apple / apple/containerization
[Request]: Configurable redirect policy for registry requests.
- Dominant language
- Swift
- Stars
- 8.9k
- Forks
- 359
- Avg merge
- 2d 20h
- Merged PRs (30d)
- 13
Description
### Feature or enhancement request details
We could enhance `RegistryClient` such that a caller could:
- Disallow all redirects.
- Limit redirects to a maximum number of hops (the limit is 5 today, which is determined by the `HTTPClient.Configuration.RedirectConfiguration` default).
- Allow or deny a redirect response depending on the original requests HTTP method, original URL, and the current URL and hop count.
The default policy should should interoperate with all widely used repos (Docker Hub, AWS, Google Cloud, GitHub, Azure, Quay, Oracle, etc.)
The enhancement should provide a helper for identifying loopback, RFC1918, and link-local redirects for both IPv4 and IPv6.
Please do not send a PR for this issue before first proposing and refining a design in the issue comments. At that point we can assign you for the PR work.
### Code of Conduct
- [x] I agree to follow this project's Code of Conduct
Contributor guide
Research direction
Start by reviewing RegistryClient and HTTPClient.Configuration.RedirectConfiguration, especially the current five-hop default. Propose and refine the redirect-policy design in the issue comments before implementation, covering disabled redirects, hop limits, request and URL-based decisions, and loopback, RFC1918, and link-local detection for IPv4 and IPv6. Done means an agreed design that preserves compatibility with the listed registries.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- swift
- Domain
- networking, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100