From 50a9795aff3979e502fc5046b762ced271f53a45 Mon Sep 17 00:00:00 2001 From: hoshi <95334603+hoshi-vo@users.noreply.github.com> Date: Wed, 14 Oct 2026 13:16:50 +0900 Subject: [PATCH] Allowlist sf16-fe-tos-sg.i18n-pglstatp.com for Swift binary targets Swift update jobs that depend on the Pangle iOS SDK can no longer parse their manifest since egress enforcement was enabled. bytedance/AdsGlobalPackage declares its PAGAdSDK and TikTokBusinessSDK binaryTargets on this host, so SwiftPM fails to resolve the package graph and no Swift PRs are opened. The host is Pangle's anonymous SDK CDN referenced from the vendor's own public Package.swift, with no redirect, so it is added as an exact entry. Co-Authored-By: Claude Opus 5.5 --- internal/handlers/egress_allowlist_defaults.yaml | 5 +++++ internal/handlers/egress_allowlist_test.go | 8 ++++++++ 2 files changed, 13 insertions(+) diff --git a/internal/handlers/egress_allowlist_defaults.yaml b/internal/handlers/egress_allowlist_defaults.yaml index 44c55bd..f72728d 100644 --- a/internal/handlers/egress_allowlist_defaults.yaml +++ b/internal/handlers/egress_allowlist_defaults.yaml @@ -653,5 +653,10 @@ ecosystem_default_domains: # declared in the vendor's own public Package.swift. Anonymous, no redirect. # Exact virtual-hosted bucket; never the path-style s3.amazonaws.com apex. - prelude-public.s3.amazonaws.com + # Pangle's (ByteDance) SDK CDN, serving the PAGAdSDK and TikTokBusinessSDK + # xcframework.zip binaryTargets declared in the vendor's own public + # Package.swift (bytedance/AdsGlobalPackage). Anonymous, no redirect. + # Exact: the rest of i18n-pglstatp.com is not needed and not vetted. + - sf16-fe-tos-sg.i18n-pglstatp.com vcpkg: [] pre_commit: [] diff --git a/internal/handlers/egress_allowlist_test.go b/internal/handlers/egress_allowlist_test.go index f34324a..9227035 100644 --- a/internal/handlers/egress_allowlist_test.go +++ b/internal/handlers/egress_allowlist_test.go @@ -1256,6 +1256,9 @@ func TestEgressAllowlist_PublicVendorRegistriesAllowed(t *testing.T) { "https://sdk.karte.io/ios/swiftpm/Utilities-3.16.0/KarteUtilities-6aa9d244.xcframework.zip", // Same failure mode for the Prelude Apple SDK's PreludeCore binaryTarget. "https://prelude-public.s3.amazonaws.com/sdk/releases/apple/core/0.1.2/PreludeCore-0.1.2.xcframework.zip", + // Same failure mode for Pangle's PAGAdSDK and TikTokBusinessSDK binaryTargets. + "https://sf16-fe-tos-sg.i18n-pglstatp.com/obj/pangle-sdk-static-va/8.3.0.8/PAGAdSDK.xcframework.zip", + "https://sf16-fe-tos-sg.i18n-pglstatp.com/obj/pangle-sdk-static-va/8.3.0.8/TikTokBusinessSDK.xcframework.zip", } { assert.Nil(t, egressResult(t, h, allowed), "public vendor registry allowed: "+allowed) } @@ -1297,6 +1300,11 @@ func TestEgressAllowlist_PublicVendorRegistriesAllowed(t *testing.T) { "https://evil.prelude-public.s3.amazonaws.com/payload", "https://prelude-public-attacker.s3.amazonaws.com/payload", "https://s3.amazonaws.com/prelude-public/payload", + // The Pangle CDN node is one exact host: no children, and never the + // vendor's parent domain or its other subdomains. + "https://evil.sf16-fe-tos-sg.i18n-pglstatp.com/payload", + "https://attacker.i18n-pglstatp.com/payload", + "https://i18n-pglstatp.com/payload", } { resp := egressResult(t, h, blocked) if assert.NotNil(t, resp, "must stay blocked: "+blocked) {