unkin-agent
2905ec99e4
ci/woodpecker/tag/docker Pipeline was successful
The generic `github` remote only allowlists URL patterns: every repo needs hand-written mutable patterns for branch archives, and a moved branch re-downloads the whole archive under a ref-named key. - add `vcs` package type for GitHub or Gitea (picked from `base_url`) tag, commit and release-download paths, cached immutable - redirect `archive/refs/heads/<branch>` to the commit archive, resolving the branch via the branch API with one shared, per-remote bounded lookup cache reused for `mutable_ttl` - cache missing branches for at least 60s and map API rate limits to `503` with `Retry-After` - reject any other path shape, escaping segments and denied redirect targets - add `docs/vcs/remote.md`, a UI type def and a vcs e2e caching case Reviewed-on: #162 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
103 lines
2.8 KiB
Go
103 lines
2.8 KiB
Go
package generic
|
|
|
|
import (
|
|
"context"
|
|
"encoding/base64"
|
|
"net/http"
|
|
"net/url"
|
|
"path"
|
|
"strings"
|
|
|
|
"git.unkin.net/unkin/artifactapi/internal/githubauth"
|
|
"git.unkin.net/unkin/artifactapi/internal/provider"
|
|
"git.unkin.net/unkin/artifactapi/pkg/models"
|
|
)
|
|
|
|
func init() {
|
|
provider.Register(&Provider{})
|
|
}
|
|
|
|
type Provider struct{}
|
|
|
|
func (p *Provider) Type() models.PackageType { return models.PackageGeneric }
|
|
|
|
func (p *Provider) Classify(_ string) provider.Mutability {
|
|
return provider.Immutable
|
|
}
|
|
|
|
var contentTypeMap = map[string]string{
|
|
".tar.gz": "application/gzip",
|
|
".tgz": "application/gzip",
|
|
".gz": "application/gzip",
|
|
".zip": "application/zip",
|
|
".whl": "application/zip",
|
|
".exe": "application/x-msdownload",
|
|
".rpm": "application/x-rpm",
|
|
".xml": "application/xml",
|
|
".yaml": "text/yaml",
|
|
".yml": "text/yaml",
|
|
".json": "application/json",
|
|
".sig": "application/octet-stream",
|
|
}
|
|
|
|
func (p *Provider) ContentType(filePath string) string {
|
|
lower := strings.ToLower(filePath)
|
|
if strings.HasSuffix(lower, ".tar.gz") {
|
|
return "application/gzip"
|
|
}
|
|
ext := path.Ext(lower)
|
|
if ct, ok := contentTypeMap[ext]; ok {
|
|
return ct
|
|
}
|
|
return "application/octet-stream"
|
|
}
|
|
|
|
func (p *Provider) UpstreamURL(remote models.Remote, reqPath string) string {
|
|
base := strings.TrimRight(remote.BaseURL, "/")
|
|
return base + "/" + strings.TrimLeft(reqPath, "/")
|
|
}
|
|
|
|
func (p *Provider) RewriteResponse(_ []byte, _ models.Remote, _ string) ([]byte, error) {
|
|
return nil, nil
|
|
}
|
|
|
|
// AuthHeaders authenticates outbound requests. A per-remote username/password
|
|
// (Basic auth) takes precedence. Otherwise, when the remote points at a GitHub
|
|
// host (e.g. a releases_remote proxying private release assets), the process-wide
|
|
// GitHub credential is attached as a bearer token so private downloads work.
|
|
func (p *Provider) AuthHeaders(ctx context.Context, remote models.Remote) (http.Header, error) {
|
|
h := http.Header{}
|
|
if remote.Username != "" {
|
|
h.Set("Authorization", "Basic "+base64.StdEncoding.EncodeToString([]byte(remote.Username+":"+remote.Password)))
|
|
return h, nil
|
|
}
|
|
if IsGitHubHost(remote.BaseURL) {
|
|
if c := githubauth.Server(); c != nil {
|
|
tok, err := c.Token(ctx)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if tok != "" {
|
|
h.Set("Authorization", "Bearer "+tok)
|
|
}
|
|
}
|
|
}
|
|
return h, nil
|
|
}
|
|
|
|
// IsGitHubHost reports whether rawURL targets a GitHub API/download host that
|
|
// accepts the server credential. objects.githubusercontent.com is deliberately
|
|
// excluded: release-asset downloads 302-redirect there with a pre-signed URL
|
|
// that must not carry an Authorization header.
|
|
func IsGitHubHost(rawURL string) bool {
|
|
u, err := url.Parse(rawURL)
|
|
if err != nil {
|
|
return false
|
|
}
|
|
switch strings.ToLower(u.Hostname()) {
|
|
case "github.com", "www.github.com", "api.github.com", "codeload.github.com", "uploads.github.com":
|
|
return true
|
|
}
|
|
return false
|
|
}
|