unkin-agent
f0ee593164
Local repo writes (file uploads/deletes, object evictions, native publishes, docker push) are open to anyone who can reach the service; only remote/virtual config is token-gated. - add `ARTIFACTAPI_AUTH_UPLOADS` (default false) gating every local write path behind the OIDC verifier - accept the token as Bearer, Token, Basic password (any user) or bare header value on every gated path, including remote/virtual config writes - serve a `/v2/token` Bearer challenge flow so `docker login` with the token enables push; missing, expired or invalid credentials get an anonymous token so pulls stay open - document minting a Vault identity token and passing it per client Reviewed-on: #169 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
25 lines
1023 B
Markdown
25 lines
1023 B
Markdown
# Local gems repository
|
|
|
|
A local `gems` repo is a RubyGems source: `gem push`, `gem yank`, `gem install`
|
|
and `bundle install` work against `/api/v1/local/<repo>`. `gem push` needs an
|
|
API key; any value works unless [uploads are gated](../common/auth.md).
|
|
|
|
```bash
|
|
GEM_HOST_API_KEY=unused gem push --host https://artifactapi.example.com/api/v1/local/<repo> mygem-1.0.0.gem
|
|
gem install mygem --source https://artifactapi.example.com/api/v1/local/<repo>/
|
|
gem yank mygem -v 1.0.0 --host https://artifactapi.example.com/api/v1/local/<repo>
|
|
```
|
|
|
|
```ruby
|
|
# Gemfile
|
|
source "https://artifactapi.example.com/api/v1/local/<repo>/"
|
|
gem "mygem"
|
|
```
|
|
|
|
The repo serves the compact index (`versions`, `info/<gem>`, `names`), `gems/*.gem`
|
|
and `quick/Marshal.4.8/*.gemspec.rz`. The legacy `specs.4.8.gz` indexes are not
|
|
served; current gem and bundler clients use the compact index.
|
|
|
|
Versions are immutable: pushing an existing name-version-platform is rejected
|
|
with 409. A yanked version disappears from the index and its files are removed.
|