Skip to content

List mirror versions from the configured upstream - #548

Merged
andrew merged 5 commits into
git-pkgs:mainfrom
simonchrz:fix/mirror-upstream-versions
Oct 25, 2026
Merged

andrew merged 5 commits into
git-pkgs:mainfrom
simonchrz:fix/mirror-upstream-versions

Conversation

@simonchrz

@simonchrz simonchrz commented Oct 22, 2026 •

Copy link
Copy Markdown
Contributor

proxy mirror, mirror API jobs and schedules listed the versions of an unversioned PURL from the public registry, whatever upstream.* says. They now list them from the configured upstream, through the proxy's upstream client, so upstream.auth and the private address rules apply. npm packages in npm_routes are listed from their route.

  • Listed from the configured upstream: npm, gem, golang, hex (hex_api), pub, pypi, maven, nuget, composer, cran and brew.
  • cargo, conda and julia: the proxy's upstream doesn't serve the API the registries client lists from. Versions come from the public registry while the upstream is the default one; with another upstream the error asks for a version.
  • Composer packages in composer_routes, and helm, swift, apk and the rest: the error asks for a version instead of the registries error. Fetching those is proxy mirror doesn't support julia, cran, homebrew, swift, apk, debian or rpm #414.

With PROXY_UPSTREAM_NPM=http://127.0.0.1:1, proxy mirror -dry-run pkg:npm/left-pad listed 15 versions on main and now fails on the unreachable upstream.

The second commit bumps registries to main, which streams npm packuments (git-pkgs/registries#109). proxy mirror -dry-run pkg:npm/typescript failed with unexpected end of JSON input and now lists every version, so this closes #524. go.mod points at a pseudo-version of registries main until the next release; I'll switch it to the tag then.

Closes #524.

proxy mirror and mirror API jobs listed the versions of unversioned
PURLs from the public registries, ignoring upstream.*. They now list
them from the configured upstream through the proxy's upstream client,
and npm packages from their npm_routes entry. Where the upstream has no
listing API, or the ecosystem has no listing at all, the error asks
for a version.

Refs git-pkgs#524
@andrew

andrew commented Oct 23, 2026

Copy link
Copy Markdown
Contributor

This is waiting on git-pkgs/registries#99. The Maven client asks search.maven.org before the configured base URL, so with a custom upstream.maven unversioned PURLs still send coordinates to Central's search and can list Central's versions instead of the upstream's. Once #99 is fixed and released, this needs the registries bump.

simonchrz and others added 4 commits October 24, 2026 19:03
registries main streams npm packuments (git-pkgs/registries#109), so
listing the versions of packages whose packument is over 10 MiB, such as
typescript, no longer fails with "unexpected end of JSON input". It also
reads Maven versions from maven-metadata.xml (git-pkgs#114).

go.mod points at a pseudo-version of registries main until those are
released.
# Conflicts:
#	go.mod
#	go.sum
@andrew
andrew merged commit 3146e80 into git-pkgs:main Oct 25, 2026
7 checks passed
@simonchrz simonchrz mentioned this pull request Oct 25, 2026
@simonchrz simonchrz added the breaking Changes behaviour users rely on; needs a minor release label Oct 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

breaking Changes behaviour users rely on; needs a minor release

Projects

None yet

Development

Successfully merging this pull request may close these issues.

proxy mirror lists versions from the public registry instead of the configured upstream

2 participants