Artifact Firewall 0.8.0

Released: 2026-10-22

Added

A standalone firewall requires a license (license.file or license.text): a Varnish Artifact Firewall license, or a Varnish Enterprise license with the sup-firewall addon. It refuses to start without one, and honours the license’s expiration, no_restart and shutdown dates as varnishd does. A Varnish Artifact Firewall license with a version line only licenses that exact firewall version.
The audit log covers proxy traffic: every identified download, and every listing the firewall altered. Downloads are checked in every mode, but only normal refuses.
Audit decisions say whether a version was dropped, flagged or quarantined, and a listing served from cache is audited with cached and decided_at.
New firewall_audit_entries_total metric, labelled by result (written/failed). Nothing is counted while audit logging is off.

An audit_log_output file that cannot be opened now stops the firewall from starting. It used to start with audit logging off.

Fixed a Go rule whose version range has no v, such as vers:go/<1.64.0 as every OSV advisory writes it, never matching, because the go command always asks for v1.63.0. A range written with the v, such as vers:go/>=v1.2.0, also wrongly missed a version without it. Go ranges and versions now compare the same with or without the v.
A standalone firewall that fails to start because a ruleset cannot be loaded now sends that error to the OpenTelemetry collector. It was only written to stderr before.
Fixed the firewall trusting the compromised eMudhra intermediate CAs.