Artifact Firewall 0.6.0

Released: 2026-09-09

Added

The startup line and --version now carry the revision the binary was built from, as stamped by the Go toolchain, suffixed -dirty for a build off a modified tree. It is omitted when the build carries no stamp.
Go modules (GOPROXY protocol) are now a supported ecosystem: @v/list, @v/<version>.{info,mod,zip}, and @latest requests are identity-extracted, evaluated against rulesets, and allowed/hidden/denied like any other package type. @v/list is content-filtered to drop denied/hidden versions; .info/.mod are gated without altering their bytes, so GOSUMDB verification keeps working through the firewall. See the README for the GOPROXY single-entry requirement (no ,direct fallback) that this protection depends on.
Added support for the Conda ecosystem. Denied packages are stripped from repodata.json, and .conda/.tar.bz2 downloads are blocked at 403; repodata that can’t be filtered (.bz2, CEP-16 shards) falls back to 404, and unparseable repodata fails open (streamed through unfiltered) since the artifact preflight still blocks a denied package’s download regardless. The channel is the purl namespace (pkg:conda/<channel>/<name>@<version>). Fetching a conda-forge-scale index needs max_manifest_size raised above the 64MiB default.

Reworked what the firewall logs. Startup records the version and the revision it was built from, the config file it read, and the configuration itself as every setting that differs from the defaults, so a log says what a firewall was running without its files having to be found. A ruleset reload names the rulesets that changed instead of counting them, and INFO is reserved for state changes rather than a line before and another after each one. A credential in firewall.webhook.headers is no longer written to the log.

Fixed the reason a firewall would not start being written to stdout instead of to the log, so it was missing from the log_output file that is the first place an operator looks. It is now an ERROR record, written before the log it would go to is closed, and the line saying the firewall stopped cleanly is written there too, where it used to be lost the same way.
Fixed the firewall notifying systemd of readiness and of shutdown while running as a Virtual Registry add-on, where the unit belongs to the Supervisor. Its readiness arrived ahead of the Supervisor’s own, and a firewall that stopped on its own announced that the whole unit was going down.
Fixed a webhook the endpoint refused being logged as a webhook sent. A refused webhook means the invalidation the reload depends on never happened, and it is now a warning.
Fixed the admin API failing to bind not being reported anywhere. The error was raised only once the public listener stopped, which for a running firewall never happens, so api_address already in use left the firewall serving traffic with no admin API and nothing in the log about it.
Fixed a configuration that does not name a deployment having its startup configuration reported as neither standalone nor integrated.