Cache Management
Initialization Protection
To prevent cache poisoning attacks, the proxy blocks all requests until the malicious package database is fully loaded. This ensures:
- No malicious packages can be cached during the initialization window
- The system is secure by default
- Users receive a clear "Service is initializing" message if they try to install packages too early
Integrity Verification
All cached packages are protected with SHA256 checksums:
- When caching, the proxy calculates and stores a SHA256 hash
- Before serving from cache, the hash is verified
- If verification fails, the cache is invalidated and the package is refetched
This prevents:
- Cache corruption from disk errors
- Manual tampering with cached files
- Serving compromised packages
Cache Poisoning Prevention
The proxy checks packages for malicious content before caching:
- Malicious packages are never cached
- If a package becomes flagged after being cached, it's automatically removed
- Each request is checked against the latest database
Minimum Package Age
The proxy can be configured to refuse any package version published more recently than a specified number of days. This gives the security community time to detect and flag malicious releases before they reach your teams.
Cache Size and Location
The cache is bounded in size and evicts the least recently used packages once it's full, so disk usage never grows without limit.
Configure it with these environment variables:
| Variable | Default | Description |
|---|---|---|
DEPENDENCY_PROXY_CACHE_DIR | a devguard-dependency-proxy-cache directory under the OS temp dir | Where cached package files are stored on disk. |
DEPENDENCY_PROXY_CACHE_MAX_SIZE_MB | 1024 (1GB) | Maximum total size of the cache, in megabytes. When exceeded, the least recently used entries are evicted to make room. |