GIgit-pkgs
scanning

Fetch a staged artifact for scanning

Changed on

Streams the exact bytes staged in storage for a pre-cache security scan. Requires a short-lived HMAC-signed token minted by the proxy itself and delivered via the fetch_url field of the scan notify request (see the Artifact Scanning section of docs/configuration.md). Not part of the public API; restrict access to the scanner network at the ingress layer.

get/_internal/scan-fetch

Request

  • Base URL
    / (relative, and the document was published on a file host, not at the API’s origin)
  • Auth
    none declared

Query parameters

pathstring required

Storage path of the staged artifact

expinteger required

Token expiry, Unix seconds

sigstring required

HMAC-SHA256 signature over the string path|exp

Response

OK

Changes