Skip to content

Clarify Cache-Control for access-controlled artifact downloads. Reser… - #268

Open
Mehrn0ush wants to merge 1 commit into
CycloneDX:mainfrom
Mehrn0ush:fix/f01-artifact-cache-control
Open

Mehrn0ush wants to merge 1 commit into
CycloneDX:mainfrom
Mehrn0ush:fix/f01-artifact-cache-control

Conversation

@Mehrn0ush

Copy link
Copy Markdown
Contributor

Summary

  • Restrict public Cache-Control on immutable artifact/signature downloads to content available without authorization
  • Require private or no-store for access-controlled download responses, with matching examples for versioned and latest headers
  • Clarify that revision immutability does not imply shared-cache / public reuse

Closes #267

@taleodor — this follows our earlier discussion. I’d appreciate your review when convenient. Thank you.

…ve public caching for unauthorized content; require private or no-store when downloads are protected.

Signed-off-by: Mehrn0ush <mehrnoush.vaseghi@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Clarify Cache-Control guidance for authenticated artifact downloads

3 participants