apple / apple/containerization

[Request]: Configurable redirect policy for registry requests.

Open
#907 0 comments 0 reactions 0 assignees View on GitHub
network
Dominant language
Swift
Stars
8.9k
Forks
359
Avg merge
2d 20h
Merged PRs (30d)
13

Description

### Feature or enhancement request details

We could enhance `RegistryClient` such that a caller could:

- Disallow all redirects.
- Limit redirects to a maximum number of hops (the limit is 5 today, which is determined by the `HTTPClient.Configuration.RedirectConfiguration` default).
- Allow or deny a redirect response depending on the original requests HTTP method, original URL, and the current URL and hop count.

The default policy should should interoperate with all widely used repos (Docker Hub, AWS, Google Cloud, GitHub, Azure, Quay, Oracle, etc.)

The enhancement should provide a helper for identifying loopback, RFC1918, and link-local redirects for both IPv4 and IPv6.

Please do not send a PR for this issue before first proposing and refining a design in the issue comments. At that point we can assign you for the PR work.

### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

Contributor guide

Open the contributing guide

Research direction

Start by reviewing RegistryClient and HTTPClient.Configuration.RedirectConfiguration, especially the current five-hop default. Propose and refine the redirect-policy design in the issue comments before implementation, covering disabled redirects, hop limits, request and URL-based decisions, and loopback, RFC1918, and link-local detection for IPv4 and IPv6. Done means an agreed design that preserves compatibility with the listed registries.

Written by the indexing model from the issue text.

Assessment

Tech stack
swift
Domain
networking, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.