getnora-io/nora v1.1.0 on GitHub

NORA 1.1.0

A feature release over 1.0.1: the last two hosted-only formats (rpm/deb) gain pull-through proxy + offline mirror, retention now covers rpm/deb/raw, OIDC namespace scoping gets per-rule granularity, a geo/policy-blocked upstream becomes observable, plus a batch of proxy, health and storage fixes.

Added

Pull-through proxy and offline mirror for rpm and deb — the last two hosted-only formats gain the proxy mode every other format has. A repository name maps to a single upstream ([rpm.proxies]/[deb.proxies], string or { url, auth }); a proxied repo is read-only, upstream metadata is served verbatim within metadata_ttl, packages are cached immutably, and a down upstream serves the stale cache with x-nora-stale: true. nora mirror rpm --repo <name> / nora mirror deb --repo <name> pre-fetch a whole repo through the proxy so dnf/apt work air-gapped. (#864)
Retention over rpm, deb, and raw — the three formats retention previously skipped. rpm/deb versions are grouped per {repo}/{arch}/{package} (structured deb per distribution × component), raw per depth-2 path prefix; touched indexes are rebuilt and re-signed under the publish lock. New optional name_glob targets groups within a registry. (#848)
Per-rule namespace scope for OIDC role rules, plus intra-segment * wildcards in namespace_scope — a role_rules entry can narrow the provider scope (a write must satisfy both; a rule can't widen past the provider ceiling), and patterns now support * within a path segment. (#854, #861)
A geo/policy-blocked upstream is now observable — a proxied upstream 4xx carrying a policy/geo block signature (x-amzn-waf-reason) emits a warn log and a nora_upstream_policy_blocked_total{registry,reason} metric, instead of being silently indistinguishable from a genuine not-found. The 404 relay and the circuit breaker are unchanged (a policy block isn't an availability failure). (#881)

Fixed

Scoped npm packages round-trip on S3 / object_store backends — encode_object_key's @→%40 was double-encoded to %2540 by object_store::path::Path, so a scoped package's packument regenerated empty (npm install → ENOVERSIONS) even though the version files were stored correctly. Reproduced on MinIO, SeaweedFS, RustFS and Garage; the local-filesystem backend was unaffected. Publish also now fails closed if the just-published version isn't visible in the regenerated packument. (#878)
Ansible collections with more than 100 versions install through the proxy — galaxy_ng's host-relative pagination links are now rewritten under the /ansible mount, so page 2+ no longer 404s (e.g. community.docker, 148 versions). (#875)
Docker serves locally-pushed manifests without upstream revalidation (#868), and registries.enable back-propagates to the per-registry flags so an enable-set no longer leaves rpm/deb returning 404 (#863).
Health: cached object-store reachability self-expires if the refresh loop stalls (#874); /health and /ready no longer probe object storage (#869).
Cargo sparse index advertises auth-required on private deployments so cargo authenticates index/download requests (#857); retention and GC schedulers run once at boot instead of waiting a full interval (#859, #860).

Thanks 🤝

Joe Grund (@jgrund) — the rpm/deb pull-through proxy + offline mirror, retention across rpm/deb/raw, per-rule OIDC namespace scoping, the health and cargo/docker fixes, and more.
@bas2k — the Ansible >100-version pagination fix (#875).

Install

# x86_64
curl -LO https://github.com/getnora-io/nora/releases/download/v1.1.0/nora-linux-amd64
chmod +x nora-linux-amd64 && sudo mv nora-linux-amd64 /usr/local/bin/nora

# ARM64 (Apple Silicon, Graviton, Ampere)
curl -LO https://github.com/getnora-io/nora/releases/download/v1.1.0/nora-linux-arm64
chmod +x nora-linux-arm64 && sudo mv nora-linux-arm64 /usr/local/bin/nora

Docker

docker pull getnora/nora:1.1.0

Helm

helm repo add nora https://getnora-io.github.io/helm-charts
helm repo update
helm install nora nora/nora   # chart 0.4.4, appVersion 1.1.0

Full changelog: v1.0.1...v1.1.0