Artifact Keeper 1.11.9

A maintenance release on the 1.11 line: 6 changelog entries from 8 pull requests since 1.11.8, all on the line in #5039, #5044, #5048, #5051, #5052, #5056, #5059 and #5060. The headlines are tokens exchanged through CI OIDC now live the configured access-token TTL (#5054, in #5057), so GitHub Actions jobs no longer get 401 after about five minutes, and a virtual conda channel's package allowlist now applies to its hosted members too (#5055, in #5058). The allowlist change can hide hosted packages from a channel on upgrade; read the upgrade notes below before upgrading if you use conda allowlists. Next to them: proxy scan verdict reuse under fail_closed is tighter, proxied archives that repeat an entry path are refused before the identity check, and the bundled grype and the scanner adapter's trivy link go-jose v4.1.6. No schema migrations (the line stays at migration 289) and no new settings.

Upgrade impact: conda virtual channel allowlists

On a virtual conda channel with an enabled package allowlist, hosted (local and staging) packages that are not on the list disappear from that channel after the upgrade: from its index and from downloads through it. Before 1.11.9 the list filtered only remote members.

Before upgrading, check each virtual conda channel that has an allowlist, and either:

• add the hosted packages the channel should keep serving to its allowlist, or
• restore the old behaviour for that channel with PUT /api/v1/repositories/{key}/allowlist and "scope": "remote_only" (the new default is all_members; a request that omits scope keeps the stored scope).

The hosted repositories themselves keep serving those packages directly. Channels without an allowlist are unaffected.

What changed

• CI OIDC exchanges mint a token that lives the configured access-token TTL (#5054, in #5057). POST /api/v1/auth/ci/token capped the minted token at the presented ID token's own expiry, so every token exchanged from GitHub Actions stopped working after about five minutes, whatever TTL was configured, and longer build steps failed with 401. The ID token now only has to be valid when it is exchanged, and the minted token lives JWT_ACCESS_TOKEN_EXPIRY_MINUTES, at most one hour. An expired ID token is still refused, mapping ceilings and group bindings still apply, and a CI session still cannot be refreshed or mint API tokens. kubernetes providers are unchanged. Jobs that run longer than the TTL exchange a fresh ID token; see docs/ci-oidc.md. 1.12.0 makes the lifetime a per-provider setting.
• A virtual conda channel's package allowlist applies to hosted members (#5055, in #5058). The list is now the channel's boundary for every member, in every index form the virtual serves (repodata.json plain, .zst and .bz2, the CEP-16 shard index and shards, current_repodata.json, run_exports.json, channeldata.json) and on package and attestation-sidecar downloads through the virtual, with the same matching rules as before. A hosted package the list does not admit still owns its name, so upstream packages of that name stay excluded. See the upgrade impact above.
• A clean proxy verdict that graded no components is no longer reused under fail_closed (#3396, in #5043 and #5056). Such a verdict says only that the scan saw nothing it could grade, so a fail_closed download scans the bytes again as for a first pull. A conda download still reuses one that a conda repository recorded, so a conda package with no gradable content (such as tzdata) is scanned on its first fail_closed pull only. A rescan in a repository whose format does not scan on proxy (for example generic) that catalogs and finds nothing now answers 503 RESCAN_SCAN_FAILED and records no verdict.
• Proxied package archives with two entries at one path are refused before the scan-on-proxy identity check (#5050). An archive whose non-directory entries repeat a path no longer establishes an identity: under fail_closed it is withheld (423) and under fail_open it is served pending, as an unreadable archive is. A survey of 1,282 published packages across seven ecosystems found no outer archive with a repeated path.

Security

• go-jose v4.1.6 in the bundled grype and the scanner adapter's trivy, published as scanner adapter 1.5.2 (#5041, in #5042 and #5049). The adapter's trivy moves to ghcr.io/artifact-keeper/trivy:0.76.0-r3, the same upstream Trivy v0.76.0 with the go-jose update. The Trivy release is unchanged, so a self-run Trivy server stays on 0.76.0.
• pulldown-cmark moved to 0.13.5 (#5038). A build-time dependency of prost-build, not linked into the backend; this clears a dependency audit finding with no runtime change.

Upgrade notes

There is no migration and no new or changed setting. Beyond the conda allowlist change above, two behaviours operators may notice:

• Tokens from the CI OIDC exchange now last the configured access-token TTL (at most one hour) instead of the CI ID token's lifetime. Workarounds that re-exchanged before every step keep working and can be dropped.
• Under fail_closed, bytes whose stored clean verdict cataloged no components are scanned again on download instead of being served from that verdict.

The full entries are in the ## [1.11.9] section of CHANGELOG.md.

Sponsors

Thank you to our sponsors for supporting ongoing development of Artifact Keeper.

Backers

• Advailo, SIA (@advailo)
• stringke (@StringKe)
• Ash A. (@dragonpaw)
• Mike (@huylv95)
• Gabriel Rodriguez (@injectedfusion)
• Narek Engibaryan (@narek01)
• and one sponsor who chose to stay private

Become a sponsor to support the project and get your name listed here.

Full changelog: v1.11.8...v1.11.9