Skip to content

Add cooldown support for Conda#68

Merged
andrew merged 2 commits intomainfrom
add-conda-cooldown
Apr 6, 2026
Merged

Add cooldown support for Conda#68
andrew merged 2 commits intomainfrom
add-conda-cooldown

Conversation

@andrew
Copy link
Copy Markdown
Contributor

@andrew andrew commented Apr 6, 2026

Filter entries from Conda repodata.json based on the timestamp field (milliseconds since epoch). Filters both packages and packages.conda sections.

When cooldown is disabled, repodata requests are proxied directly without parsing. The repodata.json.bz2 endpoint is always proxied raw since decompressing bz2 just for filtering isn't worth the cost.

Entries without a timestamp field pass through unfiltered.

andrew added 2 commits April 6, 2026 13:13
Filter entries from Conda repodata.json based on the timestamp field
(milliseconds since epoch). Filters both packages and packages.conda
sections. When cooldown is disabled, repodata requests are proxied
directly without parsing.
@andrew andrew force-pushed the add-conda-cooldown branch from 635cd74 to 610ae66 Compare April 6, 2026 12:14
@andrew andrew merged commit 75ff85f into main Apr 6, 2026
5 checks passed
@andrew andrew deleted the add-conda-cooldown branch April 6, 2026 18:32
@JeanChristopheMorinPerso
Copy link
Copy Markdown

@andrew the timestamp field in conda's repodata doesn't represent the publish timestamp. It instead represents the time at which the package was built, which can significantly differ from the time the package was published. On top of that, the timestamp comes from the package, which means that it can easily be tempered with at build time. For that reason, it cannot usually be relied on for a cooldown and security.

@JeanChristopheMorinPerso
Copy link
Copy Markdown

JeanChristopheMorinPerso commented Apr 8, 2026

See conda/conda#15759 (comment) and conda/ceps#154 for more context.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants