kevinveenbirkenbachandClaude Opus 5.5 9041098c90 fix(cache): stop validating content types on the raw package proxies ...

The package cache creates every Nexus proxy with
strictContentTypeValidation. A raw proxy has no type contract, and Nexus
cannot type a GPG keybox: on a fresh cache it answers the Node.js release
keyring (raw.githubusercontent.com/nodejs/release-keys/.../pubring.kbx)
with 404 "Content type could not be determined". The Node.js installer
from #1108 fetches that keyring, so on main (run 39668792538) Workspace
debian:13 fails in `make install-lint`, and Workspace ubuntu, centos and
manjaro fail in `test-external`, whose URL check reaches the same file
through the cache.

The four raw proxies (raw-githubusercontent, raw-codeload-github,
raw-packagist, raw-alpine) now share the storage block with validation
switched off. Every typed proxy (apt, pypi, npm, helm, rubygems, go, yum)
keeps strict validation. The installer's integrity check does not depend
on Nexus: it verifies the SHASUMS file with gpgv and the tarball with
SHA-256.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

2026-10-22 00:05:43 +02:00

..

package-frontend

fix(cache): install CA anchors where every update-ca-trust family reads them

2026-10-15 23:45:53 +02:00

package.sh

fix(cache): stop validating content types on the raw package proxies

2026-10-22 00:05:43 +02:00

registry-ca.sh

fix(cache): install CA anchors where every update-ca-trust family reads them

2026-10-15 23:45:53 +02:00