Allowlist downloads.cdn.telerik.com (Telerik NuGet feed redirects package downloads there)

The licensed Telerik NuGet feed (https://nuget.telerik.com/v3/index.json, declared in dependabot.yml as a nuget-feed registry with api-key credentials) answers package downloads with a 302 to a pre-signed URL on https://downloads.cdn.telerik.com/.... The proxy refuses that second hop:

proxy | GET https://downloads.cdn.telerik.com:443/<hash>_Telerik.Zip.2025.2.520.nupkg_4.0.0
proxy | * egress not allowlisted downloads.cdn.telerik.com
proxy | 403 https://downloads.cdn.telerik.com:443/<hash>_Telerik.Zip.2025.2.520.nupkg_4.0.0
updater | ERROR Error type: private_source_authentication_failure

Feed metadata (/v3/index.json, /v3/registration/..., /v3/package//index.json) succeeds with authenticating nuget feed request (host: nuget.telerik.com, basic auth), so this is the "allowlisting only the reported host fixes metadata and still fails the download" shape from #276. Every licensed Telerik package (Telerik.Documents.*, Telerik.Zip, the UI suites) downloads through this CDN, so any repo on the Telerik feed hits it.

downloads.cdn.telerik.com is Progress/Telerik's own CDN: an exact hostname with no user-creatable subdomains, serving only their package artefacts. Could it be added to the nuget group in internal/handlers/egress_allowlist_defaults.yaml?

@recursor

@recursor are you happy to open a PR for this? We have a Copilot skill that handles adding hosts to the allowlist, so it should be quick. I will approve it once its open

I'm hitting the same issue with MyGet feeds:

egress not allowlisted mgcdn-main2.azureedge.net

Please provide a simpler way to allow for CDN URLs in registries. Maybe something like...

registries:
  myget-bricelam:
    type: nuget-feed
    url: https://www.myget.org/F/bricelam/api/v3/index.json
    cdns:
      - mgcdn-main2.azureedge.net
      - ...

@v-robaiken

@v-robaiken opened #320. It uses registry_redirect_derivations keyed on the nuget.telerik.com credential rather than the static nuget list, since only a job holding the feed credential ever gets the redirect. The red checks are the fork-token labeler, a proxy.golang.org flake in e2e (bundler), and the three npm smoke fixtures expecting npm: 11 on a runner that now has 12.

Derive downloads.cdn.telerik.com for jobs holding a nuget.telerik.com…

Navigation Menu

Repository navigation

Allowlist downloads.cdn.telerik.com (Telerik NuGet feed redirects package downloads there) #306

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Allowlist downloads.cdn.telerik.com (Telerik NuGet feed redirects package downloads there) #306

Description

Activity

v-robaiken commented on Oct 13, 2026

bricelam commented on Oct 13, 2026

recursor commented on Oct 14, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions