Changelog

Artifact Firewall 0.6.0 #

Released: 2026-09-09

Added#

• The startup line and --version now carry the revision the binary was built from, as stamped by the Go toolchain, suffixed -dirty for a build off a modified tree. It is omitted when the build carries no stamp.
• Go modules (GOPROXY protocol) are now a supported ecosystem: @v/list, @v/<version>.{info,mod,zip}, and @latest requests are identity-extracted, evaluated against rulesets, and allowed/hidden/denied like any other package type. @v/list is content-filtered to drop denied/hidden versions; .info/.mod are gated without altering their bytes, so GOSUMDB verification keeps working through the firewall. See the README for the GOPROXY single-entry requirement (no ,direct fallback) that this protection depends on.
• Added support for the Conda ecosystem. Denied packages are stripped from repodata.json, and .conda/.tar.bz2 downloads are blocked at 403; repodata that can’t be filtered (.bz2, CEP-16 shards) falls back to 404, and unparseable repodata fails open (streamed through unfiltered) since the artifact preflight still blocks a denied package’s download regardless. The channel is the purl namespace (pkg:conda/<channel>/<name>@<version>). Fetching a conda-forge-scale index needs max_manifest_size raised above the 64MiB default.

Changed#

• Reworked what the firewall logs. Startup records the version and the revision it was built from, the config file it read, and the configuration itself as every setting that differs from the defaults, so a log says what a firewall was running without its files having to be found. A ruleset reload names the rulesets that changed instead of counting them, and INFO is reserved for state changes rather than a line before and another after each one. A credential in firewall.webhook.headers is no longer written to the log.

Fixed#

• Fixed the reason a firewall would not start being written to stdout instead of to the log, so it was missing from the log_output file that is the first place an operator looks. It is now an ERROR record, written before the log it would go to is closed, and the line saying the firewall stopped cleanly is written there too, where it used to be lost the same way.
• Fixed the firewall notifying systemd of readiness and of shutdown while running as a Virtual Registry add-on, where the unit belongs to the Supervisor. Its readiness arrived ahead of the Supervisor’s own, and a firewall that stopped on its own announced that the whole unit was going down.
• Fixed a webhook the endpoint refused being logged as a webhook sent. A refused webhook means the invalidation the reload depends on never happened, and it is now a warning.
• Fixed the admin API failing to bind not being reported anywhere. The error was raised only once the public listener stopped, which for a running firewall never happens, so api_address already in use left the firewall serving traffic with no admin API and nothing in the log about it.
• Fixed a configuration that does not name a deployment having its startup configuration reported as neither standalone nor integrated.

Artifact Firewall 0.5.1 #

Released: 2026-08-21

Changed#

• The OpenTelemetry log modules are held at their previous release, for compatibility with the rest of the Varnish OTel stack. Audit log output is unchanged.

Artifact Firewall 0.5.0 #

Released: 2026-08-20

Added#

• Added support for the RPM ecosystem (yum/dnf/zypper). The firewall rewrites repomd.xml and filters primary.xml, recomputing SHA256 sums so dnf’s integrity check still passes. .rpm downloads are blocked at 403 when a deny rule applies. repo_gpgcheck=0 is required on the client because rewriting repomd invalidates its signature; per-package gpgcheck=1 continues to work. Set preserve_manifest: true to keep the upstream repomd signature intact instead: metadata is then passed through unfiltered, but .rpm downloads are still blocked. Supports uncompressed, gzip, zstd, and xz metadata (bz2 streams through unmodified). filelists.xml/other.xml are left untouched and stream through unchanged.
• A git ruleset source can now take several paths, through a new sub_paths list alongside sub_path, and either may name a directory, which contributes every .yaml/.yml file under it at any depth. Taking six rulesets from a repository such as varnish/osv-rules is now one source that clones and caches it once, where it previously took six sources, each keeping its own copy of the same repository. Rulesets added to a tracked directory later are picked up without a config change.

Changed#

• A git ruleset republished with only a new date: field is no longer reloaded.

Fixed#

• Git ruleset caches are now repacked as fetched objects accumulate. Instead of relying on git’s gc.auto, which does not trigger at low object counts, repacking is now explicitly triggered on total size of dead objects accumulated.
• A git ruleset is now read out of its cache repository instead of being checked out. The cache no longer keeps a second, expanded copy of the ruleset.

Artifact Firewall 0.4.0 #

Released: 2026-07-31

Added#

• Warn when the firewall starts or reloads with no rulesets configured, since it then falls back to applying only the default action to all traffic.
• Git ruleset sources can now authenticate to GitHub with a GitHub App via auth.github_app (a client ID and a private key by path or env). The firewall discovers the App installation from the repository URL, then mints and refreshes short-lived installation tokens automatically. api_base_url supports GitHub Enterprise Server.
• Added Hex (Erlang/Elixir) support, including JFrog Artifactory’s Hex repository prefix. Hex’s package manifest (/packages/<name>) is a signed protobuf payload that the client cryptographically verifies, so unlike PyPI/NuGet/Maven, denied or vulnerable versions can’t be filtered out of it (any change to the payload breaks the signature and hex_core rejects the response outright); enforcement is instead a per-tarball allow/deny check on download.
• OpenTelemetry metrics exporter configured via a top-level otel: block whose schema matches Varnish Supervisor’s, so the same config works standalone or integrated. otel.metrics.exporter selects otlp (push) or prometheus (scrape). Standalone stands up its own OTel SDK. Integrated reuses Supervisor’s MeterProvider, where firewall metrics appear under instrumentation scope artifact-firewall.
• OpenTelemetry tracing over OTLP, configured under otel.tracing (off until enabled with an endpoint). Per request the firewall emits an HTTP server span, a firewall.proxy span, a firewall.transform_manifest span, and an upstream client span. The admin /api/eval endpoint emits a firewall.evaluate span with the rule decision. Inbound W3C traceparent headers are honored and propagated upstream. Standalone stands up its own TracerProvider. Integrated reuses Supervisor’s.
• Audit log export over OpenTelemetry logs. Set audit_log_output: otel to export the audit log through the OTel logs pipeline (configured under otel.logs) instead of JSON. Each entry becomes an OTel log record under its own scope artifact-firewall/audit (fields as attributes, severity by action), correlated with the request trace. Standalone stands up its own LoggerProvider. Integrated reuses Supervisor’s.
• Process log export over OpenTelemetry logs. Set log_output: otel to export process logs through the OTel logs pipeline under scope artifact-firewall/log. This tees to stderr (startup logs are never lost) and also exports to OTel. log_output is now honored generally (stdout by default, stderr, or a file path), having previously been ignored. File-based process logs are closed on shutdown and reopened on SIGHUP for external rotation, matching the audit log.

Changed#

• Metrics are now configured under otel.metrics instead of the top-level metrics_address. otel.metrics.exporter selects otlp (default, push) or prometheus (scrape endpoint at prometheus_host:prometheus_port, default localhost:9464). In integrated mode the firewall reuses Supervisor’s metrics pipeline.
• Replacing metrics_address: ":9090" takes two settings: an endpoint or exporter: prometheus, since metrics are no longer exported by default, and prometheus_host: "0.0.0.0", since the scrape endpoint now binds loopback only.
• The firewall warns at startup when a signal is enabled with nowhere to export: metrics or tracing without an endpoint, or audit_log_output/log_output set to otel without otel.logs.
• The metrics_address config field is deprecated and inert: it still parses (logging a warning) but has no effect. Configure metrics under otel.metrics.

Fixed#

• Maven: a denied version no longer breaks resolution for packages that are allowed. Maven reads the .pom of every candidate version while resolving version conflicts, including versions it then discards, so returning 403 for a denied .pom failed the whole resolve. .pom files (and Gradle’s .module) now stream through unchanged, and a deny is enforced on the artifact itself whatever its packaging type, so a build that pins a denied version still gets a 403.
• Maven artifacts and manifests served through a JFrog Artifactory repository are now correctly identified, filtered, and rewritten.
• Fixed a race between a git ruleset fetcher rewriting its file and a reload reading it, which could intermittently fail a reload with a misleading YAML parse error.
• The environment variable named by a git ruleset’s auth.token_env is no longer passed to git subprocesses, where the token was readable through /proc/<pid>/environ and by anything git spawned (credential helpers from a system gitconfig, pagers, filters). The token still reaches the remote as an HTTP header.
• A failed audit log reopen on SIGHUP no longer leaves audit logging dead until restart: the new file is opened before the old one is closed, so a failure keeps the existing file in use.
• Closing the audit log no longer races a SIGHUP arriving during shutdown, which could close one file descriptor twice and leak the other.

Artifact Firewall 0.3.6 #

Released: 2026-07-14

Fixed#

• npm, PyPI, and Maven manifests and artifacts served through a Sonatype Nexus Repository are now correctly identified, filtered, and rewritten.

Artifact Firewall 0.3.5 #

Released: 2026-07-10

Fixed#

• PyPI: a file that can’t be mapped to a listed version is now skipped instead of rejecting the entire package (403).
• PyPI: the PEP 503 HTML simple index is now filtered (allow/hide/deny) like the JSON index, instead of streaming through unchanged.
• PyPI: quarantine is now enforced on the HTML simple index when a publish-time source is configured (pypi.api_url).

Artifact Firewall 0.3.4 #

Released: 2026-06-30

Fixed#

• PyPI: fixed package downloads failing (503) in integrated mode when the upstream JSON simple index uses relative URLs (e.g. JFrog Artifactory).
• Maven: a hide verdict no longer returns 403 for a pinned .pom/snapshot; hidden versions are dropped from maven-metadata.xml but a pinned request still resolves, matching npm/PyPI/NuGet. Only deny hard-blocks.

Artifact Firewall 0.3.2 #

Released: 2026-06-13

Fixed#

• Manifests and artifacts served through a JFrog Artifactory virtual repo are now correctly identified, filtered, and rewritten — in both standalone and integrated mode, with no configuration. Previously the package path was assumed to sit at the registry root, so these requests were skipped (“not a transform path”).
  • npm / PyPI: the Artifactory API prefix (.../api/<type>/<repo>/) is stripped before identification.
  • Maven: maven-metadata.xml and .pom files are evaluated against the coordinates in the document body, not the URL path.
  • NuGet: V3 responses are dispatched by resource token (registration / flatcontainer / query / index.json), which match Artifactory’s layout as well as nuget.org’s.
• npm and PyPI manifest responses with a Content-Type the firewall can’t filter (an Artifactory vnd.rt npm variant, a charset parameter, or a PyPI HTML simple index) now stream through unchanged instead of returning an error.

Artifact Firewall 0.3.1 #

Released: 2026-06-03

Fixed#

• Fixed rule engine initialization issue when only git fetchers are used. Issue was introduced in 0.3.0.

Artifact Firewall 0.3.0 #

Released: 2026-06-02

Added#

• Standalone deployment mode, now the default. The firewall sits directly in front of one or more origin registries and routes requests itself.
• Automatic detection of registry from the Accept header, User-Agent prefix, and URL path pattern. Requests that can’t be classified stream through unchanged.
• Per-version artifact preflight: direct downloads of tarballs (npm .tgz), wheels/sdists (PyPI), and .nupkg files are blocked at 403 when a per-version deny rule applies, preventing bypass via hard-coded artifact URLs.
• Added support for the Maven ecosystem: maven-metadata.xml manifest filtering (artifact-level and per-version SNAPSHOT), plus per-artifact preflight on .jar, .pom, .war, .aar, .zip (including classifier variants).
• New api_address config field. The admin API (/api/eval, /api/update, /api/mode) listens on this address only when set.
• System-tests added under system_test/ (Docker-based mock origins for npm, PyPI, and NuGet plus a long-lived dotnet runtime container) covering both deployment modes.
• Added storage configuration section for defining the path cloned git repositories should be stored at, as well as a size limit.
• API now allows rules to be disabled at run time

Changed#

• /api/eval response shape is now structured JSON: {action, rule_id, ruleset_id, reason}, plus an error field on deny only (containing a human-readable message that npm-style clients display).
• Admin endpoints no longer use the /fw/ prefix and are served on api_address only.
• deployment: defaults to standalone; the Supervisor sets integrated explicitly when running the firewall as a Virtual Registry add-on.

Removed#

• The legacy pkg/nuget/e2e harness and its nuget-e2e Make target. NuGet coverage now lives in the shared system_test/ suite.

Artifact Firewall 0.2.2 #

Released: 2026-05-11

Added#

• Added support for the NuGet ecosystem
• Added a mode option to the Artifact Firewall configuration, which can change the behavior of the firewall. Includes normal (default), hide and report.

Changed#

• Audit log now includes an effective_action field, which for modes other than normal can be different than the action field.
• Changed log level for some chatty package quarantine logs to debug.

Artifact Firewall 0.1.1 #

Released: 2026-04-21

Added#

• Initial release.