From e3b2260cb92842ac5edf4abb60ccee956a09ca1e Mon Sep 17 00:00:00 2001 From: Jason Sznol Date: Thu, 15 Oct 2026 11:11:39 -0400 Subject: [PATCH] egress(allowlist): add adsbynimbus-public.s3.amazonaws.com and regression tests --- internal/handlers/egress_allowlist_defaults.yaml | 2 ++ internal/handlers/egress_allowlist_test.go | 3 +++ 2 files changed, 5 insertions(+) diff --git a/internal/handlers/egress_allowlist_defaults.yaml b/internal/handlers/egress_allowlist_defaults.yaml index 408646b..92a6428 100644 --- a/internal/handlers/egress_allowlist_defaults.yaml +++ b/internal/handlers/egress_allowlist_defaults.yaml @@ -150,6 +150,8 @@ shared_registry_domains: # Public mirrors (continued). - mirrors.cloud.tencent.com - mirrors.huaweicloud.com + # AdsByNimbus public vendor (Gradle and Swift Package Manager). + - adsbynimbus-public.s3.amazonaws.com # registry_redirect_derivations are storage hosts that a configured registry # 302-redirects package downloads to, but that appear in no credential field. diff --git a/internal/handlers/egress_allowlist_test.go b/internal/handlers/egress_allowlist_test.go index 9dd86ce..382ee30 100644 --- a/internal/handlers/egress_allowlist_test.go +++ b/internal/handlers/egress_allowlist_test.go @@ -581,6 +581,7 @@ func TestEgressAllowlist_NewExactDomainsAllowed(t *testing.T) { "https://maven.google.com/androidx/pkg.pom", "https://packages.drupal.org/8/packages.json", "https://packages.confluent.io/maven/pkg.jar", + "https://adsbynimbus-public.s3.amazonaws.com/iOS/spm/collection.json", } { assert.Nil(t, egressResult(t, h, allowed), "new exact host allowed: "+allowed) } @@ -606,6 +607,7 @@ func TestEgressAllowlist_PublicRegistriesAllowed(t *testing.T) { "https://go.googlesource.com/tools", "https://android.googlesource.com/platform", "https://nodejs.org/dist/index.json", + "https://adsbynimbus-public.s3.amazonaws.com/android/sdks", } { assert.Nil(t, egressResult(t, h, allowed), "public registry host allowed: "+allowed) } @@ -757,6 +759,7 @@ func TestEgressAllowlist_NewEntriesDoNotWidenBeyondExactHosts(t *testing.T) { "https://evil.charts.wiz.io/payload", "https://evil.wiz-sec.github.io/payload", "https://evil.fluent.github.io/payload", + "https://evil.adsbynimbus-public.s3.amazonaws.com/payload", } // Sibling hosts: names sharing a parent with an added entry. These pin the