[simonchrz]

Closes #536.

FreeBSD pkg repositories are served at /freebsd/{name}/, with pkg.freebsd.org as the built-in freebsd repository and more mirrors under upstream.freebsd. The rest of the path goes to the mirror unchanged, so ports, pkgbase and poudriere repositories all work. Clients override url and set mirror_type: "none". Signature settings stay as they are.

• Catalogues (meta, meta.conf, packagesite and data as .pkg, .txz or .tzst) carry their signature inside the archive. They go through the metadata cache and are served byte for byte.
• Packages under Hashed/ (All/Hashed/ for ports, Hashed/ for pkgbase) have the content hash in the file name and never change. They go to the artifact cache as pkg:bsd/freebsd/{name}@{version}, using the type from Add bsd PURL type for FreeBSD packages purl#49 (purl bumped to v0.1.23). Retention supports freebsd.
• Everything else is passed through uncached.

Two changes from the plan in the issue:

• Latest/pkg.pkg and pkg.pkg.sig are passed through rather than cached. The .sig is rewritten with every repository build while pkg.pkg changes less often, so caching them separately could pair a package with the wrong signature, the problem Arch solves for databases. Bootstrap is rare enough that I'd leave it for later.
• Unhashed package files are passed through too. Ports packages can be rebuilt without a version bump, which is why the repositories moved to Hashed/.

Also: dashboard instructions, README, config example, configuration docs, the request metrics label and pkg as a known client.

Testing

Handler tests cover the path classification, name and version parsing, catalogues and hashed packages served from the cache while the upstream is down, packages cached per ABI, Latest/ and unhashed files not cached, and the retention key.

I also ran it end to end with a FreeBSD 15.1 aarch64 VM, with FreeBSD-ports, FreeBSD-ports-kmods and FreeBSD-base pointed at the proxy and their signature settings unchanged. pkg update verified all three catalogues, and pkg install fetched a ports package (tree) and pkgbase packages through it, stored as pkg:bsd/freebsd/tree@2.3.2 and so on. With the proxy cut off from the upstream and pkg's local cache cleared, pkg update -f and reinstalling both kinds of packages still worked. pkg sends User-Agent: pkg/2.8.4, which shows up as client pkg.

FreeBSD 15 splits the old FreeBSD repository into FreeBSD-ports, FreeBSD-ports-kmods and FreeBSD-base; the README shows both layouts.

Package files outside Hashed/ (unhashed repositories, Latest/pkg.pkg) stay uncached, but a versioned name is checked against the denylist first, and while a scanner covers freebsd they are refused, since only cached artifacts can be scanned.