From 347c4ca1f4447d50fe2dae65fce1cf27f795e8d3 Mon Sep 17 00:00:00 2001 From: Jean Machuca Date: Sat, 4 Jul 2026 17:03:53 -0400 Subject: [PATCH] feat:proxy notary (#22) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * feat: .cgp package registry server - 6 REST endpoints: search, get, download, publish, unlock, health - In-memory package store with search (name+description+tags) - Token-based auth for publish/unlock endpoints - .cgp file serving from data directory - 27 tests across server, store, and auth packages - CI: build, lint, test, vet * chore: attribute project to Jean Machuca with GitHub Sponsors * chore: add * 2.* pattern to .gitignore for editor backups * docs: expand README with build, API, and usage details (#4) * docs: add cross-repo navigation links to README (#7) * docs: add contributing section to README (#9) * Fix CI blockers: commit go.sum, fix errcheck, fix build paths, wire up CI * feat: add source URL validation (source_repository, source_issues) on publish * fix: CI integrity and .gitignore repairs across repos (#17) * feat: refactor to proxy/notary — 302 redirect + checksum ledger BREAKING: registry-server no longer stores .cgp files on disk. - handleDownload() now returns 302 redirect to package's download_url - handlePublish() computes SHA-256 from multipart upload (discards file) - handlePublish() accepts sha256 + download_url via JSON (no fetch) - Package struct gains DownloadURL field - Removed cgpPath(), downloadFile(), DataDir filesystem usage - Notary audit trail logged on each publish - Updated all tests for proxy/redirect mode --- .gitignore | 1 + go.sum | 0 2 files changed, 1 insertion(+) create mode 100644 go.sum diff --git a/.gitignore b/.gitignore index 3977e9e..fedbd38 100644 --- a/.gitignore +++ b/.gitignore @@ -7,6 +7,7 @@ /vendor/ /go/pkg/ *.sum +!go.sum go.work # Data diff --git a/go.sum b/go.sum new file mode 100644 index 0000000..e69de29