Changelog

Artifact Firewall 0.10.0 #

Released: 2026-11-10

Added#

• Cargo (cargo, crates.io’s sparse index) is now a supported ecosystem, also behind a JFrog Artifactory Cargo repository. Rules match pkg:cargo/<crate> with vers:cargo/ ranges. Both deny and hide keep a version in the index marked as yanked, so cargo does not pick it. A lockfile that pins a hidden version still downloads it, and one that pins a denied version gets a 403 naming the rule. Quarantine reads the index’s publish times. In standalone mode, route crates.io by host to https://index.crates.io, and the firewall fetches its crates from https://static.crates.io under the same registry. A crate download is checked when its URL follows cargo’s default .../<crate>/<version>/download form, as crates.io’s and Artifactory’s do.

Changed#

• A path in a registry’s remote_url is now logged as a warning at startup and on a reload that changes the firewall section. Only the scheme and host have ever been used, so a remote_url such as https://repo1.maven.org/maven2 loaded without a word and answered 404 for every artifact. Clients send the path themselves, as they would to the upstream: point Maven at /maven2 below the firewall, as at Maven Central.
• Artifactory and Nexus paths are detected below the /artifactory and /nexus context paths, or at the root, as the Virtual Registry detects them. A repository manager under any other context path is no longer detected, so rules do not match its packages.

Fixed#

• A mode change through /api/mode now sends the webhook, as a config mode change does, so manifests cached under the old mode are purged.
• Fixed rules not matching packages below Artifactory or Nexus reached through a path_prefix route, such as path_prefix: /artifactory with clients at /artifactory/api/npm/<repo>/, so denied versions downloaded. Repository manager paths are now detected below a path_prefix too.
• Fixed the documentation of path_prefix, which said a matched prefix is stripped before the request goes upstream. It is forwarded with the rest of the path, as it always was, so clients pointed at the firewall keep their URLs, and it has to be a path the upstream serves, such as Artifactory’s /artifactory. A made-up prefix such as /registry/npmjs in front of https://registry.npmjs.org answers 404; use a host route for a registry served at its root.
• Fixed denied versions downloading when the first segment of a package’s path was taken for a repository manager’s context path, such as the scope of an npm package @acme/repository. Only /artifactory and /nexus are taken for one now.
• Fixed NuGet downloads from an Artifactory repository failing with a 500 through a standalone firewall. Artifactory links each package as .../registration/Download/<id>/<version>, which was taken for package metadata. It is now handled as a download, so rules apply to it.
• In report mode, npm, PyPI (JSON simple index), NuGet and VS Code metadata kept the origin’s download links, so clients downloaded around the firewall and the downloads were neither evaluated nor logged. report mode now points those links at the firewall as normal mode does, and still applies no rule to them.
• Fixed NuGet registration pages that are listed by link, not inline, being fetched from the origin, around the firewall. Denied versions in those pages stayed listed and downloaded. This affects packages with many versions on nuget.org, such as AWSSDK.Core, and Artifactory virtual repositories. Those links now point at the firewall, which filters the pages.
• Fixed NuGet search and autocomplete reporting only the current page’s results as the total (totalHits), so a search for json with 12,597 matches reported 20. The total is now the origin’s, so clients page through every match; it counts the firewall’s removed results only when one response holds them all.
• Fixed NuGet search and autocomplete failing with a 404 through a standalone firewall in front of nuget.org, which broke package search in Visual Studio, Rider and dotnet package search. nuget.org serves search from another host, which the firewall cannot reach. The firewall now leaves links to other hosts in the NuGet service index unchanged, so clients search nuget.org directly. Search results are not filtered, but downloads still go through the firewall.

Artifact Firewall 0.9.0 #

Released: 2026-11-04

Added#

• A standalone firewall reloads its config file on SIGHUP and when the file changes on disk (config_watch, ARTIFACT_FIREWALL_CONFIG_WATCH), without a restart. A reload is all or nothing. A change to a field that needs a restart, such as port, otel, log_output or a git or http ruleset source, refuses it, and the firewall keeps running the config it had. The systemd unit gets ExecReload, so systemctl reload works. SIGHUP also rebuilds the rules, so it applies an edited ruleset file, and one that finds the rulesets unchanged, as from log rotation, leaves the rules and caches alone and sends no webhook. An embedder applies a new firewall config with Firewall.Reconfigure.
• VS Code Marketplace (vscode-extension) is now a supported ecosystem. Unlike the other ecosystems, deny keeps an extension listed and refuses its download, and hide removes it from listings. A VS Code deployment needs HTTPS and a raised max_manifest_size.
• firewall.redirects.signing (enabled, key_env, url_ttl) signs metadata the firewall embeds in rewritten URLs, so a client cannot alter or replay it.
• Downloads refused at preflight are now counted in firewall_requests_total, in every ecosystem. New audit fields block_reason and substituted_with. See docs/audit-log.md.
• A JSON Schema for the config file, printed by the new -schema flag, for editors and tooling to check a config before the firewall reads it.
• A JSON Schema for ruleset files, pkg/rulesetschema/ruleset.schema.json.
• -validate-rulesets <path>... checks ruleset files without starting a firewall, reports every problem and exits non-zero if there is one.
• The Docker image is built for linux/arm64 as well as linux/amd64.
• The Docker image is published on DockerHub as varnish/artifact-firewall.
• rulesets[].http fetches rulesets from a zip or tar archive over HTTP(S), such as an S3 object, and picks them out with sub_path/sub_paths as a git source does. It polls with conditional requests (ETag/Last-Modified), so an unchanged archive is not downloaded again, also after a restart.
• boot_path on a git or http ruleset source names local rulesets to start on, so startup no longer waits on the remote, and a firewall whose remote is unreachable still starts. They are used until the first successful sync, unless a cache from an earlier run is there.
• A Helm chart for a standalone firewall, published on DockerHub as varnish/artifact-firewall-chart on a version series of its own, with its own changelog. helm show readme oci://registry-1.docker.io/varnish/artifact-firewall-chart prints its documentation.

Changed#

• Manifests are parsed once instead of twice, which cuts the CPU spent transforming them. A manifest with anything but whitespace after its JSON value is now refused as malformed; it used to be read up to the end of the first value.
• A ruleset with a qualifier in a purl, such as pkg:maven/org.example/lib?classifier=sources, now fails to load. Qualifiers were ignored, so that rule matched every artifact of lib.
• A config that conflicts with itself is refused with a message naming the setting, e.g. firewall.rulesets[]: set exactly one of path, git or http. An unknown default_action is now refused with the other config errors at startup.
• The packaged default config (/etc/varnish-artifact-firewall/default.yaml) sets deployment: standalone and carries a commented example registry to start from.
• The Docker image runs as the unprivileged varnish user, uid and gid 999. Anything the firewall writes must be under /var/lib/varnish-artifact-firewall or a volume that user can write.
• A git ruleset source accepts sub_path: ., the root of the repository. Like any directory, it takes every ruleset under it, so rulesets at the root no longer have to be listed one by one. A directory sub path now leaves out hidden files and directories under it, such as .github/, unless the sub path names them.

Fixed#

• Fixed rules not matching Maven Central artifacts requested below /maven2, the path Maven Central serves its repository at, so denied versions downloaded. The groupId was read with maven2. in front. /maven2 is now recognized like a repository manager prefix, in both deployment modes, as the Virtual Registry already does.
• Fixed PyPI downloads from a https://pypi.org remote looping back through the Virtual Registry’s own hostname. The JSON simple index pointed every file URL at the base URL, although pypi.org serves its files from files.pythonhosted.org, so a download was fetched from the Virtual Registry itself and then redirected by pypi.org, and it failed wherever the Virtual Registry cannot reach its own hostname. Behind Virtual Registry, a file URL on another host than the remote’s is now left as it is, and Virtual Registry routes it through /redirectz, as it already did for the HTML index. A standalone firewall still rewrites it.
• Fixed -version in the Docker image reporting the revision with -dirty appended, although the image was built from a clean commit.
• Fixed a manifest the firewall rewrites failing to parse when the client offered an encoding the firewall cannot decompress, such as br from VS Code. Such manifests are now requested with Accept-Encoding: gzip.
• A git ruleset named . or .. is now refused at startup. Its cache directory resolved to the shared git cache or to work_dir itself, which the firewall could delete when it discarded an unusable cache.
• A git ruleset’s fetch_timeout now stops a stalled fetch over HTTP(S). Only git itself was killed, so its remote helper kept running and the sync went on until the remote gave up, however short the timeout.
• Fixed a rule disabled through the admin API coming back enabled after the second ruleset reload, a rule enabled there despite disabled: true in its ruleset coming back disabled after the first, and a change made there while a reload was running being lost.
• Fixed RPM and conda clients getting a package list filtered under a rule’s old status after the rule was enabled or disabled through the admin API, until the next ruleset reload or mode change.
• Fixed a disabled rule that denies a whole package still blocking it. Whether disabled in its ruleset or through the admin API, the rule was skipped when versions were filtered but still refused the request for the package’s metadata.

Artifact Firewall 0.8.0 #

Released: 2026-10-22

Added#

• A standalone firewall requires a license (license.file or license.text): a Varnish Artifact Firewall license, or a Varnish Enterprise license with the sup-firewall addon. It refuses to start without one, and honours the license’s expiration, no_restart and shutdown dates as varnishd does. A Varnish Artifact Firewall license with a version line only licenses that exact firewall version.
• The audit log covers proxy traffic: every identified download, and every listing the firewall altered. Downloads are checked in every mode, but only normal refuses.
• Audit decisions say whether a version was dropped, flagged or quarantined, and a listing served from cache is audited with cached and decided_at.
• New firewall_audit_entries_total metric, labelled by result (written/failed). Nothing is counted while audit logging is off.

Changed#

• An audit_log_output file that cannot be opened now stops the firewall from starting. It used to start with audit logging off.

Fixed#

• Fixed a Go rule whose version range has no v, such as vers:go/<1.64.0 as every OSV advisory writes it, never matching, because the go command always asks for v1.63.0. A range written with the v, such as vers:go/>=v1.2.0, also wrongly missed a version without it. Go ranges and versions now compare the same with or without the v.
• A standalone firewall that fails to start because a ruleset cannot be loaded now sends that error to the OpenTelemetry collector. It was only written to stderr before.
• Fixed the firewall trusting the compromised eMudhra intermediate CAs.

Artifact Firewall 0.7.0 #

Released: 2026-10-05

Added#

• New audit log fields: id, ts, kind, registry, mode, outcome, rule_system_id and ruleset_system_id.

Changed#

• Breaking: the audit log’s effective_action field is now enforced_action, and the span attribute firewall.effective_action is now firewall.enforced_action.
• The OpenTelemetry modules are back on their current releases, with the log modules no longer held at an older one. Audit log output is unchanged.
• A ruleset the firewall refuses to load is now reported as the ruleset, the rule and the field that failed, such as ruleset "npm-policy": rule "block-leftpad": severity: 11.0 must be between 0 and 10.
• An api_address the firewall cannot bind now stops it at startup, with the reason in the log. It used to keep serving proxy traffic with the admin API unreachable and nothing but one line to say so.
• /healthz and /readyz are no longer counted under the route label on the HTTP metrics.
• A rule read back from /api/rulesets/{ruleset_id}/rules/{rule_id} now uses the same field names a ruleset uses: a selector carries version rather than version_range, the registry scope is gone, and unset fields are omitted. PATCH to that path now rejects fields it does not know, so a body captured from an older version has to drop version_range and the registry scope before it is sent back.

Fixed#

• Fixed a NuGet rule whose package name has capitals, such as pkg:nuget/Newtonsoft.Json, never matching, because the firewall lowercases the requested id. NuGet names now match in any case, in traffic and in /api/eval, whose audit entries log the NuGet purl lowercased, like traffic.
• Fixed an action spelled in any case but lower, such as action: DENY in a rule or default_action: DENY in the config, loading without complaint and then never being enforced, so the package it was meant to block was served.
• Fixed a ruleset with an empty entry under rules: crashing the firewall instead of being reported as invalid.
• Fixed re-enabling a rule through the admin API failing when several rules were disabled at once, and a rule that was re-enabled coming back disabled after the next ruleset reload.

Artifact Firewall 0.6.0 #

Released: 2026-09-09

Added#

• The startup line and --version now carry the revision the binary was built from, as stamped by the Go toolchain, suffixed -dirty for a build off a modified tree. It is omitted when the build carries no stamp.
• Go modules (GOPROXY protocol) are now a supported ecosystem: @v/list, @v/<version>.{info,mod,zip}, and @latest requests are identity-extracted, evaluated against rulesets, and allowed/hidden/denied like any other package type. @v/list is content-filtered to drop denied/hidden versions; .info/.mod are gated without altering their bytes, so GOSUMDB verification keeps working through the firewall. See the README for the GOPROXY single-entry requirement (no ,direct fallback) that this protection depends on.
• Added support for the Conda ecosystem. Denied packages are stripped from repodata.json, and .conda/.tar.bz2 downloads are blocked at 403; repodata that can’t be filtered (.bz2, CEP-16 shards) falls back to 404, and unparseable repodata fails open (streamed through unfiltered) since the artifact preflight still blocks a denied package’s download regardless. The channel is the purl namespace (pkg:conda/<channel>/<name>@<version>). Fetching a conda-forge-scale index needs max_manifest_size raised above the 64MiB default.

Changed#

• Reworked what the firewall logs. Startup records the version and the revision it was built from, the config file it read, and the configuration itself as every setting that differs from the defaults, so a log says what a firewall was running without its files having to be found. A ruleset reload names the rulesets that changed instead of counting them, and INFO is reserved for state changes rather than a line before and another after each one. A credential in firewall.webhook.headers is no longer written to the log.

Fixed#

• Fixed the reason a firewall would not start being written to stdout instead of to the log, so it was missing from the log_output file that is the first place an operator looks. It is now an ERROR record, written before the log it would go to is closed, and the line saying the firewall stopped cleanly is written there too, where it used to be lost the same way.
• Fixed the firewall notifying systemd of readiness and of shutdown while running as a Virtual Registry add-on, where the unit belongs to the Supervisor. Its readiness arrived ahead of the Supervisor’s own, and a firewall that stopped on its own announced that the whole unit was going down.
• Fixed a webhook the endpoint refused being logged as a webhook sent. A refused webhook means the invalidation the reload depends on never happened, and it is now a warning.
• Fixed the admin API failing to bind not being reported anywhere. The error was raised only once the public listener stopped, which for a running firewall never happens, so api_address already in use left the firewall serving traffic with no admin API and nothing in the log about it.
• Fixed a configuration that does not name a deployment having its startup configuration reported as neither standalone nor integrated.

Artifact Firewall 0.5.1 #

Released: 2026-08-21

Changed#

• The OpenTelemetry log modules are held at their previous release, for compatibility with the rest of the Varnish OTel stack. Audit log output is unchanged.

Artifact Firewall 0.5.0 #

Released: 2026-08-20

Added#

• Added support for the RPM ecosystem (yum/dnf/zypper). The firewall rewrites repomd.xml and filters primary.xml, recomputing SHA256 sums so dnf’s integrity check still passes. .rpm downloads are blocked at 403 when a deny rule applies. repo_gpgcheck=0 is required on the client because rewriting repomd invalidates its signature; per-package gpgcheck=1 continues to work. Set preserve_manifest: true to keep the upstream repomd signature intact instead: metadata is then passed through unfiltered, but .rpm downloads are still blocked. Supports uncompressed, gzip, zstd, and xz metadata (bz2 streams through unmodified). filelists.xml/other.xml are left untouched and stream through unchanged.
• A git ruleset source can now take several paths, through a new sub_paths list alongside sub_path, and either may name a directory, which contributes every .yaml/.yml file under it at any depth. Taking six rulesets from a repository such as varnish/osv-rules is now one source that clones and caches it once, where it previously took six sources, each keeping its own copy of the same repository. Rulesets added to a tracked directory later are picked up without a config change.

Changed#

• A git ruleset republished with only a new date: field is no longer reloaded.

Fixed#

• Git ruleset caches are now repacked as fetched objects accumulate. Instead of relying on git’s gc.auto, which does not trigger at low object counts, repacking is now explicitly triggered on total size of dead objects accumulated.
• A git ruleset is now read out of its cache repository instead of being checked out. The cache no longer keeps a second, expanded copy of the ruleset.

Artifact Firewall 0.4.0 #

Released: 2026-07-31

Added#

• Warn when the firewall starts or reloads with no rulesets configured, since it then falls back to applying only the default action to all traffic.
• Git ruleset sources can now authenticate to GitHub with a GitHub App via auth.github_app (a client ID and a private key by path or env). The firewall discovers the App installation from the repository URL, then mints and refreshes short-lived installation tokens automatically. api_base_url supports GitHub Enterprise Server.
• Added Hex (Erlang/Elixir) support, including JFrog Artifactory’s Hex repository prefix. Hex’s package manifest (/packages/<name>) is a signed protobuf payload that the client cryptographically verifies, so unlike PyPI/NuGet/Maven, denied or vulnerable versions can’t be filtered out of it (any change to the payload breaks the signature and hex_core rejects the response outright); enforcement is instead a per-tarball allow/deny check on download.
• OpenTelemetry metrics exporter configured via a top-level otel: block whose schema matches Varnish Supervisor’s, so the same config works standalone or integrated. otel.metrics.exporter selects otlp (push) or prometheus (scrape). Standalone stands up its own OTel SDK. Integrated reuses Supervisor’s MeterProvider, where firewall metrics appear under instrumentation scope artifact-firewall.
• OpenTelemetry tracing over OTLP, configured under otel.tracing (off until enabled with an endpoint). Per request the firewall emits an HTTP server span, a firewall.proxy span, a firewall.transform_manifest span, and an upstream client span. The admin /api/eval endpoint emits a firewall.evaluate span with the rule decision. Inbound W3C traceparent headers are honored and propagated upstream. Standalone stands up its own TracerProvider. Integrated reuses Supervisor’s.
• Audit log export over OpenTelemetry logs. Set audit_log_output: otel to export the audit log through the OTel logs pipeline (configured under otel.logs) instead of JSON. Each entry becomes an OTel log record under its own scope artifact-firewall/audit (fields as attributes, severity by action), correlated with the request trace. Standalone stands up its own LoggerProvider. Integrated reuses Supervisor’s.
• Process log export over OpenTelemetry logs. Set log_output: otel to export process logs through the OTel logs pipeline under scope artifact-firewall/log. This tees to stderr (startup logs are never lost) and also exports to OTel. log_output is now honored generally (stdout by default, stderr, or a file path), having previously been ignored. File-based process logs are closed on shutdown and reopened on SIGHUP for external rotation, matching the audit log.

Changed#

• Metrics are now configured under otel.metrics instead of the top-level metrics_address. otel.metrics.exporter selects otlp (default, push) or prometheus (scrape endpoint at prometheus_host:prometheus_port, default localhost:9464). In integrated mode the firewall reuses Supervisor’s metrics pipeline.
• Replacing metrics_address: ":9090" takes two settings: an endpoint or exporter: prometheus, since metrics are no longer exported by default, and prometheus_host: "0.0.0.0", since the scrape endpoint now binds loopback only.
• The firewall warns at startup when a signal is enabled with nowhere to export: metrics or tracing without an endpoint, or audit_log_output/log_output set to otel without otel.logs.
• The metrics_address config field is deprecated and inert: it still parses (logging a warning) but has no effect. Configure metrics under otel.metrics.

Fixed#

• Maven: a denied version no longer breaks resolution for packages that are allowed. Maven reads the .pom of every candidate version while resolving version conflicts, including versions it then discards, so returning 403 for a denied .pom failed the whole resolve. .pom files (and Gradle’s .module) now stream through unchanged, and a deny is enforced on the artifact itself whatever its packaging type, so a build that pins a denied version still gets a 403.
• Maven artifacts and manifests served through a JFrog Artifactory repository are now correctly identified, filtered, and rewritten.
• Fixed a race between a git ruleset fetcher rewriting its file and a reload reading it, which could intermittently fail a reload with a misleading YAML parse error.
• The environment variable named by a git ruleset’s auth.token_env is no longer passed to git subprocesses, where the token was readable through /proc/<pid>/environ and by anything git spawned (credential helpers from a system gitconfig, pagers, filters). The token still reaches the remote as an HTTP header.
• A failed audit log reopen on SIGHUP no longer leaves audit logging dead until restart: the new file is opened before the old one is closed, so a failure keeps the existing file in use.
• Closing the audit log no longer races a SIGHUP arriving during shutdown, which could close one file descriptor twice and leak the other.

Artifact Firewall 0.3.6 #

Released: 2026-07-14

Fixed#

• npm, PyPI, and Maven manifests and artifacts served through a Sonatype Nexus Repository are now correctly identified, filtered, and rewritten.

Artifact Firewall 0.3.5 #

Released: 2026-07-10

Fixed#

• PyPI: a file that can’t be mapped to a listed version is now skipped instead of rejecting the entire package (403).
• PyPI: the PEP 503 HTML simple index is now filtered (allow/hide/deny) like the JSON index, instead of streaming through unchanged.
• PyPI: quarantine is now enforced on the HTML simple index when a publish-time source is configured (pypi.api_url).

Artifact Firewall 0.3.4 #

Released: 2026-06-30

Fixed#

• PyPI: fixed package downloads failing (503) in integrated mode when the upstream JSON simple index uses relative URLs (e.g. JFrog Artifactory).
• Maven: a hide verdict no longer returns 403 for a pinned .pom/snapshot; hidden versions are dropped from maven-metadata.xml but a pinned request still resolves, matching npm/PyPI/NuGet. Only deny hard-blocks.

Artifact Firewall 0.3.2 #

Released: 2026-06-13

Fixed#

• Manifests and artifacts served through a JFrog Artifactory virtual repo are now correctly identified, filtered, and rewritten — in both standalone and integrated mode, with no configuration. Previously the package path was assumed to sit at the registry root, so these requests were skipped (“not a transform path”).
  • npm / PyPI: the Artifactory API prefix (.../api/<type>/<repo>/) is stripped before identification.
  • Maven: maven-metadata.xml and .pom files are evaluated against the coordinates in the document body, not the URL path.
  • NuGet: V3 responses are dispatched by resource token (registration / flatcontainer / query / index.json), which match Artifactory’s layout as well as nuget.org’s.
• npm and PyPI manifest responses with a Content-Type the firewall can’t filter (an Artifactory vnd.rt npm variant, a charset parameter, or a PyPI HTML simple index) now stream through unchanged instead of returning an error.

Artifact Firewall 0.3.1 #

Released: 2026-06-03

Fixed#

• Fixed rule engine initialization issue when only git fetchers are used. Issue was introduced in 0.3.0.

Artifact Firewall 0.3.0 #

Released: 2026-06-02

Added#

• Standalone deployment mode, now the default. The firewall sits directly in front of one or more origin registries and routes requests itself.
• Automatic detection of registry from the Accept header, User-Agent prefix, and URL path pattern. Requests that can’t be classified stream through unchanged.
• Per-version artifact preflight: direct downloads of tarballs (npm .tgz), wheels/sdists (PyPI), and .nupkg files are blocked at 403 when a per-version deny rule applies, preventing bypass via hard-coded artifact URLs.
• Added support for the Maven ecosystem: maven-metadata.xml manifest filtering (artifact-level and per-version SNAPSHOT), plus per-artifact preflight on .jar, .pom, .war, .aar, .zip (including classifier variants).
• New api_address config field. The admin API (/api/eval, /api/update, /api/mode) listens on this address only when set.
• System-tests added under system_test/ (Docker-based mock origins for npm, PyPI, and NuGet plus a long-lived dotnet runtime container) covering both deployment modes.
• Added storage configuration section for defining the path cloned git repositories should be stored at, as well as a size limit.
• API now allows rules to be disabled at run time

Changed#

• /api/eval response shape is now structured JSON: {action, rule_id, ruleset_id, reason}, plus an error field on deny only (containing a human-readable message that npm-style clients display).
• Admin endpoints no longer use the /fw/ prefix and are served on api_address only.
• deployment: defaults to standalone; the Supervisor sets integrated explicitly when running the firewall as a Virtual Registry add-on.

Removed#

• The legacy pkg/nuget/e2e harness and its nuget-e2e Make target. NuGet coverage now lives in the shared system_test/ suite.

Artifact Firewall 0.2.2 #

Released: 2026-05-11

Added#

• Added support for the NuGet ecosystem
• Added a mode option to the Artifact Firewall configuration, which can change the behavior of the firewall. Includes normal (default), hide and report.

Changed#

• Audit log now includes an effective_action field, which for modes other than normal can be different than the action field.
• Changed log level for some chatty package quarantine logs to debug.

Artifact Firewall 0.1.1 #

Released: 2026-04-21

Added#

• Initial release.