From 006099bc00ea37ec56e7b8f137d76ab483ed9940 Mon Sep 17 00:00:00 2001 From: Amith211 Date: Sun, 18 Oct 2026 16:34:24 +0100 Subject: [PATCH] (Allowlist) Add MyGet CDN for NuGet package downloads Add mgcdn-main2.azureedge.net as a derived host for MyGet registries to permit package downloads redirected to the CDN. Add a regression test to verify the URL derivation. --- internal/handlers/egress_allowlist_defaults.yaml | 4 ++++ internal/handlers/egress_allowlist_test.go | 2 ++ 2 files changed, 6 insertions(+) diff --git a/internal/handlers/egress_allowlist_defaults.yaml b/internal/handlers/egress_allowlist_defaults.yaml index 5963862..244dfe2 100644 --- a/internal/handlers/egress_allowlist_defaults.yaml +++ b/internal/handlers/egress_allowlist_defaults.yaml @@ -192,6 +192,10 @@ registry_redirect_derivations: - credential_host: nuget.telerik.com derived: - downloads.cdn.telerik.com + # MyGet feeds redirect package downloads to their CDN + - credential_host: .myget.org + derived: + - mgcdn-main2.azureedge.net # ecosystem_default_domains lists the public registry and CDN hosts each # Dependabot ecosystem needs. The map is kept keyed by ecosystem for provenance diff --git a/internal/handlers/egress_allowlist_test.go b/internal/handlers/egress_allowlist_test.go index fc77fea..e075476 100644 --- a/internal/handlers/egress_allowlist_test.go +++ b/internal/handlers/egress_allowlist_test.go @@ -1072,6 +1072,8 @@ func TestEgressDefaults_RegistryRedirectDerivationsLoadedFromYAML(t *testing.T) registryRedirectHosts([]string{"pypi.fury.io"})) assert.Equal(t, []string{"downloads.cdn.telerik.com"}, registryRedirectHosts([]string{"nuget.telerik.com"})) + assert.Equal(t, []string{"mgcdn-main2.azureedge.net"}, + registryRedirectHosts([]string{"www.myget.org"})) } func TestValidateRegistryRedirectDerivations_RejectsUnmatchableEntries(t *testing.T) {