From 09487f40c58e8bc00a38d59e3189bca3a81f9227 Mon Sep 17 00:00:00 2001 From: Sachin Sampras M Date: Mon, 20 Jul 2026 14:30:05 +0100 Subject: [PATCH] fix: use scoped squid proxy for staging Developer Portal downloads Configure a custom HTTP transport proxy in Download() that routes only Red Hat staging domains (*.qa.redhat.com, *.stage.redhat.com, etc.) through squid.corp.redhat.com:3128. All other traffic goes direct. This is needed because the staging portal redirects to access.cdn.stage.redhat.com for file downloads, which also requires proxy access. Follows the Red Hat proxy auto-configuration rules from hdn.corp.redhat.com/proxy.pac without requiring global HTTPS_PROXY env vars in CI pipelines. Implements SECURESIGN-2158 Signed-off-by: Sachin Sampras M --- pkg/support/testSupport.go | 25 ++++++++++++++++++++++++- 1 file changed, 24 insertions(+), 1 deletion(-) diff --git a/pkg/support/testSupport.go b/pkg/support/testSupport.go index e1de719..2ea693e 100644 --- a/pkg/support/testSupport.go +++ b/pkg/support/testSupport.go @@ -9,6 +9,7 @@ import ( "fmt" "io" "net/http" + "net/url" "os" "path/filepath" "strings" @@ -82,8 +83,30 @@ func DownloadAndUntarArchive(ctx context.Context, link string, dst string) error return UntarArchive(dst, pr) } +const squidProxy = "http://squid.corp.redhat.com:3128" + +var stagingProxySuffixes = []string{ + ".qa.redhat.com", + ".dev.redhat.com", + ".stage.redhat.com", + ".preprod.redhat.com", +} + +func proxyForStagingOnly(req *http.Request) (*url.URL, error) { + host := req.URL.Hostname() + for _, suffix := range stagingProxySuffixes { + if strings.HasSuffix(host, suffix) { + return url.Parse(squidProxy) + } + } + return nil, nil +} + func Download(ctx context.Context, link string, writer io.Writer) (int64, error) { - client := &http.Client{Timeout: 2 * time.Minute} //nolint:mnd + client := &http.Client{ + Timeout: 2 * time.Minute, //nolint:mnd + Transport: &http.Transport{Proxy: proxyForStagingOnly}, + } const maxRetries = 5 var lastErr error