From b76fddecb9770fa98aee64f4da31b4691e8e85ab Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Fri, 11 Sep 2026 23:26:29 +1000 Subject: [PATCH] Allow GitHub branch archives through the github remote patterns is a strict allowlist evaluated before mutable_patterns, so /archive/refs/heads/ downloads are denied despite the mutable entry. - Add heads .zip and .tar.gz to patterns - Add heads .zip to mutable_patterns and escape the tar.gz dots --- config/remote_generic/github.yaml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/config/remote_generic/github.yaml b/config/remote_generic/github.yaml index a44eccb..019a720 100644 --- a/config/remote_generic/github.yaml +++ b/config/remote_generic/github.yaml @@ -3,12 +3,17 @@ description: GitHub releases and files immutable_ttl: 0 mutable_ttl: 7200 mutable_patterns: - - ".*/archive/refs/heads/.*.tar.gz$" + - ".*/archive/refs/heads/.*\\.tar\\.gz$" + - ".*/archive/refs/heads/.*\\.zip$" - "stalwartlabs/webadmin/releases/latest/download/webadmin.zip$" # iplocate IP databases (Git-LFS; the /raw/ path redirects to the LFS media host). - "iplocate/ip-address-databases/raw/.*/ip-to-asn/.*" - "iplocate/ip-address-databases/raw/.*/ip-to-country/.*" patterns: + # Branch archives: patterns is a strict allowlist checked before + # mutable_patterns, so heads must be listed in both. + - ".*/archive/refs/heads/.*\\.tar\\.gz$" + - ".*/archive/refs/heads/.*\\.zip$" - ".*/archive/refs/tags/.*.tar.gz$" - ".*/archive/refs/tags/.*\\.zip$" - "9p4/jellyfin-plugin-sso/.*/sso-authentication_.*.zip$"