for wrong path depth")
+	}
+	if _, _, err := p.ValidateUpload("ns/aws/not-a-provider.zip"); err == nil {
+		t.Error("expected error for bad filename")
+	}
+	if _, _, err := p.ValidateUpload("ns/gcp/terraform-provider-aws_1.0.0_linux_amd64.zip"); err == nil {
+		t.Error("expected error for type mismatch")
+	}
+}
+
+func TestTFUploadResponse(t *testing.T) {
+	p := &Provider{}
+	resp := p.UploadResponse("hashicorp/aws/terraform-provider-aws_1.2.3_linux_amd64.zip", "sha256:abc", 100)
+	if resp["namespace"] != "hashicorp" || resp["type"] != "aws" || resp["version"] != "1.2.3" || resp["os"] != "linux" || resp["arch"] != "amd64" {
+		t.Errorf("structured response wrong: %v", resp)
+	}
+	fallback := p.UploadResponse("weird/path", "sha256:x", 1)
+	if fallback["path"] != "weird/path" {
+		t.Errorf("fallback response wrong: %v", fallback)
+	}
+}
+
+func TestTFRewriteResponse(t *testing.T) {
+	p := &Provider{}
+	remote := models.Remote{Name: "tf", ReleasesRemote: "hashicorp-releases"}
+
+	if out, _ := p.RewriteResponse([]byte(`{"download_url":"x"}`), models.Remote{}, "http://proxy"); out != nil {
+		t.Error("no ReleasesRemote should be a no-op")
+	}
+	if out, _ := p.RewriteResponse([]byte("not json"), remote, "http://proxy"); out != nil {
+		t.Error("invalid json should be a no-op")
+	}
+	body := []byte(`{"download_url":"https://releases.hashicorp.com/terraform-provider-aws/1.0/aws.zip"}`)
+	out, err := p.RewriteResponse(body, remote, "http://proxy")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !strings.Contains(string(out), "http://proxy/api/v1/remote/hashicorp-releases/") {
+		t.Errorf("download_url not rewritten: %s", out)
+	}
+}
+
+func TestTFServeLocalIndex(t *testing.T) {
+	p := &Provider{}
+	fs := fakeFileStore{entries: []provider.FileEntry{
+		{FilePath: "hashicorp/aws/terraform-provider-aws_1.0.0_linux_amd64.zip", ContentHash: "sha256:deadbeef"},
+		{FilePath: "hashicorp/aws/terraform-provider-aws_1.0.0_darwin_arm64.zip", ContentHash: "sha256:cafe"},
+	}}
+
+	serve := func(path string) *httptest.ResponseRecorder {
+		w := httptest.NewRecorder()
+		r := httptest.NewRequest(http.MethodGet, "/"+path, nil)
+		p.ServeLocalIndex(w, r, fs, "repo", path)
+		return w
+	}
+
+	if w := serve("hashicorp/aws/index.json"); w.Code != 200 || !strings.Contains(w.Body.String(), "1.0.0") {
+		t.Errorf("index.json: code=%d body=%s", w.Code, w.Body.String())
+	}
+	if w := serve("hashicorp/aws/1.0.0.json"); w.Code != 200 || !strings.Contains(w.Body.String(), "linux_amd64") {
+		t.Errorf("version doc: code=%d body=%s", w.Code, w.Body.String())
+	}
+
+	// Not a terraform index path.
+	w := httptest.NewRecorder()
+	r := httptest.NewRequest(http.MethodGet, "/x", nil)
+	if p.ServeLocalIndex(w, r, fs, "repo", "hashicorp/aws/other.txt") {
+		t.Error("non-index path should return false")
+	}
+	if p.ServeLocalIndex(httptest.NewRecorder(), r, fs, "repo", "too/short") {
+		t.Error("short path should return false")
+	}
+}
+
+func TestTFContentTypeAndEmptyIndex(t *testing.T) {
+	p := &Provider{}
+	for path, want := range map[string]string{
+		"x.zip":      "application/zip",
+		"x.sig":      "application/octet-stream",
+		"index.json": "application/json",
+	} {
+		if got := p.ContentType(path); got != want {
+			t.Errorf("ContentType(%q)=%q want %q", path, got, want)
+		}
+	}
+	// index / version doc with no matching files -> 404.
+	empty := fakeFileStore{}
+	w := httptest.NewRecorder()
+	r := httptest.NewRequest(http.MethodGet, "/hashicorp/aws/index.json", nil)
+	p.ServeLocalIndex(w, r, empty, "repo", "hashicorp/aws/index.json")
+	if w.Code != http.StatusNotFound {
+		t.Errorf("empty index should be 404, got %d", w.Code)
+	}
+	w = httptest.NewRecorder()
+	p.ServeLocalIndex(w, r, empty, "repo", "hashicorp/aws/1.0.0.json")
+	if w.Code != http.StatusNotFound {
+		t.Errorf("empty version doc should be 404, got %d", w.Code)
+	}
+}
+
+func TestRewriteDownloadURL(t *testing.T) {
+	// Empty proxy base -> unchanged.
+	if got := rewriteDownloadURL("https://x/a.zip", "rel", ""); got != "https://x/a.zip" {
+		t.Errorf("empty base: %q", got)
+	}
+	// Unparseable URL -> unchanged.
+	if got := rewriteDownloadURL("://bad", "rel", "http://p"); got != "://bad" {
+		t.Errorf("bad url: %q", got)
+	}
+	// Normal rewrite.
+	if got := rewriteDownloadURL("https://cdn/path/a.zip", "rel", "http://p"); got != "http://p/api/v1/remote/rel/path/a.zip" {
+		t.Errorf("rewrite: %q", got)
+	}
+}
+
+func TestTFGenerateLocalIndexUnsupported(t *testing.T) {
+	if _, err := (&Provider{}).GenerateLocalIndex(context.Background(), fakeFileStore{}, "r", "x"); err == nil {
+		t.Error("expected unsupported error")
+	}
+}

internal/proxy/classifier.go

@@ -2,6 +2,7 @@ package proxy
 
 import (
 	"regexp"
+	"sync"
 
 	"git.unkin.net/unkin/artifactapi/internal/provider"
 	"git.unkin.net/unkin/artifactapi/pkg/models"
@@ -60,10 +61,29 @@ func (c *Classifier) Classify(remote models.Remote, path string) Classification
 	return ClassImmutable
 }
 
+// patternCache memoises regex compilation. Classify runs on every proxied
+// request and previously recompiled each remote's pattern lists every time;
+// keying by the pattern string lets each distinct pattern compile once and
+// then be reused, with no invalidation needed (the pattern text is the key).
+// A pattern that fails to compile is cached as a typed nil so we don't retry.
+var patternCache sync.Map // map[string]*regexp.Regexp
+
+func compileCached(pattern string) *regexp.Regexp {
+	if v, ok := patternCache.Load(pattern); ok {
+		return v.(*regexp.Regexp)
+	}
+	re, err := regexp.Compile(pattern)
+	if err != nil {
+		re = nil
+	}
+	patternCache.Store(pattern, re)
+	return re
+}
+
 func compilePatterns(patterns []string) []*regexp.Regexp {
 	compiled := make([]*regexp.Regexp, 0, len(patterns))
 	for _, p := range patterns {
-		if re, err := regexp.Compile(p); err == nil {
+		if re := compileCached(p); re != nil {
 			compiled = append(compiled, re)
 		}
 	}

internal/proxy/classifier_extra_test.go

@@ -0,0 +1,52 @@
+package proxy
+
+import (
+	"testing"
+
+	"git.unkin.net/unkin/artifactapi/internal/provider"
+	_ "git.unkin.net/unkin/artifactapi/internal/provider/generic"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+func TestClassifierBranches(t *testing.T) {
+	gp, err := provider.Get(models.PackageGeneric)
+	if err != nil {
+		t.Fatal(err)
+	}
+	c := NewClassifier(gp)
+
+	if c.Classify(models.Remote{Blocklist: []string{`\.exe$`}}, "x.exe") != ClassDenied {
+		t.Error("blocklist match should be denied")
+	}
+	// Allowlist present but path doesn't match -> denied.
+	allow := models.Remote{Patterns: []string{`^allowed/`}}
+	if c.Classify(allow, "other/x") != ClassDenied {
+		t.Error("non-allowlisted path should be denied")
+	}
+	if c.Classify(allow, "allowed/x") != ClassImmutable {
+		t.Error("allowlisted generic path should be immutable")
+	}
+	if c.Classify(models.Remote{MutablePatterns: []string{`index$`}}, "a/index") != ClassMutable {
+		t.Error("mutable pattern override failed")
+	}
+	if c.Classify(models.Remote{ImmutablePatterns: []string{`\.bin$`}}, "a.bin") != ClassImmutable {
+		t.Error("immutable pattern failed")
+	}
+	// An invalid regex is skipped (not treated as a match) rather than denying.
+	if c.Classify(models.Remote{Blocklist: []string{`[invalid`}}, "anything") == ClassDenied {
+		t.Error("invalid blocklist regex should be skipped, not deny everything")
+	}
+}
+
+func TestClassificationString(t *testing.T) {
+	for c, want := range map[Classification]string{
+		ClassImmutable:     "immutable",
+		ClassMutable:       "mutable",
+		ClassDenied:        "denied",
+		Classification(99): "unknown",
+	} {
+		if c.String() != want {
+			t.Errorf("Classification(%d).String() = %q, want %q", c, c.String(), want)
+		}
+	}
+}

internal/proxy/engine.go

@@ -4,10 +4,13 @@ import (
 	"context"
 	"crypto/sha256"
 	"encoding/hex"
+	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"log/slog"
 	"net/http"
+	"strings"
 	"time"
 
 	"git.unkin.net/unkin/artifactapi/internal/cache"
@@ -19,19 +22,65 @@ import (
 
 const fetchLockTTL = 30 * time.Second
 
+const (
+	accessLogBufferSize = 4096
+	accessLogBatchSize  = 128
+	accessLogFlushEvery = 2 * time.Second
+)
+
 type Engine struct {
-	db    *database.DB
-	cache *cache.Redis
-	store *storage.S3
-	cas   *storage.CAS
+	db        *database.DB
+	cache     *cache.Redis
+	store     *storage.S3
+	cas       *storage.CAS
+	circuit   *CircuitBreaker
+	accessLog chan database.AccessLogEntry
 }
 
 func NewEngine(db *database.DB, c *cache.Redis, s *storage.S3) *Engine {
-	return &Engine{
-		db:    db,
-		cache: c,
-		store: s,
-		cas:   storage.NewCAS(s),
+	e := &Engine{
+		db:        db,
+		cache:     c,
+		store:     s,
+		cas:       storage.NewCAS(s),
+		circuit:   NewCircuitBreaker(c),
+		accessLog: make(chan database.AccessLogEntry, accessLogBufferSize),
+	}
+	go e.runAccessLogWriter()
+	return e
+}
+
+// runAccessLogWriter drains the access-log channel and writes rows in batches,
+// replacing a goroutine-per-request insert. It runs for the process lifetime;
+// access logs are best-effort telemetry, so a small tail may be lost on abrupt
+// shutdown.
+func (e *Engine) runAccessLogWriter() {
+	ticker := time.NewTicker(accessLogFlushEvery)
+	defer ticker.Stop()
+
+	batch := make([]database.AccessLogEntry, 0, accessLogBatchSize)
+	flush := func() {
+		if len(batch) == 0 {
+			return
+		}
+		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		if err := e.db.InsertAccessLogBatch(ctx, batch); err != nil {
+			slog.Warn("access log batch insert failed", "error", err, "count", len(batch))
+		}
+		cancel()
+		batch = batch[:0]
+	}
+
+	for {
+		select {
+		case entry := <-e.accessLog:
+			batch = append(batch, entry)
+			if len(batch) >= accessLogBatchSize {
+				flush()
+			}
+		case <-ticker.C:
+			flush()
+		}
 	}
 }
 
@@ -42,7 +91,7 @@ type FetchResult struct {
 	Source      string // "cache" or "remote"
 }
 
-func (e *Engine) Fetch(ctx context.Context, remote models.Remote, path string, prov provider.Provider) (*FetchResult, error) {
+func (e *Engine) Fetch(ctx context.Context, remote models.Remote, path string, prov provider.Provider, clientHeaders ...http.Header) (*FetchResult, error) {
 	classifier := NewClassifier(prov)
 	class := classifier.Classify(remote, path)
 
@@ -61,7 +110,7 @@ func (e *Engine) Fetch(ctx context.Context, remote models.Remote, path string, p
 		result, err := e.serveFromStore(ctx, remote, path)
 		if err == nil {
 			result.Source = "cache"
-			go e.logAccess(remote.Name, path, true, result.Size, 0)
+			e.logAccess(remote.Name, path, true, result.Size, 0)
 			return result, nil
 		}
 		slog.Warn("cache hit but S3 miss, re-fetching", "remote", remote.Name, "path", path)
@@ -73,11 +122,12 @@ func (e *Engine) Fetch(ctx context.Context, remote models.Remote, path string, p
 	}
 
 	if !locked {
-		time.Sleep(500 * time.Millisecond)
-		result, err := e.serveFromStore(ctx, remote, path)
-		if err == nil {
+		// Another request holds the fetch lock. Poll the store until the leader
+		// populates it rather than immediately racing to fetch upstream too; a
+		// cold-cache stampede otherwise hits upstream once per waiter.
+		if result := e.waitForStore(ctx, remote, path); result != nil {
 			result.Source = "cache"
-			go e.logAccess(remote.Name, path, true, result.Size, 0)
+			e.logAccess(remote.Name, path, true, result.Size, 0)
 			return result, nil
 		}
 	}
@@ -96,35 +146,138 @@ func (e *Engine) Fetch(ctx context.Context, remote models.Remote, path string, p
 				result, err := e.serveFromStore(ctx, remote, path)
 				if err == nil {
 					result.Source = "cache"
-					go e.logAccess(remote.Name, path, true, result.Size, 0)
+					e.logAccess(remote.Name, path, true, result.Size, 0)
 					return result, nil
 				}
 			}
 		}
 	}
 
+	var fwdHeaders http.Header
+	if len(clientHeaders) > 0 && clientHeaders[0] != nil {
+		fwdHeaders = clientHeaders[0]
+	}
+
+	// Short-circuit upstream calls when the remote's breaker is open: serve
+	// stale from the store if we have it, otherwise fail fast rather than
+	// hammering a known-bad upstream.
+	if e.circuit.IsOpen(ctx, remote.Name) {
+		if stale, serr := e.serveFromStore(ctx, remote, path); serr == nil {
+			slog.Warn("circuit open, serving stale", "remote", remote.Name, "path", path)
+			stale.Source = "cache"
+			e.logAccess(remote.Name, path, true, stale.Size, 0)
+			return stale, nil
+		}
+		return nil, &ProxyError{Status: http.StatusServiceUnavailable, Message: "upstream circuit open"}
+	}
+
 	start := time.Now()
-	result, err := e.fetchFromUpstream(ctx, remote, path, prov, class, ttl)
+	result, err := e.fetchFromUpstream(ctx, remote, path, prov, class, ttl, fwdHeaders)
 	upstreamMS := int(time.Since(start).Milliseconds())
 	if err != nil {
+		if isNetworkError(err) {
+			e.circuit.RecordFailure(ctx, remote.Name)
+		}
 		if remote.StaleOnError && isNetworkError(err) {
 			_ = e.cache.SetTTL(ctx, remote.Name, path, ttl)
 			stale, serr := e.serveFromStore(ctx, remote, path)
 			if serr == nil {
 				slog.Warn("serving stale on upstream error", "remote", remote.Name, "path", path, "error", err)
 				stale.Source = "cache"
-				go e.logAccess(remote.Name, path, true, stale.Size, 0)
+				e.logAccess(remote.Name, path, true, stale.Size, 0)
 				return stale, nil
 			}
 		}
 		return nil, err
 	}
 
-	go e.logAccess(remote.Name, path, false, result.Size, upstreamMS)
+	e.circuit.RecordSuccess(ctx, remote.Name)
+	e.logAccess(remote.Name, path, false, result.Size, upstreamMS)
 	return result, nil
 }
 
-func (e *Engine) fetchFromUpstream(ctx context.Context, remote models.Remote, path string, prov provider.Provider, class Classification, ttl time.Duration) (*FetchResult, error) {
+// HeadResult carries artifact metadata for a HEAD request. There is no body.
+type HeadResult struct {
+	ContentType string
+	Size        int64
+	Source      string // "cache" or "remote"
+}
+
+// Head resolves artifact metadata without fetching or streaming the body.
+// Cached artifacts/indexes are answered from the store metadata; on a miss it
+// issues an upstream HEAD. It never downloads or caches the body.
+func (e *Engine) Head(ctx context.Context, remote models.Remote, path string, prov provider.Provider) (*HeadResult, error) {
+	class := NewClassifier(prov).Classify(remote, path)
+	if class == ClassDenied {
+		return nil, &ProxyError{Status: http.StatusForbidden, Message: "access denied"}
+	}
+
+	if artifact, err := e.db.GetArtifact(ctx, remote.Name, path); err == nil && artifact != nil {
+		return &HeadResult{ContentType: artifact.ContentType, Size: artifact.SizeBytes, Source: "cache"}, nil
+	}
+	if info, err := e.store.Stat(ctx, storage.IndexKey(remote.Name, path)); err == nil {
+		return &HeadResult{ContentType: info.ContentType, Size: info.Size, Source: "cache"}, nil
+	}
+
+	return e.headUpstream(ctx, remote, path, prov)
+}
+
+func (e *Engine) headUpstream(ctx context.Context, remote models.Remote, path string, prov provider.Provider) (*HeadResult, error) {
+	url := prov.UpstreamURL(remote, path)
+
+	authHeaders, err := prov.AuthHeaders(ctx, remote)
+	if err != nil {
+		return nil, fmt.Errorf("auth headers: %w", err)
+	}
+
+	doHead := func(extra http.Header) (*http.Response, error) {
+		req, err := http.NewRequestWithContext(ctx, http.MethodHead, url, nil)
+		if err != nil {
+			return nil, fmt.Errorf("create request: %w", err)
+		}
+		for k, vv := range authHeaders {
+			for _, v := range vv {
+				req.Header.Add(k, v)
+			}
+		}
+		for k, vv := range extra {
+			for _, v := range vv {
+				req.Header.Set(k, v)
+			}
+		}
+		return http.DefaultClient.Do(req)
+	}
+
+	resp, err := doHead(nil)
+	if err != nil {
+		return nil, &UpstreamError{Err: err}
+	}
+	if resp.StatusCode == http.StatusUnauthorized {
+		resp.Body.Close()
+		token, _, terr := fetchBearerToken(ctx, resp.Header.Get("Www-Authenticate"), remote)
+		if terr == nil && token != "" {
+			resp, err = doHead(http.Header{"Authorization": []string{"Bearer " + token}})
+			if err != nil {
+				return nil, &UpstreamError{Err: err}
+			}
+		} else {
+			return nil, &ProxyError{Status: http.StatusUnauthorized, Message: "upstream returned 401"}
+		}
+	}
+	resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return nil, &ProxyError{Status: resp.StatusCode, Message: fmt.Sprintf("upstream returned %d", resp.StatusCode)}
+	}
+
+	contentType := prov.ContentType(path)
+	if ct := resp.Header.Get("Content-Type"); ct != "" {
+		contentType = ct
+	}
+	return &HeadResult{ContentType: contentType, Size: resp.ContentLength, Source: "remote"}, nil
+}
+
+func (e *Engine) fetchFromUpstream(ctx context.Context, remote models.Remote, path string, prov provider.Provider, class Classification, ttl time.Duration, clientHeaders http.Header) (*FetchResult, error) {
 	url := prov.UpstreamURL(remote, path)
 
 	authHeaders, err := prov.AuthHeaders(ctx, remote)
@@ -141,94 +294,144 @@ func (e *Engine) fetchFromUpstream(ctx context.Context, remote models.Remote, pa
 			req.Header.Add(k, v)
 		}
 	}
+	if clientHeaders != nil {
+		if accept := clientHeaders.Get("Accept"); accept != "" {
+			req.Header.Set("Accept", accept)
+		}
+	}
 
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := clientForRemote(remote).Do(req)
 	if err != nil {
 		return nil, &UpstreamError{Err: err}
 	}
 
+	if resp.StatusCode == http.StatusUnauthorized {
+		resp.Body.Close()
+		token, err := e.cachedBearerToken(ctx, resp.Header.Get("Www-Authenticate"), remote)
+		if err == nil && token != "" {
+			req2, _ := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+			req2.Header.Set("Authorization", "Bearer "+token)
+			if clientHeaders != nil {
+				if accept := clientHeaders.Get("Accept"); accept != "" {
+					req2.Header.Set("Accept", accept)
+				}
+			}
+			resp, err = clientForRemote(remote).Do(req2)
+			if err != nil {
+				return nil, &UpstreamError{Err: err}
+			}
+		} else {
+			return nil, &ProxyError{Status: http.StatusUnauthorized, Message: "upstream returned 401"}
+		}
+	}
+
 	if resp.StatusCode != http.StatusOK {
 		resp.Body.Close()
 		return nil, &ProxyError{Status: resp.StatusCode, Message: fmt.Sprintf("upstream returned %d", resp.StatusCode)}
 	}
 
-	body, err := io.ReadAll(resp.Body)
-	resp.Body.Close()
-	if err != nil {
-		return nil, fmt.Errorf("read upstream body: %w", err)
-	}
-
-	rewritten, err := prov.RewriteResponse(body, remote, "")
-	if err != nil {
-		return nil, fmt.Errorf("rewrite response: %w", err)
-	}
-	if rewritten != nil {
-		body = rewritten
-	}
-
 	contentType := prov.ContentType(path)
-	if ct := resp.Header.Get("Content-Type"); ct != "" && contentType == "application/octet-stream" {
+	if ct := resp.Header.Get("Content-Type"); ct != "" {
 		contentType = ct
 	}
 
+	// Mutable indexes are small and may be rewritten, so buffer them in memory.
 	if class == ClassMutable {
+		body, err := io.ReadAll(resp.Body)
+		resp.Body.Close()
+		if err != nil {
+			return nil, fmt.Errorf("read upstream body: %w", err)
+		}
+
+		rewritten, err := prov.RewriteResponse(body, remote, "")
+		if err != nil {
+			return nil, fmt.Errorf("rewrite response: %w", err)
+		}
+		if rewritten != nil {
+			body = rewritten
+		}
+
 		s3Key := storage.IndexKey(remote.Name, path)
 		if err := e.store.Upload(ctx, s3Key, bytesReader(body), int64(len(body)), contentType); err != nil {
 			return nil, fmt.Errorf("upload index: %w", err)
 		}
 
-		etag := resp.Header.Get("ETag")
-		_ = e.cache.SetTTL(ctx, remote.Name, path, ttl)
-		if etag != "" {
-			_ = e.cache.SetETag(ctx, remote.Name, path, etag, ttl)
-		}
-	} else {
-		hash := sha256Hash(body)
-		s3Key := storage.BlobKey(hash)
-
-		exists, _ := e.store.Exists(ctx, s3Key)
-		if !exists {
-			if err := e.store.Upload(ctx, s3Key, bytesReader(body), int64(len(body)), contentType); err != nil {
-				return nil, fmt.Errorf("upload blob: %w", err)
-			}
-		}
-
-		contentHash := fmt.Sprintf("sha256:%s", hash)
-		if err := e.db.UpsertBlob(ctx, contentHash, s3Key, int64(len(body)), contentType); err != nil {
-			slog.Warn("upsert blob failed", "error", err)
-		}
-		if err := e.db.UpsertArtifact(ctx, remote.Name, path, contentHash, resp.Header.Get("ETag")); err != nil {
-			slog.Warn("upsert artifact failed", "error", err)
-		}
-
 		_ = e.cache.SetTTL(ctx, remote.Name, path, ttl)
 		if etag := resp.Header.Get("ETag"); etag != "" {
 			_ = e.cache.SetETag(ctx, remote.Name, path, etag, ttl)
 		}
+
+		return &FetchResult{
+			Reader:      io.NopCloser(bytesReader(body)),
+			ContentType: contentType,
+			Size:        int64(len(body)),
+			Source:      "remote",
+		}, nil
 	}
 
+	// Immutable blobs are streamed through the content-addressable store
+	// (tempfile -> sha256 -> S3) so arbitrarily large artifacts never sit
+	// fully in memory. Immutable content is never rewritten in the proxy path.
+	casResult, err := e.cas.Store(ctx, resp.Body, contentType)
+	resp.Body.Close()
+	if err != nil {
+		return nil, fmt.Errorf("store blob: %w", err)
+	}
+
+	if err := e.db.UpsertBlob(ctx, casResult.ContentHash, casResult.S3Key, casResult.SizeBytes, contentType); err != nil {
+		slog.Warn("upsert blob failed", "error", err)
+	}
+	if err := e.db.UpsertArtifact(ctx, remote.Name, path, casResult.ContentHash, resp.Header.Get("ETag")); err != nil {
+		slog.Warn("upsert artifact failed", "error", err)
+	}
+
+	_ = e.cache.SetTTL(ctx, remote.Name, path, ttl)
+	if etag := resp.Header.Get("ETag"); etag != "" {
+		_ = e.cache.SetETag(ctx, remote.Name, path, etag, ttl)
+	}
+
+	reader, info, err := e.store.Download(ctx, casResult.S3Key)
+	if err != nil {
+		return nil, fmt.Errorf("serve stored blob: %w", err)
+	}
 	return &FetchResult{
-		Reader:      io.NopCloser(bytesReader(body)),
-		ContentType: contentType,
-		Size:        int64(len(body)),
+		Reader:      reader,
+		ContentType: info.ContentType,
+		Size:        casResult.SizeBytes,
 		Source:      "remote",
 	}, nil
 }
 
+// waitForStore polls the store for an artifact populated by the request that
+// holds the fetch lock, returning it once available or nil if it does not
+// appear within the wait budget (after which the caller fetches upstream
+// itself). It stops early if the request context is cancelled.
+func (e *Engine) waitForStore(ctx context.Context, remote models.Remote, path string) *FetchResult {
+	const (
+		pollInterval = 100 * time.Millisecond
+		maxWait      = 5 * time.Second
+	)
+	deadline := time.Now().Add(maxWait)
+	for {
+		if result, err := e.serveFromStore(ctx, remote, path); err == nil {
+			return result
+		}
+		if time.Now().After(deadline) {
+			return nil
+		}
+		select {
+		case <-ctx.Done():
+			return nil
+		case <-time.After(pollInterval):
+		}
+	}
+}
+
 func (e *Engine) serveFromStore(ctx context.Context, remote models.Remote, path string) (*FetchResult, error) {
 	artifact, err := e.db.GetArtifact(ctx, remote.Name, path)
 	if err == nil && artifact != nil {
-		reader, info, err := e.store.Download(ctx, artifact.ContentHash[len("sha256:"):])
-		if err == nil {
-			_ = e.db.TouchArtifactAccess(ctx, remote.Name, path)
-			return &FetchResult{
-				Reader:      reader,
-				ContentType: info.ContentType,
-				Size:        info.Size,
-			}, nil
-		}
 		s3Key := storage.BlobKey(artifact.ContentHash[len("sha256:"):])
-		reader, info, err = e.store.Download(ctx, s3Key)
+		reader, info, err := e.store.Download(ctx, s3Key)
 		if err == nil {
 			_ = e.db.TouchArtifactAccess(ctx, remote.Name, path)
 			return &FetchResult{
@@ -270,7 +473,7 @@ func (e *Engine) checkUpstream(ctx context.Context, remote models.Remote, path,
 		}
 	}
 
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := clientForRemote(remote).Do(req)
 	if err != nil {
 		return false, &UpstreamError{Err: err}
 	}
@@ -291,15 +494,20 @@ func (e *Engine) ttlFor(remote models.Remote, class Classification) time.Duratio
 	}
 }
 
+// logAccess enqueues an access-log entry for the batch writer. It never blocks
+// the request path: if the buffer is full the entry is dropped.
 func (e *Engine) logAccess(remoteName, path string, cacheHit bool, size int64, upstreamMS int) {
-	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
-	defer cancel()
-	_ = e.db.InsertAccessLog(ctx, remoteName, path, cacheHit, size, upstreamMS, "")
-}
-
-func sha256Hash(data []byte) string {
-	h := sha256.Sum256(data)
-	return hex.EncodeToString(h[:])
+	select {
+	case e.accessLog <- database.AccessLogEntry{
+		RemoteName: remoteName,
+		Path:       path,
+		CacheHit:   cacheHit,
+		SizeBytes:  size,
+		UpstreamMS: upstreamMS,
+	}:
+	default:
+		slog.Warn("access log buffer full, dropping entry", "remote", remoteName, "path", path)
+	}
 }
 
 func bytesReader(data []byte) io.Reader {
@@ -319,6 +527,110 @@ func (r readerAt) ReadAt(p []byte, off int64) (n int, err error) {
 	return
 }
 
+// bearerTokenTTLDefault/Margin bound how long a token is cached: the default
+// is used when the token endpoint omits expires_in, and the margin is
+// subtracted so a cached token is refreshed slightly before it actually expires.
+const (
+	bearerTokenTTLDefault = 60 * time.Second
+	bearerTokenTTLMargin  = 10 * time.Second
+)
+
+func sha256Hash(data []byte) string {
+	h := sha256.Sum256(data)
+	return hex.EncodeToString(h[:])
+}
+
+// cachedBearerToken returns a bearer token for the given challenge, reusing a
+// Redis-cached token for the same remote+challenge while it is still valid.
+func (e *Engine) cachedBearerToken(ctx context.Context, wwwAuth string, remote models.Remote) (string, error) {
+	key := remote.Name + ":" + sha256Hash([]byte(wwwAuth))
+	if tok, err := e.cache.GetToken(ctx, key); err == nil && tok != "" {
+		return tok, nil
+	}
+
+	tok, ttl, err := fetchBearerToken(ctx, wwwAuth, remote)
+	if err != nil {
+		return "", err
+	}
+	if tok != "" {
+		if ttl <= 0 {
+			ttl = bearerTokenTTLDefault
+		}
+		if ttl > bearerTokenTTLMargin {
+			ttl -= bearerTokenTTLMargin
+		}
+		_ = e.cache.SetToken(ctx, key, tok, ttl)
+	}
+	return tok, nil
+}
+
+func fetchBearerToken(ctx context.Context, wwwAuth string, remote models.Remote) (string, time.Duration, error) {
+	if !strings.HasPrefix(wwwAuth, "Bearer ") {
+		return "", 0, fmt.Errorf("not a Bearer challenge")
+	}
+
+	params := map[string]string{}
+	for _, part := range strings.Split(wwwAuth[7:], ",") {
+		part = strings.TrimSpace(part)
+		eq := strings.Index(part, "=")
+		if eq < 0 {
+			continue
+		}
+		key := part[:eq]
+		val := strings.Trim(part[eq+1:], `"`)
+		params[key] = val
+	}
+
+	realm := params["realm"]
+	if realm == "" {
+		return "", 0, fmt.Errorf("no realm in Bearer challenge")
+	}
+
+	tokenURL := realm
+	sep := "?"
+	if s, ok := params["service"]; ok {
+		tokenURL += sep + "service=" + s
+		sep = "&"
+	}
+	if s, ok := params["scope"]; ok {
+		tokenURL += sep + "scope=" + s
+	}
+
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, tokenURL, nil)
+	if err != nil {
+		return "", 0, err
+	}
+
+	if remote.Username != "" && remote.Password != "" {
+		req.SetBasicAuth(remote.Username, remote.Password)
+	}
+
+	resp, err := clientForRemote(remote).Do(req)
+	if err != nil {
+		return "", 0, err
+	}
+	defer resp.Body.Close()
+
+	if resp.StatusCode != http.StatusOK {
+		return "", 0, fmt.Errorf("token endpoint returned %d", resp.StatusCode)
+	}
+
+	var tokenResp struct {
+		Token       string `json:"token"`
+		AccessToken string `json:"access_token"`
+		ExpiresIn   int    `json:"expires_in"`
+	}
+	if err := json.NewDecoder(resp.Body).Decode(&tokenResp); err != nil {
+		return "", 0, err
+	}
+
+	ttl := time.Duration(tokenResp.ExpiresIn) * time.Second
+	if tokenResp.Token != "" {
+		return tokenResp.Token, ttl, nil
+	}
+	return tokenResp.AccessToken, ttl, nil
+}
+
 type ProxyError struct {
 	Status  int
 	Message string
@@ -334,8 +646,6 @@ func (e *UpstreamError) Error() string { return fmt.Sprintf("upstream error: %v"
 func (e *UpstreamError) Unwrap() error { return e.Err }
 
 func isNetworkError(err error) bool {
-	if _, ok := err.(*UpstreamError); ok {
-		return true
-	}
-	return false
+	var ue *UpstreamError
+	return errors.As(err, &ue)
 }

internal/proxy/engine_test.go

@@ -0,0 +1,557 @@
+package proxy
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"testing"
+	"time"
+
+	"git.unkin.net/unkin/artifactapi/internal/cache"
+	"git.unkin.net/unkin/artifactapi/internal/database"
+	"git.unkin.net/unkin/artifactapi/internal/provider"
+	_ "git.unkin.net/unkin/artifactapi/internal/provider/generic"
+	_ "git.unkin.net/unkin/artifactapi/internal/provider/npm"
+	"git.unkin.net/unkin/artifactapi/internal/storage"
+	"git.unkin.net/unkin/artifactapi/internal/testsupport"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+var (
+	testEngine *Engine
+	testCache  *cache.Redis
+	testDB     *database.DB
+	upstream   *httptest.Server
+)
+
+func TestMain(m *testing.M) {
+	ctx := context.Background()
+	dsn, termPG, err := testsupport.StartPostgres(ctx)
+	if err != nil {
+		os.Exit(m.Run())
+	}
+	redisURL, termRedis, err := testsupport.StartRedis(ctx)
+	if err != nil {
+		termPG()
+		os.Exit(m.Run())
+	}
+	minio, termMinio, err := testsupport.StartMinio(ctx)
+	if err != nil {
+		termPG()
+		termRedis()
+		os.Exit(m.Run())
+	}
+
+	db, err := database.New(dsn)
+	if err != nil {
+		panic(err)
+	}
+	redis, err := cache.NewRedis(redisURL)
+	if err != nil {
+		panic(err)
+	}
+	var s3 *storage.S3
+	for i := 0; i < 20; i++ {
+		if s3, err = storage.NewS3(minio.Endpoint, minio.AccessKey, minio.SecretKey, "proxy-test", false, ""); err == nil {
+			break
+		}
+		time.Sleep(500 * time.Millisecond)
+	}
+	if err != nil {
+		panic(err)
+	}
+
+	testCache = redis
+	testDB = db
+	testEngine = NewEngine(db, redis, s3)
+	upstream = httptest.NewServer(http.HandlerFunc(mockUpstream))
+
+	code := m.Run()
+
+	upstream.Close()
+	db.Close()
+	termMinio()
+	termRedis()
+	termPG()
+	if code != 0 {
+		os.Exit(code)
+	}
+}
+
+func mockUpstream(w http.ResponseWriter, r *http.Request) {
+	switch r.URL.Path {
+	case "/blob.bin":
+		w.Header().Set("Content-Type", "application/octet-stream")
+		w.Write([]byte("immutable blob"))
+	case "/pkg": // npm metadata: mutable, supports revalidation
+		if r.Method == http.MethodHead && r.Header.Get("If-None-Match") == `"v1"` {
+			w.WriteHeader(http.StatusNotModified)
+			return
+		}
+		w.Header().Set("ETag", `"v1"`)
+		w.Write([]byte(`{"name":"pkg"}`))
+	case "/protected.bin": // requires a bearer token obtained from /token
+		if r.Header.Get("Authorization") != "Bearer minted-token" {
+			w.Header().Set("Www-Authenticate", `Bearer realm="`+upstream.URL+`/token",service="reg",scope="repo:pull"`)
+			w.WriteHeader(http.StatusUnauthorized)
+			return
+		}
+		w.Write([]byte("protected payload"))
+	case "/protected2.bin": // same challenge as /protected.bin
+		if r.Header.Get("Authorization") != "Bearer minted-token" {
+			w.Header().Set("Www-Authenticate", `Bearer realm="`+upstream.URL+`/token",service="reg",scope="repo:pull"`)
+			w.WriteHeader(http.StatusUnauthorized)
+			return
+		}
+		w.Write([]byte("protected payload 2"))
+	case "/token":
+		w.Write([]byte(`{"token":"minted-token","expires_in":300}`))
+	case "/token-at":
+		w.Write([]byte(`{"access_token":"at-token"}`))
+	case "/token-500":
+		w.WriteHeader(http.StatusInternalServerError)
+	case "/err500":
+		w.WriteHeader(http.StatusInternalServerError)
+	case "/noauth": // 401 with an unusable challenge (no realm)
+		w.Header().Set("Www-Authenticate", `Bearer service="reg"`)
+		w.WriteHeader(http.StatusUnauthorized)
+	default:
+		http.NotFound(w, r)
+	}
+}
+
+func requireStack(t *testing.T) {
+	t.Helper()
+	if testEngine == nil {
+		t.Skip("Docker unavailable; skipping proxy engine test")
+	}
+}
+
+func genericRemote(name string) models.Remote {
+	return models.Remote{Name: name, PackageType: models.PackageGeneric, RepoType: models.RepoTypeRemote, BaseURL: upstream.URL, StaleOnError: true}
+}
+
+// seed inserts the remote so artifact rows (FK to remotes) can be stored.
+func seed(t *testing.T, r models.Remote) models.Remote {
+	t.Helper()
+	rr := r
+	if err := testDB.CreateRemote(context.Background(), &rr); err != nil {
+		t.Fatalf("seed remote %s: %v", r.Name, err)
+	}
+	return r
+}
+
+func prov(t *testing.T, pt models.PackageType) provider.Provider {
+	p, err := provider.Get(pt)
+	if err != nil {
+		t.Fatalf("provider %s: %v", pt, err)
+	}
+	return p
+}
+
+func readAll(t *testing.T, res *FetchResult) string {
+	t.Helper()
+	defer res.Reader.Close()
+	b, _ := io.ReadAll(res.Reader)
+	return string(b)
+}
+
+func TestFetchImmutableMissThenHit(t *testing.T) {
+	requireStack(t)
+	ctx := context.Background()
+	r := seed(t, genericRemote("eng-imm"))
+	p := prov(t, models.PackageGeneric)
+
+	res, err := testEngine.Fetch(ctx, r, "blob.bin", p)
+	if err != nil {
+		t.Fatalf("fetch: %v", err)
+	}
+	if res.Source != "remote" || readAll(t, res) != "immutable blob" {
+		t.Errorf("miss: source=%s", res.Source)
+	}
+	res, err = testEngine.Fetch(ctx, r, "blob.bin", p)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if res.Source != "cache" || readAll(t, res) != "immutable blob" {
+		t.Errorf("hit: source=%s", res.Source)
+	}
+}
+
+func TestFetchDenied(t *testing.T) {
+	requireStack(t)
+	r := genericRemote("eng-deny")
+	r.Blocklist = []string{`\.secret$`}
+	_, err := testEngine.Fetch(context.Background(), r, "x.secret", prov(t, models.PackageGeneric))
+	var pe *ProxyError
+	if err == nil || !asProxyError(err, &pe) || pe.Status != http.StatusForbidden {
+		t.Errorf("expected 403 ProxyError, got %v", err)
+	}
+}
+
+func TestHead(t *testing.T) {
+	requireStack(t)
+	ctx := context.Background()
+	r := seed(t, genericRemote("eng-head"))
+	p := prov(t, models.PackageGeneric)
+
+	// Uncached HEAD hits upstream.
+	h, err := testEngine.Head(ctx, r, "blob.bin", p)
+	if err != nil || h.Source != "remote" {
+		t.Fatalf("head uncached: %+v %v", h, err)
+	}
+	// Populate the cache, then HEAD should be served from metadata.
+	res, _ := testEngine.Fetch(ctx, r, "blob.bin", p)
+	res.Reader.Close()
+	h, err = testEngine.Head(ctx, r, "blob.bin", p)
+	if err != nil || h.Source != "cache" {
+		t.Errorf("head cached: %+v %v", h, err)
+	}
+	// Denied HEAD.
+	r.Blocklist = []string{".*"}
+	if _, err := testEngine.Head(ctx, r, "blob.bin", p); err == nil {
+		t.Error("expected denied head error")
+	}
+}
+
+func TestStaleOnError(t *testing.T) {
+	requireStack(t)
+	ctx := context.Background()
+	r := seed(t, genericRemote("eng-stale"))
+	p := prov(t, models.PackageGeneric)
+
+	if _, err := testEngine.Fetch(ctx, r, "blob.bin", p); err != nil {
+		t.Fatal(err)
+	}
+	// Drop cache freshness so the next fetch goes upstream, then point at a
+	// dead upstream: stale-on-error must serve the stored copy.
+	testCache.FlushRemote(ctx, "eng-stale")
+	r.BaseURL = "http://127.0.0.1:1"
+	res, err := testEngine.Fetch(ctx, r, "blob.bin", p)
+	if err != nil {
+		t.Fatalf("expected stale serve, got %v", err)
+	}
+	if res.Source != "cache" || readAll(t, res) != "immutable blob" {
+		t.Errorf("stale: source=%s", res.Source)
+	}
+}
+
+func TestCircuitOpenServesStale(t *testing.T) {
+	requireStack(t)
+	ctx := context.Background()
+	r := seed(t, genericRemote("eng-circuit"))
+	p := prov(t, models.PackageGeneric)
+	if _, err := testEngine.Fetch(ctx, r, "blob.bin", p); err != nil {
+		t.Fatal(err)
+	}
+	testCache.FlushRemote(ctx, "eng-circuit")
+	for i := 0; i < 6; i++ {
+		testEngine.circuit.RecordFailure(ctx, "eng-circuit")
+	}
+	res, err := testEngine.Fetch(ctx, r, "blob.bin", p)
+	if err != nil {
+		t.Fatalf("circuit-open should serve stale: %v", err)
+	}
+	if res.Source != "cache" {
+		t.Errorf("expected stale from open circuit, got %s", res.Source)
+	}
+	res.Reader.Close()
+}
+
+func TestMutableRevalidation(t *testing.T) {
+	requireStack(t)
+	ctx := context.Background()
+	r := seed(t, models.Remote{Name: "eng-npm", PackageType: models.PackageNPM, RepoType: models.RepoTypeRemote, BaseURL: upstream.URL, CheckMutable: true, MutableTTL: 3600, StaleOnError: true})
+	p := prov(t, models.PackageNPM)
+
+	res, err := testEngine.Fetch(ctx, r, "pkg", p)
+	if err != nil {
+		t.Fatalf("initial mutable fetch: %v", err)
+	}
+	res.Reader.Close()
+
+	// Expire only the freshness marker; the ETag persists, forcing a
+	// conditional revalidation that the upstream answers with 304.
+	testCache.SetTTL(ctx, "eng-npm", "pkg", time.Millisecond)
+	time.Sleep(10 * time.Millisecond)
+	res, err = testEngine.Fetch(ctx, r, "pkg", p)
+	if err != nil {
+		t.Fatalf("revalidation fetch: %v", err)
+	}
+	if res.Source != "cache" {
+		t.Errorf("revalidated response should come from cache, got %s", res.Source)
+	}
+	res.Reader.Close()
+}
+
+func TestBearerTokenFlow(t *testing.T) {
+	requireStack(t)
+	ctx := context.Background()
+	r := seed(t, genericRemote("eng-bearer"))
+	p := prov(t, models.PackageGeneric)
+
+	// GET: 401 challenge -> token endpoint -> retry with bearer -> 200.
+	res, err := testEngine.Fetch(ctx, r, "protected.bin", p)
+	if err != nil {
+		t.Fatalf("bearer fetch: %v", err)
+	}
+	if readAll(t, res) != "protected payload" {
+		t.Error("bearer-protected content mismatch")
+	}
+
+	// A second protected path with the same challenge reuses the cached token.
+	res2, err := testEngine.Fetch(ctx, r, "protected2.bin", p)
+	if err != nil {
+		t.Fatalf("second bearer fetch: %v", err)
+	}
+	if readAll(t, res2) != "protected payload 2" {
+		t.Error("second bearer content mismatch")
+	}
+
+	// HEAD path also negotiates a bearer token (uncached).
+	testCache.FlushRemote(ctx, "eng-bearer")
+	testDB.DeleteArtifact(ctx, "eng-bearer", "protected.bin")
+	if h, err := testEngine.Head(ctx, r, "protected.bin", p); err != nil || h.Source != "cache" && h.Source != "remote" {
+		t.Fatalf("bearer head: %+v %v", h, err)
+	}
+}
+
+func TestFetchUpstreamError(t *testing.T) {
+	requireStack(t)
+	r := seed(t, genericRemote("eng-404"))
+	// Upstream 404 (no cached copy, stale-on-error can't help) -> ProxyError.
+	_, err := testEngine.Fetch(context.Background(), r, "missing", prov(t, models.PackageGeneric))
+	var pe *ProxyError
+	if err == nil || !asProxyError(err, &pe) || pe.Status != http.StatusNotFound {
+		t.Errorf("expected 404 ProxyError, got %v", err)
+	}
+	// HEAD of a missing upstream path also errors.
+	if _, err := testEngine.Head(context.Background(), r, "missing", prov(t, models.PackageGeneric)); err == nil {
+		t.Error("expected head error for missing path")
+	}
+}
+
+func TestFetchUpstreamStatusErrors(t *testing.T) {
+	requireStack(t)
+	ctx := context.Background()
+	p := prov(t, models.PackageGeneric)
+
+	r := seed(t, genericRemote("eng-500"))
+	_, err := testEngine.Fetch(ctx, r, "err500", p)
+	var pe *ProxyError
+	if err == nil || !asProxyError(err, &pe) || pe.Status != http.StatusInternalServerError {
+		t.Errorf("expected 500 ProxyError, got %v", err)
+	}
+
+	r = seed(t, genericRemote("eng-noauth"))
+	_, err = testEngine.Fetch(ctx, r, "noauth", p)
+	if err == nil || !asProxyError(err, &pe) || pe.Status != http.StatusUnauthorized {
+		t.Errorf("expected 401 ProxyError, got %v", err)
+	}
+}
+
+func TestBearerTokenParsing(t *testing.T) {
+	// Non-Bearer challenges and missing realms are rejected.
+	if _, _, err := fetchBearerToken(context.Background(), "Basic realm=x", models.Remote{}); err == nil {
+		t.Error("expected error for non-Bearer challenge")
+	}
+	if _, _, err := fetchBearerToken(context.Background(), `Bearer service="reg"`, models.Remote{}); err == nil {
+		t.Error("expected error for missing realm")
+	}
+}
+
+func TestWaitForStoreCoalesces(t *testing.T) {
+	requireStack(t)
+	ctx := context.Background()
+	r := seed(t, genericRemote("eng-herd"))
+	p := prov(t, models.PackageGeneric)
+
+	// Fire concurrent cold-cache fetches: only one holds the lock, the others
+	// wait on the store (waitForStore) and pick up the result.
+	const n = 4
+	done := make(chan string, n)
+	for i := 0; i < n; i++ {
+		go func() {
+			res, err := testEngine.Fetch(ctx, r, "blob.bin", p)
+			if err != nil {
+				done <- "err:" + err.Error()
+				return
+			}
+			done <- readAll(t, res)
+		}()
+	}
+	for i := 0; i < n; i++ {
+		if got := <-done; got != "immutable blob" {
+			t.Errorf("concurrent fetch got %q", got)
+		}
+	}
+}
+
+func TestRevalidationUpstreamError(t *testing.T) {
+	requireStack(t)
+	ctx := context.Background()
+	r := seed(t, models.Remote{Name: "eng-reval-err", PackageType: models.PackageNPM, RepoType: models.RepoTypeRemote, BaseURL: upstream.URL, CheckMutable: true, MutableTTL: 3600, StaleOnError: true})
+	p := prov(t, models.PackageNPM)
+
+	res, err := testEngine.Fetch(ctx, r, "pkg", p)
+	if err != nil {
+		t.Fatalf("initial fetch: %v", err)
+	}
+	res.Reader.Close()
+
+	// Expire freshness but keep the ETag, then break the upstream: the
+	// conditional HEAD (checkUpstream) errors, and stale-on-error serves the
+	// stored index.
+	testCache.SetTTL(ctx, "eng-reval-err", "pkg", time.Millisecond)
+	time.Sleep(10 * time.Millisecond)
+	r.BaseURL = "http://127.0.0.1:1"
+	res, err = testEngine.Fetch(ctx, r, "pkg", p)
+	if err != nil {
+		t.Fatalf("expected stale serve on revalidation error, got %v", err)
+	}
+	if res.Source != "cache" {
+		t.Errorf("expected stale cache source, got %s", res.Source)
+	}
+	res.Reader.Close()
+}
+
+func TestTTLFor(t *testing.T) {
+	e := &Engine{}
+	if got := e.ttlFor(models.Remote{ImmutableTTL: 100}, ClassImmutable); got != 100*time.Second {
+		t.Errorf("immutable ttl = %v", got)
+	}
+	if got := e.ttlFor(models.Remote{ImmutableTTL: 0}, ClassImmutable); got != 0 {
+		t.Errorf("immutable ttl=0 (forever) = %v", got)
+	}
+	if got := e.ttlFor(models.Remote{MutableTTL: 50}, ClassMutable); got != 50*time.Second {
+		t.Errorf("mutable ttl = %v", got)
+	}
+}
+
+func TestHeadUpstreamStatusError(t *testing.T) {
+	requireStack(t)
+	r := seed(t, genericRemote("eng-head500"))
+	if _, err := testEngine.Head(context.Background(), r, "err500", prov(t, models.PackageGeneric)); err == nil {
+		t.Error("expected error for HEAD of 500 upstream")
+	}
+}
+
+func TestHeadCachedIndex(t *testing.T) {
+	requireStack(t)
+	ctx := context.Background()
+	r := seed(t, models.Remote{Name: "eng-headidx", PackageType: models.PackageNPM, RepoType: models.RepoTypeRemote, BaseURL: upstream.URL, CheckMutable: true, MutableTTL: 3600})
+	p := prov(t, models.PackageNPM)
+	// Cache the mutable index, then HEAD is answered from the stored index.
+	res, err := testEngine.Fetch(ctx, r, "pkg", p)
+	if err != nil {
+		t.Fatal(err)
+	}
+	res.Reader.Close()
+	h, err := testEngine.Head(ctx, r, "pkg", p)
+	if err != nil || h.Source != "cache" {
+		t.Errorf("head of cached index: %+v %v", h, err)
+	}
+}
+
+func TestFetchBearerTokenVariants(t *testing.T) {
+	requireStack(t)
+	ctx := context.Background()
+
+	// access_token field + service/scope params + basic auth on the token req.
+	tok, _, err := fetchBearerToken(ctx, `Bearer realm="`+upstream.URL+`/token-at",service="reg",scope="repo:pull"`, models.Remote{Username: "u", Password: "p"})
+	if err != nil || tok != "at-token" {
+		t.Errorf("access_token variant: tok=%q err=%v", tok, err)
+	}
+	// Token endpoint error status.
+	if _, _, err := fetchBearerToken(ctx, `Bearer realm="`+upstream.URL+`/token-500"`, models.Remote{}); err == nil {
+		t.Error("expected error for 500 token endpoint")
+	}
+}
+
+func TestCheckUpstreamChanged(t *testing.T) {
+	requireStack(t)
+	ctx := context.Background()
+	r := genericRemote("eng-check")
+	// A non-matching ETag yields a normal 200 (not 304): not modified is false.
+	notModified, err := testEngine.checkUpstream(ctx, r, "pkg", `"stale-etag"`, prov(t, models.PackageNPM))
+	if err != nil {
+		t.Fatalf("checkUpstream: %v", err)
+	}
+	if notModified {
+		t.Error("mismatched etag should report modified (notModified=false)")
+	}
+}
+
+func TestUpstreamErrorUnwrap(t *testing.T) {
+	base := context.DeadlineExceeded
+	ue := &UpstreamError{Err: base}
+	if ue.Unwrap() != base {
+		t.Error("Unwrap should return the wrapped error")
+	}
+	if !isNetworkError(ue) {
+		t.Error("UpstreamError should be a network error")
+	}
+	if isNetworkError(context.Canceled) {
+		t.Error("plain error should not be a network error")
+	}
+}
+
+func TestImmutableBlobDedup(t *testing.T) {
+	requireStack(t)
+	ctx := context.Background()
+	p := prov(t, models.PackageGeneric)
+	// Two remotes serving identical content: the second store hits the
+	// already-exists branch (blob content is deduplicated).
+	for _, name := range []string{"eng-dedup-a", "eng-dedup-b"} {
+		r := seed(t, genericRemote(name))
+		res, err := testEngine.Fetch(ctx, r, "blob.bin", p)
+		if err != nil {
+			t.Fatalf("%s fetch: %v", name, err)
+		}
+		if readAll(t, res) != "immutable blob" {
+			t.Errorf("%s content mismatch", name)
+		}
+	}
+}
+
+func TestCircuitBreakerStates(t *testing.T) {
+	requireStack(t)
+	ctx := context.Background()
+	cb := NewCircuitBreaker(testCache)
+	const key = "cb-states"
+	testCache.ResetCircuit(ctx, key)
+
+	if cb.IsOpen(ctx, key) {
+		t.Error("fresh breaker should be closed")
+	}
+	if cb.Health(ctx, key).Status != "healthy" {
+		t.Error("fresh breaker should be healthy")
+	}
+	cb.RecordFailure(ctx, key)
+	if s := cb.Health(ctx, key).Status; s != "degraded" {
+		t.Errorf("one failure should be degraded, got %q", s)
+	}
+	for i := 0; i < 6; i++ {
+		cb.RecordFailure(ctx, key)
+	}
+	if !cb.IsOpen(ctx, key) {
+		t.Error("breaker should be open after threshold failures")
+	}
+	if s := cb.Health(ctx, key).Status; s != "down" {
+		t.Errorf("open breaker should be down, got %q", s)
+	}
+	cb.RecordSuccess(ctx, key)
+	if cb.IsOpen(ctx, key) {
+		t.Error("breaker should close after success")
+	}
+}
+
+func asProxyError(err error, target **ProxyError) bool {
+	pe, ok := err.(*ProxyError)
+	if ok {
+		*target = pe
+	}
+	return ok
+}

internal/proxy/httpclient.go

@@ -0,0 +1,83 @@
+package proxy
+
+import (
+	"net"
+	"net/http"
+	"sync"
+	"time"
+
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+// Default upstream timeouts. A remote may override any of these; a zero
+// override falls back to the default here. There is deliberately no overall
+// Client.Timeout: the proxy streams arbitrarily large artifacts and total time
+// is bounded by the request context instead. We only constrain the phases that
+// must never hang — connect, TLS handshake, and time-to-first-response-header —
+// so a slow or wedged upstream cannot pin a goroutine and connection.
+const (
+	defaultDialTimeout           = 10 * time.Second
+	defaultTLSTimeout            = 10 * time.Second
+	defaultResponseHeaderTimeout = 30 * time.Second
+)
+
+type clientKey struct {
+	dial       time.Duration
+	tls        time.Duration
+	respHeader time.Duration
+}
+
+var (
+	clientCacheMu sync.Mutex
+	clientCache   = map[clientKey]*http.Client{}
+)
+
+// upstreamClientFor returns an HTTP client configured with the given timeouts,
+// reusing a cached client (and its connection pool) for identical timeout sets.
+// Zero values fall back to the defaults.
+func upstreamClientFor(dial, tls, respHeader time.Duration) *http.Client {
+	if dial <= 0 {
+		dial = defaultDialTimeout
+	}
+	if tls <= 0 {
+		tls = defaultTLSTimeout
+	}
+	if respHeader <= 0 {
+		respHeader = defaultResponseHeaderTimeout
+	}
+	key := clientKey{dial: dial, tls: tls, respHeader: respHeader}
+
+	clientCacheMu.Lock()
+	defer clientCacheMu.Unlock()
+	if c, ok := clientCache[key]; ok {
+		return c
+	}
+
+	c := &http.Client{
+		Transport: &http.Transport{
+			Proxy: http.ProxyFromEnvironment,
+			DialContext: (&net.Dialer{
+				Timeout:   dial,
+				KeepAlive: 30 * time.Second,
+			}).DialContext,
+			MaxIdleConns:          100,
+			MaxIdleConnsPerHost:   10,
+			IdleConnTimeout:       90 * time.Second,
+			TLSHandshakeTimeout:   tls,
+			ExpectContinueTimeout: 1 * time.Second,
+			ResponseHeaderTimeout: respHeader,
+		},
+	}
+	clientCache[key] = c
+	return c
+}
+
+// clientForRemote returns the upstream client for a remote, applying its
+// per-remote timeout overrides (in seconds) on top of the defaults.
+func clientForRemote(remote models.Remote) *http.Client {
+	return upstreamClientFor(
+		time.Duration(remote.UpstreamDialTimeout)*time.Second,
+		time.Duration(remote.UpstreamTLSTimeout)*time.Second,
+		time.Duration(remote.UpstreamResponseHeaderTimeout)*time.Second,
+	)
+}

internal/server/server.go

@@ -12,12 +12,14 @@ import (
 	"github.com/go-chi/chi/v5"
 	"github.com/go-chi/chi/v5/middleware"
 
+	tfregistry "git.unkin.net/unkin/artifactapi/internal/api/terraform"
 	v1 "git.unkin.net/unkin/artifactapi/internal/api/v1"
 	v2 "git.unkin.net/unkin/artifactapi/internal/api/v2"
 	"git.unkin.net/unkin/artifactapi/internal/cache"
 	"git.unkin.net/unkin/artifactapi/internal/config"
 	"git.unkin.net/unkin/artifactapi/internal/database"
 	"git.unkin.net/unkin/artifactapi/internal/gc"
+	"git.unkin.net/unkin/artifactapi/internal/githubauth"
 	_ "git.unkin.net/unkin/artifactapi/internal/provider/alpine"
 	_ "git.unkin.net/unkin/artifactapi/internal/provider/docker"
 	_ "git.unkin.net/unkin/artifactapi/internal/provider/generic"
@@ -26,15 +28,17 @@ import (
 	_ "git.unkin.net/unkin/artifactapi/internal/provider/npm"
 	_ "git.unkin.net/unkin/artifactapi/internal/provider/puppet"
 	_ "git.unkin.net/unkin/artifactapi/internal/provider/pypi"
-	_ "git.unkin.net/unkin/artifactapi/internal/provider/rpm"
+	"git.unkin.net/unkin/artifactapi/internal/provider/rpm"
 	_ "git.unkin.net/unkin/artifactapi/internal/provider/terraform"
 	"git.unkin.net/unkin/artifactapi/internal/proxy"
 	"git.unkin.net/unkin/artifactapi/internal/storage"
+	"git.unkin.net/unkin/artifactapi/internal/tfsign"
 	"git.unkin.net/unkin/artifactapi/internal/virtual"
 )
 
 type Server struct {
 	cfg          *config.Config
+	version      string
 	router       chi.Router
 	db           *database.DB
 	cache        *cache.Redis
@@ -42,10 +46,12 @@ type Server struct {
 	engine       *proxy.Engine
 	virtEngine   *virtual.Engine
 	localHandler *v2.LocalHandler
+	tfRegistry   *tfregistry.Handler
 	gc           *gc.Collector
+	syncer       *rpm.Syncer
 }
 
-func New(cfg *config.Config) (*Server, error) {
+func New(cfg *config.Config, version string) (*Server, error) {
 	db, err := database.New(cfg.DatabaseDSN())
 	if err != nil {
 		return nil, fmt.Errorf("database: %w", err)
@@ -61,20 +67,67 @@ func New(cfg *config.Config) (*Server, error) {
 		return nil, fmt.Errorf("s3: %w", err)
 	}
 
+	// Install the process-wide GitHub credential before any provider makes an
+	// outbound call. A misconfiguration (e.g. App id without a private key) fails
+	// closed here rather than silently falling back to anonymous. No credential
+	// configured is fine — requests stay anonymous.
+	ghCred, err := githubauth.New(githubauth.Options{
+		Token:          cfg.GitHubToken,
+		AppID:          cfg.GitHubAppID,
+		InstallationID: cfg.GitHubAppInstallationID,
+		PrivateKeyPEM:  cfg.GitHubAppPrivateKey,
+		PrivateKeyPath: cfg.GitHubAppPrivateKeyPath,
+	})
+	if err != nil {
+		return nil, fmt.Errorf("github auth: %w", err)
+	}
+	githubauth.SetServer(ghCred)
+	if ghCred != nil {
+		slog.Info("github machine credential configured")
+	}
+
 	engine := proxy.NewEngine(db, redis, s3)
 	localHandler := v2.NewLocalHandler(db, s3)
 	virtEngine := virtual.NewEngine(db, engine)
 	collector := gc.New(db, s3, 1*time.Hour)
+	syncer := rpm.NewSyncer(db, rpm.SyncConfig{
+		RatePerSec:   cfg.GitHubSyncRatePerSec,
+		Burst:        cfg.GitHubSyncBurst,
+		Workers:      cfg.GitHubSyncWorkers,
+		PollInterval: time.Duration(cfg.GitHubSyncPollInterval) * time.Second,
+	})
+
+	// The terraform registry signs with a GPG key. A configured file wins (BYO
+	// key); otherwise artifactapi generates one on first start and persists it in
+	// the database so every replica shares it. A failure here must not take the
+	// server down — the registry just stays disabled.
+	var signer *tfsign.Signer
+	if cfg.TFSigningKeyPath != "" {
+		signer, err = tfsign.Load(cfg.TFSigningKeyPath, cfg.TFSigningKeyPassphrase)
+	} else {
+		signer, err = tfsign.LoadOrCreate(context.Background(), db, "terraform-provider")
+	}
+	if err != nil {
+		slog.Warn("terraform provider registry disabled", "error", err)
+		signer = nil
+	}
+	tfRegistry := tfregistry.NewHandler(db, signer, cfg.TFProviderProtocols)
+	if tfRegistry.Enabled() {
+		slog.Info("terraform provider registry enabled", "key_id", signer.KeyID())
+	}
 
 	s := &Server{
 		cfg:          cfg,
+		version:      version,
 		db:           db,
 		cache:        redis,
 		store:        s3,
 		engine:       engine,
 		virtEngine:   virtEngine,
 		localHandler: localHandler,
+		tfRegistry:   tfRegistry,
 		gc:           collector,
+		syncer:       syncer,
 	}
 
 	s.router = s.routes()
@@ -93,11 +146,18 @@ func (s *Server) routes() chi.Router {
 
 	r.Get("/health", s.handleHealth)
 	r.Get("/", s.handleRoot)
+	r.Get("/version", s.handleVersion)
+
+	// Terraform provider registry: service discovery at the well-known path,
+	// providers.v1 protocol under /terraform/v1/providers.
+	r.Get("/.well-known/terraform.json", s.tfRegistry.ServiceDiscovery)
+	r.Mount(tfregistry.MountPath, s.tfRegistry.Routes())
 
 	proxyHandler := v1.NewProxyHandler(s.engine, s.virtEngine, s.db, s.store, s.localHandler)
 	r.Mount("/api/v1", proxyHandler.Routes())
+	r.Mount("/v2", proxyHandler.DockerV2Routes())
 
-	remotesHandler := v2.NewRemotesHandler(s.db)
+	remotesHandler := v2.NewRemotesHandler(s.db, s.syncer)
 	virtualsHandler := v2.NewVirtualsHandler(s.db)
 	healthHandler := v2.NewHealthHandler(s.db, s.cache, s.store)
 	statsHandler := v2.NewStatsHandler(s.db)
@@ -118,6 +178,12 @@ func (s *Server) routes() chi.Router {
 			r.Delete("/*", objHandler.Routes().ServeHTTP)
 		})
 
+		r.Route("/locals/{name}/objects", func(r chi.Router) {
+			objHandler := v2.NewObjectsHandler(s.db)
+			r.Get("/", objHandler.LocalRoutes().ServeHTTP)
+			r.Delete("/*", objHandler.LocalRoutes().ServeHTTP)
+		})
+
 		r.Route("/remotes/{name}/files", func(r chi.Router) {
 			r.Put("/*", s.localHandler.Routes().ServeHTTP)
 			r.Get("/*", s.localHandler.Routes().ServeHTTP)
@@ -134,10 +200,16 @@ func (s *Server) handleHealth(w http.ResponseWriter, r *http.Request) {
 	fmt.Fprint(w, `{"status":"ok"}`)
 }
 
+// handleRoot sends browsers landing on the bare domain to the web UI, which is
+// served under /ui. The service identity that used to live here is at /version.
 func (s *Server) handleRoot(w http.ResponseWriter, r *http.Request) {
+	http.Redirect(w, r, "/ui/", http.StatusFound)
+}
+
+func (s *Server) handleVersion(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(http.StatusOK)
-	fmt.Fprint(w, `{"name":"artifactapi","version":"3.0.0-dev"}`)
+	fmt.Fprintf(w, `{"name":"artifactapi","version":"%s"}`, s.version)
 }
 
 func (s *Server) newHTTPServer() *http.Server {
@@ -152,6 +224,7 @@ func (s *Server) newHTTPServer() *http.Server {
 
 func (s *Server) Run(ctx context.Context) error {
 	go s.gc.Run(ctx)
+	go s.syncer.Run(ctx)
 
 	httpServer := s.newHTTPServer()
 
@@ -172,6 +245,7 @@ func (s *Server) Run(ctx context.Context) error {
 
 func (s *Server) RunOnListener(ctx context.Context, ln net.Listener) error {
 	go s.gc.Run(ctx)
+	go s.syncer.Run(ctx)
 
 	httpServer := s.newHTTPServer()
 

internal/server/server_test.go

@@ -0,0 +1,639 @@
+package server
+
+import (
+	"bytes"
+	"context"
+	"fmt"
+	"io"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"os"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"git.unkin.net/unkin/artifactapi/internal/config"
+	"git.unkin.net/unkin/artifactapi/internal/testsupport"
+)
+
+var (
+	testTS   *httptest.Server // the artifactapi router
+	upstream *httptest.Server // mock upstream the proxy fetches from
+	testSrv  *Server
+)
+
+func TestMain(m *testing.M) {
+	ctx := context.Background()
+
+	dsn, termPG, err := testsupport.StartPostgres(ctx)
+	if err != nil {
+		os.Exit(m.Run())
+	}
+	defer termPG()
+	redisURL, termRedis, err := testsupport.StartRedis(ctx)
+	if err != nil {
+		termPG()
+		os.Exit(m.Run())
+	}
+	defer termRedis()
+	minio, termMinio, err := testsupport.StartMinio(ctx)
+	if err != nil {
+		termPG()
+		termRedis()
+		os.Exit(m.Run())
+	}
+	defer termMinio()
+
+	u, _ := url.Parse(dsn)
+	port, _ := strconv.Atoi(u.Port())
+	cfg := &config.Config{
+		ListenAddr:  ":0",
+		DBHost:      u.Hostname(),
+		DBPort:      port,
+		DBUser:      "artifacts",
+		DBPass:      "artifacts123",
+		DBName:      "artifacts",
+		DBSSL:       "disable",
+		RedisURL:    redisURL,
+		S3Endpoint:  minio.Endpoint,
+		S3AccessKey: minio.AccessKey,
+		S3SecretKey: minio.SecretKey,
+		S3Bucket:    "server-test",
+	}
+
+	var srv *Server
+	for i := 0; i < 20; i++ { // tolerate MinIO reporting ready before bucket ops succeed
+		if srv, err = New(cfg, "test-version"); err == nil {
+			break
+		}
+		time.Sleep(500 * time.Millisecond)
+	}
+	if err != nil {
+		panic(err)
+	}
+	testSrv = srv
+	testTS = httptest.NewServer(srv.router)
+	upstream = httptest.NewServer(http.HandlerFunc(mockUpstream))
+
+	code := m.Run()
+
+	testTS.Close()
+	upstream.Close()
+	termMinio()
+	termRedis()
+	termPG()
+	if code != 0 {
+		os.Exit(code)
+	}
+}
+
+func mockUpstream(w http.ResponseWriter, r *http.Request) {
+	switch r.URL.Path {
+	case "/data/file.bin":
+		w.Write([]byte("upstream blob payload"))
+	case "/helm-a/index.yaml":
+		w.Write([]byte("apiVersion: v1\nentries:\n  alpha:\n    - name: alpha\n      version: 1.0.0\n      urls: [charts/alpha-1.0.0.tgz]\n"))
+	case "/helm-b/index.yaml":
+		w.Write([]byte("apiVersion: v1\nentries:\n  beta:\n    - name: beta\n      version: 2.0.0\n      urls: [charts/beta-2.0.0.tgz]\n"))
+	default:
+		http.NotFound(w, r)
+	}
+}
+
+func requireStack(t *testing.T) {
+	t.Helper()
+	if testTS == nil {
+		t.Skip("Docker unavailable; skipping server integration test")
+	}
+}
+
+func req(t *testing.T, method, path string, body string) (*http.Response, []byte) {
+	t.Helper()
+	var r io.Reader
+	if body != "" {
+		r = strings.NewReader(body)
+	}
+	rq, _ := http.NewRequest(method, testTS.URL+path, r)
+	if body != "" {
+		rq.Header.Set("Content-Type", "application/json")
+	}
+	resp, err := http.DefaultClient.Do(rq)
+	if err != nil {
+		t.Fatalf("%s %s: %v", method, path, err)
+	}
+	defer resp.Body.Close()
+	b, _ := io.ReadAll(resp.Body)
+	return resp, b
+}
+
+// reqNoRedirect issues a request without following redirects so the response's
+// status and Location header can be asserted directly.
+func reqNoRedirect(t *testing.T, method, path string) *http.Response {
+	t.Helper()
+	rq, _ := http.NewRequest(method, testTS.URL+path, nil)
+	client := &http.Client{CheckRedirect: func(*http.Request, []*http.Request) error {
+		return http.ErrUseLastResponse
+	}}
+	resp, err := client.Do(rq)
+	if err != nil {
+		t.Fatalf("%s %s: %v", method, path, err)
+	}
+	resp.Body.Close()
+	return resp
+}
+
+func TestServerHealthAndRoot(t *testing.T) {
+	requireStack(t)
+	if resp, _ := req(t, "GET", "/health", ""); resp.StatusCode != 200 {
+		t.Errorf("health: %d", resp.StatusCode)
+	}
+	if resp := reqNoRedirect(t, "GET", "/"); resp.StatusCode != http.StatusFound || resp.Header.Get("Location") != "/ui/" {
+		t.Errorf("root redirect: %d %q", resp.StatusCode, resp.Header.Get("Location"))
+	}
+	if resp, b := req(t, "GET", "/version", ""); resp.StatusCode != 200 || !strings.Contains(string(b), "test-version") {
+		t.Errorf("version: %d %s", resp.StatusCode, b)
+	}
+	if resp, _ := req(t, "GET", "/api/v2/health", ""); resp.StatusCode != 200 {
+		t.Errorf("health v2: %d", resp.StatusCode)
+	}
+}
+
+func TestServerRemoteAndProxy(t *testing.T) {
+	requireStack(t)
+	create := fmt.Sprintf(`{"name":"srv-remote","package_type":"generic","repo_type":"remote","base_url":%q,"stale_on_error":true}`, upstream.URL)
+	if resp, b := req(t, "POST", "/api/v2/remotes", create); resp.StatusCode != 201 {
+		t.Fatalf("create remote: %d %s", resp.StatusCode, b)
+	}
+	defer req(t, "DELETE", "/api/v2/remotes/srv-remote", "")
+
+	if resp, _ := req(t, "GET", "/api/v2/remotes/srv-remote", ""); resp.StatusCode != 200 {
+		t.Errorf("get remote: %d", resp.StatusCode)
+	}
+	if resp, _ := req(t, "GET", "/api/v2/remotes", ""); resp.StatusCode != 200 {
+		t.Errorf("list remotes: %d", resp.StatusCode)
+	}
+
+	// Proxy fetch: miss then hit.
+	resp, b := req(t, "GET", "/api/v1/remote/srv-remote/data/file.bin", "")
+	if resp.StatusCode != 200 || string(b) != "upstream blob payload" {
+		t.Fatalf("proxy miss: %d %s", resp.StatusCode, b)
+	}
+	if src := resp.Header.Get("X-Artifact-Source"); src != "remote" {
+		t.Errorf("expected remote source, got %q", src)
+	}
+	resp, _ = req(t, "GET", "/api/v1/remote/srv-remote/data/file.bin", "")
+	if resp.Header.Get("X-Artifact-Source") != "cache" {
+		t.Errorf("second fetch should be cache: %q", resp.Header.Get("X-Artifact-Source"))
+	}
+
+	// Objects listing + stats now that we have an artifact.
+	if resp, _ := req(t, "GET", "/api/v2/remotes/srv-remote/objects", ""); resp.StatusCode != 200 {
+		t.Errorf("objects: %d", resp.StatusCode)
+	}
+	if resp, _ := req(t, "GET", "/api/v2/stats", ""); resp.StatusCode != 200 {
+		t.Errorf("stats: %d", resp.StatusCode)
+	}
+	for _, p := range []string{"/api/v2/stats/top-remotes", "/api/v2/stats/top-files-by-hits", "/api/v2/stats/top-files-by-bandwidth"} {
+		if resp, _ := req(t, "GET", p, ""); resp.StatusCode != 200 {
+			t.Errorf("%s: %d", p, resp.StatusCode)
+		}
+	}
+}
+
+func TestServerLocalUpload(t *testing.T) {
+	requireStack(t)
+	if resp, b := req(t, "POST", "/api/v2/remotes", `{"name":"srv-local","package_type":"generic","repo_type":"local"}`); resp.StatusCode != 201 {
+		t.Fatalf("create local: %d %s", resp.StatusCode, b)
+	}
+	defer req(t, "DELETE", "/api/v2/remotes/srv-local", "")
+
+	rq, _ := http.NewRequest("PUT", testTS.URL+"/api/v2/remotes/srv-local/files/dir/hello.bin", strings.NewReader("local payload"))
+	rq.Header.Set("Content-Type", "text/plain") // exercise the content-type branch
+	resp, err := http.DefaultClient.Do(rq)
+	if err != nil || resp.StatusCode != 201 {
+		t.Fatalf("upload: %v %d", err, resp.StatusCode)
+	}
+	resp.Body.Close()
+
+	resp, b := req(t, "GET", "/api/v1/local/srv-local/dir/hello.bin", "")
+	if resp.StatusCode != 200 || string(b) != "local payload" {
+		t.Errorf("download local: %d %s", resp.StatusCode, b)
+	}
+	// Also download via the v2 files endpoint.
+	if resp, b := req(t, "GET", "/api/v2/remotes/srv-local/files/dir/hello.bin", ""); resp.StatusCode != 200 || string(b) != "local payload" {
+		t.Errorf("v2 download: %d %s", resp.StatusCode, b)
+	}
+}
+
+func TestServerVirtualMerge(t *testing.T) {
+	requireStack(t)
+	for _, m := range []string{"a", "b"} {
+		body := fmt.Sprintf(`{"name":"srv-helm-%s","package_type":"helm","repo_type":"remote","base_url":"%s/helm-%s","stale_on_error":true}`, m, upstream.URL, m)
+		if resp, b := req(t, "POST", "/api/v2/remotes", body); resp.StatusCode != 201 {
+			t.Fatalf("create helm-%s: %d %s", m, resp.StatusCode, b)
+		}
+		defer req(t, "DELETE", "/api/v2/remotes/srv-helm-"+m, "")
+	}
+	if resp, b := req(t, "POST", "/api/v2/virtuals", `{"name":"srv-vh","package_type":"helm","members":["srv-helm-a","srv-helm-b"]}`); resp.StatusCode != 201 {
+		t.Fatalf("create virtual: %d %s", resp.StatusCode, b)
+	}
+	defer req(t, "DELETE", "/api/v2/virtuals/srv-vh", "")
+
+	resp, b := req(t, "GET", "/api/v1/virtual/srv-vh/index.yaml", "")
+	if resp.StatusCode != 200 {
+		t.Fatalf("virtual fetch: %d %s", resp.StatusCode, b)
+	}
+	s := string(b)
+	if !strings.Contains(s, "alpha") || !strings.Contains(s, "beta") {
+		t.Errorf("merged index missing charts: %s", s)
+	}
+}
+
+func TestServerProbe(t *testing.T) {
+	requireStack(t)
+	create := fmt.Sprintf(`{"name":"srv-probe","package_type":"generic","repo_type":"remote","base_url":%q,"stale_on_error":true}`, upstream.URL)
+	req(t, "POST", "/api/v2/remotes", create)
+	defer req(t, "DELETE", "/api/v2/remotes/srv-probe", "")
+
+	// Reachable path -> status 200 in the probe body.
+	if resp, b := req(t, "POST", "/api/v2/probe", `{"remote":"srv-probe","path":"data/file.bin"}`); resp.StatusCode != 200 || !strings.Contains(string(b), `"status":200`) {
+		t.Errorf("probe reachable: %d %s", resp.StatusCode, b)
+	}
+	// Missing upstream path -> upstream error reported (502) in the body.
+	if resp, b := req(t, "POST", "/api/v2/probe", `{"remote":"srv-probe","path":"missing"}`); resp.StatusCode != 200 || !strings.Contains(string(b), `"status":502`) {
+		t.Errorf("probe missing: %d %s", resp.StatusCode, b)
+	}
+	// Unknown remote -> 404 in the body.
+	if resp, b := req(t, "POST", "/api/v2/probe", `{"remote":"nope","path":"x"}`); resp.StatusCode != 200 || !strings.Contains(string(b), `"status":404`) {
+		t.Errorf("probe unknown: %d %s", resp.StatusCode, b)
+	}
+	// Bad requests.
+	if resp, _ := req(t, "POST", "/api/v2/probe", `{}`); resp.StatusCode != 400 {
+		t.Errorf("probe missing fields: %d", resp.StatusCode)
+	}
+	if resp, _ := req(t, "POST", "/api/v2/probe", `not json`); resp.StatusCode != 400 {
+		t.Errorf("probe invalid json: %d", resp.StatusCode)
+	}
+}
+
+func put(t *testing.T, path string, body []byte) (*http.Response, []byte) {
+	t.Helper()
+	rq, _ := http.NewRequest("PUT", testTS.URL+path, bytes.NewReader(body))
+	resp, err := http.DefaultClient.Do(rq)
+	if err != nil {
+		t.Fatalf("PUT %s: %v", path, err)
+	}
+	defer resp.Body.Close()
+	b, _ := io.ReadAll(resp.Body)
+	return resp, b
+}
+
+func TestServerLocalPyPI(t *testing.T) {
+	requireStack(t)
+	if resp, b := req(t, "POST", "/api/v2/remotes", `{"name":"srv-pypi","package_type":"pypi","repo_type":"local"}`); resp.StatusCode != 201 {
+		t.Fatalf("create pypi local: %d %s", resp.StatusCode, b)
+	}
+	defer req(t, "DELETE", "/api/v2/remotes/srv-pypi", "")
+
+	if resp, b := put(t, "/api/v2/remotes/srv-pypi/files/foo-1.0-py3-none-any.whl", []byte("wheel bytes")); resp.StatusCode != 201 {
+		t.Fatalf("upload wheel: %d %s", resp.StatusCode, b)
+	}
+	// Re-uploading the same file is rejected.
+	if resp, _ := put(t, "/api/v2/remotes/srv-pypi/files/foo-1.0-py3-none-any.whl", []byte("again")); resp.StatusCode != 409 {
+		t.Errorf("expected 409 on overwrite, got %d", resp.StatusCode)
+	}
+	// Invalid pypi filename rejected.
+	if resp, _ := put(t, "/api/v2/remotes/srv-pypi/files/not-a-package.txt", []byte("x")); resp.StatusCode != 400 {
+		t.Errorf("expected 400 for bad filename, got %d", resp.StatusCode)
+	}
+
+	if resp, b := req(t, "GET", "/api/v1/local/srv-pypi/simple/", ""); resp.StatusCode != 200 || !strings.Contains(string(b), "foo") {
+		t.Errorf("simple index: %d %s", resp.StatusCode, b)
+	}
+	if resp, b := req(t, "GET", "/api/v1/local/srv-pypi/simple/foo/", ""); resp.StatusCode != 200 || !strings.Contains(string(b), "foo-1.0-py3-none-any.whl") {
+		t.Errorf("package index: %d %s", resp.StatusCode, b)
+	}
+}
+
+func TestServerLocalRPMRepodata(t *testing.T) {
+	requireStack(t)
+	rpm := testsupport.MinimalRPM("e2e-testpkg", "1.0", "1", "noarch")
+	if resp, b := req(t, "POST", "/api/v2/remotes", `{"name":"srv-rpm","package_type":"rpm","repo_type":"local"}`); resp.StatusCode != 201 {
+		t.Fatalf("create rpm local: %d %s", resp.StatusCode, b)
+	}
+	defer req(t, "DELETE", "/api/v2/remotes/srv-rpm", "")
+
+	if resp, b := put(t, "/api/v2/remotes/srv-rpm/files/e2e-testpkg-1.0-1.noarch.rpm", rpm); resp.StatusCode != 201 {
+		t.Fatalf("upload rpm: %d %s", resp.StatusCode, b)
+	}
+
+	// repodata is generated asynchronously; poll for it.
+	var body []byte
+	for i := 0; i < 40; i++ {
+		var resp *http.Response
+		resp, body = req(t, "GET", "/api/v1/local/srv-rpm/repodata/repomd.xml", "")
+		if resp.StatusCode == 200 && strings.Contains(string(body), "<repomd") {
+			return
+		}
+		time.Sleep(250 * time.Millisecond)
+	}
+	t.Errorf("repomd.xml not generated: %s", body)
+}
+
+func TestServerObjectEviction(t *testing.T) {
+	requireStack(t)
+	create := fmt.Sprintf(`{"name":"srv-evict","package_type":"generic","repo_type":"remote","base_url":%q,"stale_on_error":true}`, upstream.URL)
+	req(t, "POST", "/api/v2/remotes", create)
+	defer req(t, "DELETE", "/api/v2/remotes/srv-evict", "")
+
+	resp, _ := req(t, "GET", "/api/v1/remote/srv-evict/data/file.bin", "")
+	resp.Body.Close()
+	if resp, _ := req(t, "DELETE", "/api/v2/remotes/srv-evict/objects/data/file.bin", ""); resp.StatusCode >= 400 {
+		t.Errorf("evict object: %d", resp.StatusCode)
+	}
+}
+
+func TestServerValidationErrors(t *testing.T) {
+	requireStack(t)
+	if resp, _ := req(t, "POST", "/api/v2/remotes", `{"name":"bad","package_type":"bogus","base_url":"https://x"}`); resp.StatusCode != 400 {
+		t.Errorf("invalid package type: %d", resp.StatusCode)
+	}
+	if resp, _ := req(t, "POST", "/api/v2/remotes", `{"name":"bad","package_type":"generic","repo_type":"remote"}`); resp.StatusCode != 400 {
+		t.Errorf("missing base_url: %d", resp.StatusCode)
+	}
+	if resp, _ := req(t, "POST", "/api/v2/remotes", `not json`); resp.StatusCode != 400 {
+		t.Errorf("invalid json: %d", resp.StatusCode)
+	}
+	// Invalid regex pattern -> 400 from ValidatePatterns.
+	if resp, _ := req(t, "POST", "/api/v2/remotes", `{"name":"badre","package_type":"generic","repo_type":"remote","base_url":"https://x","blocklist":["[unterminated"]}`); resp.StatusCode != 400 {
+		t.Errorf("invalid regex: %d", resp.StatusCode)
+	}
+}
+
+func TestServerDockerAndHead(t *testing.T) {
+	requireStack(t)
+	create := fmt.Sprintf(`{"name":"srv-docker","package_type":"generic","repo_type":"remote","base_url":%q,"stale_on_error":true}`, upstream.URL)
+	req(t, "POST", "/api/v2/remotes", create)
+	defer req(t, "DELETE", "/api/v2/remotes/srv-docker", "")
+
+	// Docker registry ping.
+	if resp, _ := req(t, "GET", "/v2/", ""); resp.StatusCode != 200 {
+		t.Errorf("docker ping: %d", resp.StatusCode)
+	}
+	// HEAD through the docker route resolves metadata (uncached -> upstream).
+	rq, _ := http.NewRequest("HEAD", testTS.URL+"/v2/srv-docker/data/file.bin", nil)
+	resp, err := http.DefaultClient.Do(rq)
+	if err != nil {
+		t.Fatalf("head: %v", err)
+	}
+	resp.Body.Close()
+	if resp.StatusCode != 200 {
+		t.Errorf("head status: %d", resp.StatusCode)
+	}
+}
+
+func TestServerRemoteUpdateAndVirtualCRUD(t *testing.T) {
+	requireStack(t)
+	req(t, "POST", "/api/v2/remotes", `{"name":"srv-upd","package_type":"helm","repo_type":"remote","base_url":"https://a.example.com","stale_on_error":true}`)
+	defer req(t, "DELETE", "/api/v2/remotes/srv-upd", "")
+	if resp, b := req(t, "PUT", "/api/v2/remotes/srv-upd", `{"package_type":"helm","base_url":"https://b.example.com","stale_on_error":true}`); resp.StatusCode != 200 {
+		t.Errorf("update remote: %d %s", resp.StatusCode, b)
+	}
+
+	req(t, "POST", "/api/v2/virtuals", `{"name":"srv-v2","package_type":"helm","members":["srv-upd"]}`)
+	defer req(t, "DELETE", "/api/v2/virtuals/srv-v2", "")
+	if resp, _ := req(t, "GET", "/api/v2/virtuals/srv-v2", ""); resp.StatusCode != 200 {
+		t.Errorf("get virtual: %d", resp.StatusCode)
+	}
+	if resp, _ := req(t, "GET", "/api/v2/virtuals", ""); resp.StatusCode != 200 {
+		t.Errorf("list virtuals: %d", resp.StatusCode)
+	}
+	if resp, b := req(t, "PUT", "/api/v2/virtuals/srv-v2", `{"package_type":"helm","members":["srv-upd"]}`); resp.StatusCode != 200 {
+		t.Errorf("update virtual: %d %s", resp.StatusCode, b)
+	}
+}
+
+func TestServerLocalRemoveAndMissing(t *testing.T) {
+	requireStack(t)
+	req(t, "POST", "/api/v2/remotes", `{"name":"srv-rm","package_type":"generic","repo_type":"local"}`)
+	defer req(t, "DELETE", "/api/v2/remotes/srv-rm", "")
+
+	put(t, "/api/v2/remotes/srv-rm/files/a/b.bin", []byte("payload"))
+	if resp, _ := req(t, "DELETE", "/api/v2/remotes/srv-rm/files/a/b.bin", ""); resp.StatusCode >= 400 {
+		t.Errorf("delete local file: %d", resp.StatusCode)
+	}
+	if resp, _ := req(t, "GET", "/api/v1/local/srv-rm/a/b.bin", ""); resp.StatusCode != 404 {
+		t.Errorf("expected 404 for removed file, got %d", resp.StatusCode)
+	}
+}
+
+func TestServerLocalUploadErrors(t *testing.T) {
+	requireStack(t)
+	// Uploading to a remote-type repo is rejected.
+	create := fmt.Sprintf(`{"name":"srv-uerr","package_type":"generic","repo_type":"remote","base_url":%q,"stale_on_error":true}`, upstream.URL)
+	req(t, "POST", "/api/v2/remotes", create)
+	defer req(t, "DELETE", "/api/v2/remotes/srv-uerr", "")
+	if resp, _ := put(t, "/api/v2/remotes/srv-uerr/files/x.bin", []byte("x")); resp.StatusCode != 400 {
+		t.Errorf("upload to remote repo should be 400, got %d", resp.StatusCode)
+	}
+
+	// Duplicate generic upload is a conflict.
+	req(t, "POST", "/api/v2/remotes", `{"name":"srv-dup","package_type":"generic","repo_type":"local"}`)
+	defer req(t, "DELETE", "/api/v2/remotes/srv-dup", "")
+	put(t, "/api/v2/remotes/srv-dup/files/dup.bin", []byte("one"))
+	if resp, _ := put(t, "/api/v2/remotes/srv-dup/files/dup.bin", []byte("two")); resp.StatusCode != 409 {
+		t.Errorf("duplicate upload should be 409, got %d", resp.StatusCode)
+	}
+
+	// Download of a missing local file is 404.
+	if resp, _ := req(t, "GET", "/api/v1/local/srv-dup/does/not/exist", ""); resp.StatusCode != 404 {
+		t.Errorf("missing local download should be 404, got %d", resp.StatusCode)
+	}
+	// Unknown virtual is 404.
+	if resp, _ := req(t, "GET", "/api/v1/virtual/nope/index.yaml", ""); resp.StatusCode != 404 {
+		t.Errorf("unknown virtual should be 404, got %d", resp.StatusCode)
+	}
+}
+
+func TestServerEvents(t *testing.T) {
+	requireStack(t)
+	client := &http.Client{Timeout: 800 * time.Millisecond}
+	resp, err := client.Get(testTS.URL + "/api/v2/events")
+	if err == nil {
+		resp.Body.Close()
+		if resp.StatusCode != 200 {
+			t.Errorf("events status: %d", resp.StatusCode)
+		}
+	}
+	// A timeout is expected for a streaming endpoint; the handler still ran.
+}
+
+func TestRunOnListener(t *testing.T) {
+	requireStack(t)
+	ln, err := net.Listen("tcp", "127.0.0.1:0")
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	errc := make(chan error, 1)
+	go func() { errc <- testSrv.RunOnListener(ctx, ln) }()
+
+	base := "http://" + ln.Addr().String()
+	ok := false
+	for i := 0; i < 50; i++ {
+		if resp, e := http.Get(base + "/health"); e == nil {
+			resp.Body.Close()
+			ok = resp.StatusCode == 200
+			break
+		}
+		time.Sleep(20 * time.Millisecond)
+	}
+	if !ok {
+		t.Error("server did not serve /health")
+	}
+	cancel()
+	select {
+	case err := <-errc:
+		if err != nil {
+			t.Errorf("RunOnListener returned error: %v", err)
+		}
+	case <-time.After(12 * time.Second):
+		t.Fatal("RunOnListener did not shut down")
+	}
+}
+
+func TestRun(t *testing.T) {
+	requireStack(t)
+	ctx, cancel := context.WithCancel(context.Background())
+	errc := make(chan error, 1)
+	go func() { errc <- testSrv.Run(ctx) }()
+	time.Sleep(300 * time.Millisecond) // let it bind and start serving
+	cancel()
+	select {
+	case err := <-errc:
+		if err != nil {
+			t.Errorf("Run returned error: %v", err)
+		}
+	case <-time.After(12 * time.Second):
+		t.Fatal("Run did not shut down")
+	}
+}
+
+func TestServerVirtualUnreachableMembers(t *testing.T) {
+	requireStack(t)
+	// A virtual whose only member does not exist -> no members reachable.
+	req(t, "POST", "/api/v2/virtuals", `{"name":"srv-vbad","package_type":"helm","members":["nonexistent-member"]}`)
+	defer req(t, "DELETE", "/api/v2/virtuals/srv-vbad", "")
+	if resp, _ := req(t, "GET", "/api/v1/virtual/srv-vbad/index.yaml", ""); resp.StatusCode != 502 {
+		t.Errorf("virtual with dead members = %d, want 502", resp.StatusCode)
+	}
+}
+
+func TestServerVirtualLocalPyPIMerge(t *testing.T) {
+	requireStack(t)
+	for _, n := range []string{"a", "b"} {
+		req(t, "POST", "/api/v2/remotes", `{"name":"srv-pm-`+n+`","package_type":"pypi","repo_type":"local"}`)
+		defer req(t, "DELETE", "/api/v2/remotes/srv-pm-"+n, "")
+	}
+	put(t, "/api/v2/remotes/srv-pm-a/files/foo-1.0-py3-none-any.whl", []byte("foo"))
+	put(t, "/api/v2/remotes/srv-pm-b/files/bar-2.0-py3-none-any.whl", []byte("bar"))
+	req(t, "POST", "/api/v2/virtuals", `{"name":"srv-pmv","package_type":"pypi","members":["srv-pm-a","srv-pm-b"]}`)
+	defer req(t, "DELETE", "/api/v2/virtuals/srv-pmv", "")
+
+	resp, b := req(t, "GET", "/api/v1/virtual/srv-pmv/simple/", "")
+	if resp.StatusCode != 200 {
+		t.Fatalf("virtual pypi index: %d %s", resp.StatusCode, b)
+	}
+	if s := string(b); !strings.Contains(s, "foo") || !strings.Contains(s, "bar") {
+		t.Errorf("merged local pypi index missing packages: %s", s)
+	}
+}
+
+func TestServerProxyErrors(t *testing.T) {
+	requireStack(t)
+	// Blocklisted path -> 403 propagated through handleProxy.
+	block := fmt.Sprintf(`{"name":"srv-block","package_type":"generic","repo_type":"remote","base_url":%q,"blocklist":["\\.secret$"],"stale_on_error":true}`, upstream.URL)
+	req(t, "POST", "/api/v2/remotes", block)
+	defer req(t, "DELETE", "/api/v2/remotes/srv-block", "")
+	if resp, _ := req(t, "GET", "/api/v1/remote/srv-block/x.secret", ""); resp.StatusCode != 403 {
+		t.Errorf("blocklisted GET = %d, want 403", resp.StatusCode)
+	}
+	rq, _ := http.NewRequest("HEAD", testTS.URL+"/v2/srv-block/x.secret", nil)
+	if resp, err := http.DefaultClient.Do(rq); err == nil {
+		resp.Body.Close()
+		if resp.StatusCode != 403 {
+			t.Errorf("blocklisted HEAD = %d, want 403", resp.StatusCode)
+		}
+	}
+
+	// Unreachable upstream, no stale copy -> 502 bad gateway.
+	dead := `{"name":"srv-dead","package_type":"generic","repo_type":"remote","base_url":"http://127.0.0.1:1","stale_on_error":false}`
+	req(t, "POST", "/api/v2/remotes", dead)
+	defer req(t, "DELETE", "/api/v2/remotes/srv-dead", "")
+	if resp, _ := req(t, "GET", "/api/v1/remote/srv-dead/x", ""); resp.StatusCode != 502 {
+		t.Errorf("dead upstream GET = %d, want 502", resp.StatusCode)
+	}
+}
+
+func TestServerLocalMissingBlob(t *testing.T) {
+	requireStack(t)
+	req(t, "POST", "/api/v2/remotes", `{"name":"srv-ghost","package_type":"generic","repo_type":"local"}`)
+	defer req(t, "DELETE", "/api/v2/remotes/srv-ghost", "")
+
+	ctx := context.Background()
+	// A local file whose blob object is absent from the store.
+	testSrv.db.UpsertBlob(ctx, "sha256:ghost", "blobs/sha256/ghost-missing", 5, "text/plain")
+	if err := testSrv.db.CreateLocalFile(ctx, "srv-ghost", "ghost.bin", "sha256:ghost"); err != nil {
+		t.Fatalf("create local file: %v", err)
+	}
+
+	if resp, _ := req(t, "GET", "/api/v1/local/srv-ghost/ghost.bin", ""); resp.StatusCode != 500 {
+		t.Errorf("v1 download missing blob = %d, want 500", resp.StatusCode)
+	}
+	if resp, _ := req(t, "GET", "/api/v2/remotes/srv-ghost/files/ghost.bin", ""); resp.StatusCode != 500 {
+		t.Errorf("v2 download missing blob = %d, want 500", resp.StatusCode)
+	}
+}
+
+func TestServerBogusProviderType(t *testing.T) {
+	requireStack(t)
+	// Insert a remote with an unregistered package type directly, bypassing
+	// validation, to exercise the provider-not-found branches.
+	_, err := testSrv.db.Pool.Exec(context.Background(),
+		`INSERT INTO remotes (name, package_type, repo_type, base_url) VALUES ($1,'bogus','remote','https://x')`, "srv-bogus")
+	if err != nil {
+		t.Fatalf("insert bogus remote: %v", err)
+	}
+	defer testSrv.db.Pool.Exec(context.Background(), `DELETE FROM remotes WHERE name='srv-bogus'`)
+
+	if resp, _ := req(t, "GET", "/api/v1/remote/srv-bogus/x", ""); resp.StatusCode != 500 {
+		t.Errorf("bogus provider GET = %d, want 500", resp.StatusCode)
+	}
+	rq, _ := http.NewRequest("HEAD", testTS.URL+"/v2/srv-bogus/x", nil)
+	if resp, err := http.DefaultClient.Do(rq); err == nil {
+		resp.Body.Close()
+		if resp.StatusCode != 500 {
+			t.Errorf("bogus provider HEAD = %d, want 500", resp.StatusCode)
+		}
+	}
+	if resp, b := req(t, "POST", "/api/v2/probe", `{"remote":"srv-bogus","path":"x"}`); resp.StatusCode != 200 || !strings.Contains(string(b), `"status":500`) {
+		t.Errorf("bogus provider probe: %d %s", resp.StatusCode, b)
+	}
+}
+
+func TestServerNotFound(t *testing.T) {
+	requireStack(t)
+	if resp, _ := req(t, "GET", "/api/v2/remotes/does-not-exist", ""); resp.StatusCode != 404 {
+		t.Errorf("expected 404, got %d", resp.StatusCode)
+	}
+	if resp, _ := req(t, "GET", "/api/v1/remote/nope/x", ""); resp.StatusCode != 404 {
+		t.Errorf("expected 404 for unknown remote, got %d", resp.StatusCode)
+	}
+	// Unknown local repo -> 404 in handleLocal.
+	if resp, _ := req(t, "GET", "/api/v1/local/nope/x", ""); resp.StatusCode != 404 {
+		t.Errorf("expected 404 for unknown local repo, got %d", resp.StatusCode)
+	}
+}

internal/storage/s3.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"io"
 	"log/slog"
+	"time"
 
 	"github.com/minio/minio-go/v7"
 	"github.com/minio/minio-go/v7/pkg/credentials"
@@ -97,3 +98,18 @@ func (s *S3) Stat(ctx context.Context, key string) (*minio.ObjectInfo, error) {
 	}
 	return &info, nil
 }
+
+// ListStaleObjects returns keys under prefix last modified before cutoff. Used
+// by the GC to reap abandoned staging objects (e.g. cancelled docker pushes).
+func (s *S3) ListStaleObjects(ctx context.Context, prefix string, cutoff time.Time) ([]string, error) {
+	var keys []string
+	for obj := range s.client.ListObjects(ctx, s.bucket, minio.ListObjectsOptions{Prefix: prefix, Recursive: true}) {
+		if obj.Err != nil {
+			return nil, obj.Err
+		}
+		if obj.LastModified.Before(cutoff) {
+			keys = append(keys, obj.Key)
+		}
+	}
+	return keys, nil
+}

internal/storage/storage_test.go

@@ -0,0 +1,160 @@
+package storage
+
+import (
+	"bytes"
+	"context"
+	"io"
+	"os"
+	"strings"
+	"testing"
+	"time"
+
+	"git.unkin.net/unkin/artifactapi/internal/testsupport"
+)
+
+var (
+	testS3       *S3
+	testEndpoint string
+)
+
+func TestMain(m *testing.M) {
+	ctx := context.Background()
+	conn, terminate, err := testsupport.StartMinio(ctx)
+	if err != nil {
+		os.Exit(m.Run())
+	}
+	var s3 *S3
+	for i := 0; i < 20; i++ { // MinIO can report ready before bucket ops succeed
+		if s3, err = NewS3(conn.Endpoint, conn.AccessKey, conn.SecretKey, "test-bucket", false, ""); err == nil {
+			break
+		}
+		time.Sleep(500 * time.Millisecond)
+	}
+	if err != nil {
+		terminate()
+		panic(err)
+	}
+	testS3 = s3
+	testEndpoint = conn.Endpoint
+	code := m.Run()
+	terminate()
+	if code != 0 {
+		os.Exit(code)
+	}
+}
+
+func requireS3(t *testing.T) {
+	t.Helper()
+	if testS3 == nil {
+		t.Skip("Docker unavailable; skipping storage integration test")
+	}
+}
+
+func TestKeys(t *testing.T) {
+	if BlobKey("abc") != "blobs/sha256/abc" {
+		t.Error("BlobKey")
+	}
+	if IndexKey("remote", "path/to/x") != "indexes/remote/path/to/x" {
+		t.Error("IndexKey")
+	}
+}
+
+func TestS3RoundTrip(t *testing.T) {
+	requireS3(t)
+	ctx := context.Background()
+	key := "blobs/sha256/test1"
+	content := []byte("hello storage")
+
+	if err := testS3.Upload(ctx, key, bytes.NewReader(content), int64(len(content)), "text/plain"); err != nil {
+		t.Fatalf("upload: %v", err)
+	}
+
+	exists, err := testS3.Exists(ctx, key)
+	if err != nil || !exists {
+		t.Fatalf("exists after upload: %v %v", exists, err)
+	}
+
+	reader, info, err := testS3.Download(ctx, key)
+	if err != nil {
+		t.Fatalf("download: %v", err)
+	}
+	got, _ := io.ReadAll(reader)
+	reader.Close()
+	if !bytes.Equal(got, content) {
+		t.Errorf("content mismatch: %q", got)
+	}
+	if info.Size != int64(len(content)) || info.ContentType != "text/plain" {
+		t.Errorf("stat info wrong: size=%d ct=%s", info.Size, info.ContentType)
+	}
+
+	if _, err := testS3.Stat(ctx, key); err != nil {
+		t.Errorf("stat: %v", err)
+	}
+
+	if err := testS3.Delete(ctx, key); err != nil {
+		t.Fatalf("delete: %v", err)
+	}
+	if exists, _ := testS3.Exists(ctx, key); exists {
+		t.Error("expected object gone after delete")
+	}
+}
+
+func TestNewS3ExistingBucket(t *testing.T) {
+	requireS3(t)
+	// The bucket already exists from TestMain, so ensureBucket takes the
+	// "already present" path.
+	if _, err := NewS3(testEndpoint, "minioadmin", "minioadmin", "test-bucket", false, ""); err != nil {
+		t.Fatalf("second NewS3: %v", err)
+	}
+}
+
+func TestS3DownloadMissing(t *testing.T) {
+	requireS3(t)
+	if _, _, err := testS3.Download(context.Background(), "does/not/exist"); err == nil {
+		t.Error("expected error downloading missing key")
+	}
+	if _, err := testS3.Stat(context.Background(), "does/not/exist"); err == nil {
+		t.Error("expected error stat-ing missing key")
+	}
+	if exists, err := testS3.Exists(context.Background(), "does/not/exist"); err != nil || exists {
+		t.Errorf("Exists(missing) = %v, %v; want false, nil", exists, err)
+	}
+}
+
+func TestCASStore(t *testing.T) {
+	requireS3(t)
+	ctx := context.Background()
+	cas := NewCAS(testS3)
+	content := "content-addressed payload"
+
+	res, err := cas.Store(ctx, strings.NewReader(content), "text/plain")
+	if err != nil {
+		t.Fatalf("store: %v", err)
+	}
+	if res.AlreadyExists {
+		t.Error("first store should not report AlreadyExists")
+	}
+	if res.SizeBytes != int64(len(content)) || !strings.HasPrefix(res.ContentHash, "sha256:") {
+		t.Errorf("unexpected result: %+v", res)
+	}
+
+	// Storing identical content again is deduplicated.
+	res2, err := cas.Store(ctx, strings.NewReader(content), "text/plain")
+	if err != nil {
+		t.Fatalf("store again: %v", err)
+	}
+	if !res2.AlreadyExists || res2.ContentHash != res.ContentHash {
+		t.Errorf("second store should dedup: %+v", res2)
+	}
+
+	// The stored blob is retrievable.
+	reader, _, err := testS3.Download(ctx, res.S3Key)
+	if err != nil {
+		t.Fatalf("download stored blob: %v", err)
+	}
+	got, _ := io.ReadAll(reader)
+	reader.Close()
+	if string(got) != content {
+		t.Errorf("stored content mismatch: %q", got)
+	}
+}

internal/testsupport/containers.go

@@ -0,0 +1,101 @@
+// Package testsupport starts throwaway backing containers (Postgres, Redis,
+// MinIO) for integration-style unit tests. It is only ever imported from
+// *_test.go files, so it never reaches the production binary. Each Start*
+// function returns a connection detail plus a terminate func; callers wire
+// them up in a TestMain and skip the package's tests when Docker is absent.
+package testsupport
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"time"
+
+	"github.com/testcontainers/testcontainers-go"
+	tcpostgres "github.com/testcontainers/testcontainers-go/modules/postgres"
+	tcredis "github.com/testcontainers/testcontainers-go/modules/redis"
+	"github.com/testcontainers/testcontainers-go/wait"
+)
+
+func init() {
+	// The Ryuk reaper container cannot start in this environment; each Start*
+	// returns an explicit terminate func for cleanup instead.
+	if _, ok := os.LookupEnv("TESTCONTAINERS_RYUK_DISABLED"); !ok {
+		os.Setenv("TESTCONTAINERS_RYUK_DISABLED", "true")
+	}
+}
+
+// StartPostgres launches postgres:17-alpine and returns its DSN.
+func StartPostgres(ctx context.Context) (dsn string, terminate func(), err error) {
+	c, err := tcpostgres.Run(ctx,
+		"postgres:17-alpine",
+		tcpostgres.WithDatabase("artifacts"),
+		tcpostgres.WithUsername("artifacts"),
+		tcpostgres.WithPassword("artifacts123"),
+		testcontainers.WithWaitStrategy(
+			// Postgres opens the port, runs init scripts, then restarts, so wait
+			// for the readiness log to appear twice to avoid connection resets.
+			wait.ForLog("database system is ready to accept connections").
+				WithOccurrence(2).
+				WithStartupTimeout(60*time.Second),
+		),
+	)
+	if err != nil {
+		return "", nil, err
+	}
+	host, _ := c.Host(ctx)
+	port, _ := c.MappedPort(ctx, "5432/tcp")
+	dsn = fmt.Sprintf("postgres://artifacts:artifacts123@%s:%s/artifacts?sslmode=disable", host, port.Port())
+	return dsn, func() { _ = c.Terminate(ctx) }, nil
+}
+
+// StartRedis launches redis:7-alpine and returns its URL.
+func StartRedis(ctx context.Context) (url string, terminate func(), err error) {
+	c, err := tcredis.Run(ctx,
+		"redis:7-alpine",
+		testcontainers.WithWaitStrategy(
+			wait.ForListeningPort("6379/tcp").WithStartupTimeout(60*time.Second),
+		),
+	)
+	if err != nil {
+		return "", nil, err
+	}
+	host, _ := c.Host(ctx)
+	port, _ := c.MappedPort(ctx, "6379/tcp")
+	url = fmt.Sprintf("redis://%s:%s", host, port.Port())
+	return url, func() { _ = c.Terminate(ctx) }, nil
+}
+
+// MinioConn holds MinIO connection details.
+type MinioConn struct {
+	Endpoint  string
+	AccessKey string
+	SecretKey string
+}
+
+// StartMinio launches minio and returns its connection details.
+func StartMinio(ctx context.Context) (conn MinioConn, terminate func(), err error) {
+	c, err := testcontainers.GenericContainer(ctx, testcontainers.GenericContainerRequest{
+		ContainerRequest: testcontainers.ContainerRequest{
+			Image:        "minio/minio:latest",
+			ExposedPorts: []string{"9000/tcp"},
+			Cmd:          []string{"server", "/data"},
+			Env: map[string]string{
+				"MINIO_ROOT_USER":     "minioadmin",
+				"MINIO_ROOT_PASSWORD": "minioadmin",
+			},
+			WaitingFor: wait.ForHTTP("/minio/health/ready").WithPort("9000/tcp").WithStartupTimeout(60 * time.Second),
+		},
+		Started: true,
+	})
+	if err != nil {
+		return MinioConn{}, nil, err
+	}
+	host, _ := c.Host(ctx)
+	port, _ := c.MappedPort(ctx, "9000/tcp")
+	return MinioConn{
+		Endpoint:  fmt.Sprintf("%s:%s", host, port.Port()),
+		AccessKey: "minioadmin",
+		SecretKey: "minioadmin",
+	}, func() { _ = c.Terminate(ctx) }, nil
+}

internal/testsupport/rpm.go

@@ -0,0 +1,59 @@
+package testsupport
+
+import (
+	"bytes"
+	"encoding/binary"
+)
+
+// MinimalRPM builds a valid-enough RPM package in pure Go (no committed binary
+// fixture, no external rpmbuild). It carries just the header tags the provider
+// reads: name/version/release/arch plus a single self Provides entry, which is
+// enough for cavaliergopher/rpm to parse and for repodata generation.
+func MinimalRPM(name, version, release, arch string) []byte {
+	type tag struct {
+		id, typ, count uint32
+		data           []byte
+	}
+	cstr := func(s string) []byte { return append([]byte(s), 0) }
+	tags := []tag{
+		{1000, 6, 1, cstr(name)},         // RPMTAG_NAME (STRING)
+		{1001, 6, 1, cstr(version)},      // RPMTAG_VERSION
+		{1002, 6, 1, cstr(release)},      // RPMTAG_RELEASE
+		{1022, 6, 1, cstr(arch)},         // RPMTAG_ARCH
+		{1047, 8, 1, cstr(name)},         // RPMTAG_PROVIDENAME (STRING_ARRAY)
+		{1112, 4, 1, []byte{0, 0, 0, 0}}, // RPMTAG_PROVIDEFLAGS (INT32)
+		{1113, 8, 1, cstr(version)},      // RPMTAG_PROVIDEVERSION (STRING_ARRAY)
+	}
+
+	buildHeader := func(entries []tag) []byte {
+		var index, store bytes.Buffer
+		for _, e := range entries {
+			off := uint32(store.Len())
+			for _, v := range []uint32{e.id, e.typ, off, e.count} {
+				binary.Write(&index, binary.BigEndian, v)
+			}
+			store.Write(e.data)
+		}
+		var b bytes.Buffer
+		b.Write([]byte{0x8e, 0xad, 0xe8, 0x01, 0, 0, 0, 0}) // header magic + reserved
+		binary.Write(&b, binary.BigEndian, uint32(len(entries)))
+		binary.Write(&b, binary.BigEndian, uint32(store.Len()))
+		b.Write(index.Bytes())
+		b.Write(store.Bytes())
+		return b.Bytes()
+	}
+
+	lead := make([]byte, 96)
+	copy(lead[0:4], []byte{0xed, 0xab, 0xee, 0xdb}) // lead magic
+	lead[4] = 3                                     // major version
+	binary.BigEndian.PutUint16(lead[8:10], 1)       // archnum
+	copy(lead[10:76], name)                         // name (66 bytes, null-padded)
+	binary.BigEndian.PutUint16(lead[76:78], 1)      // osnum
+	binary.BigEndian.PutUint16(lead[78:80], 5)      // signature type
+
+	var out bytes.Buffer
+	out.Write(lead)
+	out.Write(buildHeader(nil)) // empty signature header (16 bytes, 8-aligned)
+	out.Write(buildHeader(tags))
+	return out.Bytes()
+}