From b76fddecb9770fa98aee64f4da31b4691e8e85ab Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Fri, 11 Sep 2026 23:26:29 +1000 Subject: [PATCH 1/2] Allow GitHub branch archives through the github remote patterns is a strict allowlist evaluated before mutable_patterns, so /archive/refs/heads/ downloads are denied despite the mutable entry. - Add heads .zip and .tar.gz to patterns - Add heads .zip to mutable_patterns and escape the tar.gz dots --- config/remote_generic/github.yaml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/config/remote_generic/github.yaml b/config/remote_generic/github.yaml index a44eccb..019a720 100644 --- a/config/remote_generic/github.yaml +++ b/config/remote_generic/github.yaml @@ -3,12 +3,17 @@ description: GitHub releases and files immutable_ttl: 0 mutable_ttl: 7200 mutable_patterns: - - ".*/archive/refs/heads/.*.tar.gz$" + - ".*/archive/refs/heads/.*\\.tar\\.gz$" + - ".*/archive/refs/heads/.*\\.zip$" - "stalwartlabs/webadmin/releases/latest/download/webadmin.zip$" # iplocate IP databases (Git-LFS; the /raw/ path redirects to the LFS media host). - "iplocate/ip-address-databases/raw/.*/ip-to-asn/.*" - "iplocate/ip-address-databases/raw/.*/ip-to-country/.*" patterns: + # Branch archives: patterns is a strict allowlist checked before + # mutable_patterns, so heads must be listed in both. + - ".*/archive/refs/heads/.*\\.tar\\.gz$" + - ".*/archive/refs/heads/.*\\.zip$" - ".*/archive/refs/tags/.*.tar.gz$" - ".*/archive/refs/tags/.*\\.zip$" - "9p4/jellyfin-plugin-sso/.*/sso-authentication_.*.zip$" -- 2.47.3 From d7542d8fe26bd6c387463f6099f3e3ece07d0b45 Mon Sep 17 00:00:00 2001 From: unkin-agent Date: Fri, 11 Sep 2026 23:34:12 +1000 Subject: [PATCH 2/2] Narrow GitHub branch archives to named repos The wildcard heads entries admitted a branch archive from any repository on GitHub. patterns is the admission allowlist, so only the repos that need a branch install belong in it. - Replace the wildcard heads entries with one anchored entry per repo - Cover the 14 Neovim plugins that publish no tags, zip and tar.gz - List each repo in both patterns and mutable_patterns --- config/remote_generic/github.yaml | 40 ++++++++++++++++++++++++++----- 1 file changed, 34 insertions(+), 6 deletions(-) diff --git a/config/remote_generic/github.yaml b/config/remote_generic/github.yaml index 019a720..30b0d26 100644 --- a/config/remote_generic/github.yaml +++ b/config/remote_generic/github.yaml @@ -3,17 +3,45 @@ description: GitHub releases and files immutable_ttl: 0 mutable_ttl: 7200 mutable_patterns: - - ".*/archive/refs/heads/.*\\.tar\\.gz$" - - ".*/archive/refs/heads/.*\\.zip$" + # Branch archives of tagless Neovim plugins; a branch ref moves, so these + # revalidate on mutable_ttl instead of caching immutably. + - "^HampusHauffman/block\\.nvim/archive/refs/heads/main\\.(zip|tar\\.gz)$" + - "^hrsh7th/cmp-buffer/archive/refs/heads/main\\.(zip|tar\\.gz)$" + - "^hrsh7th/cmp-nvim-lsp/archive/refs/heads/main\\.(zip|tar\\.gz)$" + - "^hrsh7th/cmp-nvim-lsp-signature-help/archive/refs/heads/main\\.(zip|tar\\.gz)$" + - "^hrsh7th/cmp-nvim-lua/archive/refs/heads/main\\.(zip|tar\\.gz)$" + - "^hrsh7th/cmp-path/archive/refs/heads/main\\.(zip|tar\\.gz)$" + - "^hrsh7th/cmp-vsnip/archive/refs/heads/main\\.(zip|tar\\.gz)$" + - "^hrsh7th/vim-vsnip/archive/refs/heads/master\\.(zip|tar\\.gz)$" + - "^junegunn/gv\\.vim/archive/refs/heads/master\\.(zip|tar\\.gz)$" + - "^jvirtanen/vim-hcl/archive/refs/heads/main\\.(zip|tar\\.gz)$" + - "^Mofiqul/dracula\\.nvim/archive/refs/heads/main\\.(zip|tar\\.gz)$" + - "^numToStr/FTerm\\.nvim/archive/refs/heads/master\\.(zip|tar\\.gz)$" + - "^qvalentin/helm-ls\\.nvim/archive/refs/heads/main\\.(zip|tar\\.gz)$" + - "^rafamadriz/friendly-snippets/archive/refs/heads/main\\.(zip|tar\\.gz)$" - "stalwartlabs/webadmin/releases/latest/download/webadmin.zip$" # iplocate IP databases (Git-LFS; the /raw/ path redirects to the LFS media host). - "iplocate/ip-address-databases/raw/.*/ip-to-asn/.*" - "iplocate/ip-address-databases/raw/.*/ip-to-country/.*" patterns: - # Branch archives: patterns is a strict allowlist checked before - # mutable_patterns, so heads must be listed in both. - - ".*/archive/refs/heads/.*\\.tar\\.gz$" - - ".*/archive/refs/heads/.*\\.zip$" + # Branch archives of Neovim plugins that publish no tags. patterns is a + # strict allowlist checked before mutable_patterns, so each repo must be + # listed in both. Anchored per repo: matching is a substring search, so an + # unanchored entry would also admit evil///.... + - "^HampusHauffman/block\\.nvim/archive/refs/heads/main\\.(zip|tar\\.gz)$" + - "^hrsh7th/cmp-buffer/archive/refs/heads/main\\.(zip|tar\\.gz)$" + - "^hrsh7th/cmp-nvim-lsp/archive/refs/heads/main\\.(zip|tar\\.gz)$" + - "^hrsh7th/cmp-nvim-lsp-signature-help/archive/refs/heads/main\\.(zip|tar\\.gz)$" + - "^hrsh7th/cmp-nvim-lua/archive/refs/heads/main\\.(zip|tar\\.gz)$" + - "^hrsh7th/cmp-path/archive/refs/heads/main\\.(zip|tar\\.gz)$" + - "^hrsh7th/cmp-vsnip/archive/refs/heads/main\\.(zip|tar\\.gz)$" + - "^hrsh7th/vim-vsnip/archive/refs/heads/master\\.(zip|tar\\.gz)$" + - "^junegunn/gv\\.vim/archive/refs/heads/master\\.(zip|tar\\.gz)$" + - "^jvirtanen/vim-hcl/archive/refs/heads/main\\.(zip|tar\\.gz)$" + - "^Mofiqul/dracula\\.nvim/archive/refs/heads/main\\.(zip|tar\\.gz)$" + - "^numToStr/FTerm\\.nvim/archive/refs/heads/master\\.(zip|tar\\.gz)$" + - "^qvalentin/helm-ls\\.nvim/archive/refs/heads/main\\.(zip|tar\\.gz)$" + - "^rafamadriz/friendly-snippets/archive/refs/heads/main\\.(zip|tar\\.gz)$" - ".*/archive/refs/tags/.*.tar.gz$" - ".*/archive/refs/tags/.*\\.zip$" - "9p4/jellyfin-plugin-sso/.*/sso-authentication_.*.zip$" -- 2.47.3