artifact-keeper/artifact-keeper-web v1.10.1

Artifact Keeper Web 1.10.1

on GitHub

Fixed

• Proxy-cached artifacts no longer show a green all-clear, and their scan-on-proxy verdicts are visible (#788, #828, #790, backend artifact-keeper#3394 / #1274) - the artifact Security tab rendered a green ShieldCheck reading "No vulnerabilities detected for this artifact" whenever its finding total was zero, and for proxy-cached content that total is structurally always zero: the tab's sources (CVE history, scan_findings, Dependency-Track) are all artifact-keyed and proxy content has no artifacts row. An artifact the download gate had just refused with a 403 therefore displayed an all-clear. The all-clear now requires both halves of the evidence — an artifact-keyed scan actually ran (1.10.0's hasEverBeenScanned) and the artifact is one those sources can describe at all — and proxy-cached artifacts instead get a verdict panel driven by GET /api/v1/repositories/{key}/security/proxy-scans?path=…, whose copy is conditioned on the repository's own scan_on_proxy / proxy_scan_action so vulnerable never implies "blocked" in a fail-open repository. The repository Security tab gains a proxy-cache scan summary (clean / vulnerable / not-scanned / pending-ingest / distinct-digest counts) and the cached-path listing behind it, because counts alone answer "3 vulnerable digests" but not which ones; it is visible to any authenticated user with repository visibility, matching the endpoint's own authorization, while the scan-config form beside it stays admin-only. The artifact SBOM tab serves the proxy-cache inventory from GET /api/v1/repositories/{key}/security/proxy-sbom (CycloneDX or SPDX) instead of a permanently disabled Generate button. Throughout, nothing unproven renders as clean: a 401 says "Sign in to view" rather than showing zero findings (these pages sit outside the (protected) route group, so anonymous viewers reach them on public repositories), an unresolvable cache path renders as unknown, an absent SBOM inventory is its own state rather than a zero-row component table, a pending_ingest catalog row is reported as having no content digest to look a verdict up by, and a suppressed finding count stays null instead of being coalesced to 0. Per-CVE detail is listed when the backend records it (artifact-keeper#3395) and named as not-recorded when it does not. Also corrects copy that claimed proxy-cached artifacts cannot be scanned — PyPI, npm and Docker/OCI proxies do scan at download time when scan-on-proxy is enabled; only SBOM generation and on-demand scans are hosted-only.
• Scan on proxy is only offered on the formats the backend actually gates (backend artifact-keeper#1274) - both repository surfaces that carry the setting — the Scan on Proxy switch on the Security tab and Scan on proxy download in the Settings tab's Scanning & enforcement card — offered it as an enableable control for every Remote and Virtual repository, but backend 1.10.0 enforces the inline scan-and-block gate in exactly four request handlers: api/handlers/npm.rs (/npm), api/handlers/pypi.rs (/pypi), api/handlers/oci_v2.rs (/v2) and api/handlers/vscode.rs (/vscode, new in 1.10.0). Every other format stores scan_on_proxy, logs "scan_on_proxy enabled but unsupported for this format" and serves the proxied bytes unscanned — so an operator who switched it on for a Maven, Cargo, Helm, Go, Debian, RPM, Conda or Composer remote believed proxied artifacts were being scanned when nothing was. The enforced set is now a single source of truth, SCAN_ON_PROXY_GATED_FORMATS / supportsScanOnProxy in src/lib/scan-on-proxy-formats.ts — hasProxyScanSummary (which decides whether the Security tab shows the proxy scan verdicts panel) delegates to it instead of keeping a second hardcoded list, so the panel and the toggle can never disagree. Derived from the backend route table and the handler_key / get_handler_for_format alias mapping: npm / yarn / pnpm / bower, pypi / poetry / jupyter, docker / podman / buildx / oras / wasm_oci / helm_oci, and vscode. Note the two traps the alias table hides: conda shares the PyPI format handler but is served by its own ungated /conda router, and helm (ChartMuseum) is a different handler from helm_oci (OCI). On a proxying repository of any other format both switches now render disabled with the reason, while a stored true stays switchable so an operator can turn the illusion off; gated formats gain a one-line pointer to the repository's proxy scan verdicts. The wording itself lives in one shared ScanOnProxyNote component so the two surfaces cannot drift. Hosted (Local/Staging) repositories are unchanged, and the request payload is unchanged. Folding the two lists together also widened the verdicts panel to the alias formats it had been missing (yarn / pnpm / bower, served by npm.rs; poetry / jupyter, served by pypi.rs).

What's Changed

• feat(analysis): package content analysis tab, and stop rendering unscanned as clean by @brandonrc in #883
• fix(security): show proxy scan-on-proxy verdicts and drop the green all-clear on proxy-cached artifacts by @brandonrc in #789
• fix(repositories): only offer scan-on-proxy on formats the backend gates by @brandonrc in #889
• chore(release): web 1.10.1 prep — CHANGELOG + version bump by @brandonrc in #890

Full Changelog: v1.10.0...v1.10.1