Follow GitHub username 301s when checking plugin integrity

[MikeW1901]

Welcome!

• Yes, I've searched similar issues on GitHub and didn't find any.
• Yes, I've searched similar issues on the Traefik community forum and didn't find any.

What did you do?

Following a username change for the maintainer of the DenyIP plugin, it caused Traefik to fail to load all plugins on next restart with:

unable to set up plugins environment: unable to check archive integrity of the plugin [github.com/kevtainer/denyip](http://github.com/kevtainer/denyip): plugin integrity check failed.

Whilst GitHub don't necessarily leave these 301s in place indefinitely, there is a period where it does so, and thus Traefik should follow these 301s when doing the plugin integrity check and output a warning that the URL has changed (Which can then be configured to be watched for in the user's monitoring tool of choice), so plugin users have time to update to a newer version of the plugin with the new URL.

Relevant issue on the plugin's GitHub repository.

What did you see instead?

Any IngressRoutes using any plugin as a middleware fail to apply successfully, causing applications to output a 404.

What version of Traefik are you using?

3.1.2

What is your environment & configuration?

Kubernetes on GKE.

Relevant (plugins) part of config (now corrected to the correct github URL):

- --experimental.plugins.jwt.moduleName=github.com/team-carepay/traefik-jwt-plugin
- --experimental.plugins.jwt.version=v0.0.11
- --experimental.plugins.traceid.modulename=github.com/trinnylondon/traefik-add-trace-id
- --experimental.plugins.traceid.version=v0.1.5
- --experimental.plugins.denyip.modulename=github.com/kvncrw/denyip
- --experimental.plugins.denyip.version=v1.1.0

If applicable, please paste the log output in DEBUG level

No response

[nmengin]

Hey @MikeW1901,

Thanks for reaching out.

If any community member can help us find verified steps to reproduce and fix the issue if possible, we would love the help.

[Nelwhix]

@nmengin You can recreate the bug by cloning: https://github.com/Nelwhix/traefik-denyip-bug-sandbox. When you start the container you get this error in the traefik container

2025-01-16 01:11:15 traefik-lb  | 2025-01-16T00:11:15Z ERR Plugins are disabled because an error has occurred. error="failed to create Yaegi interpreter: failed to import plugin code \"github.com/kvncrw/denyip\": 1:21: import \"github.com/kvncrw/denyip\" error: unable to find source related to: \"github.com/kvncrw/denyip\"" plugins=["denyip"]

It would be cool if Traefik follows the redirect and loads the plugin correctly, then just drops a warning log for the admin to update the plugin path

[nikonhub]

Hello,

It looks like the problem comes from the validate endpoint.

Calling
GET https://plugins.traefik.io/public/validate/github.com/kevtainer/denyip/v1.0.0 => 404
GET https://plugins.traefik.io/public/validate/github.com/kvncrw/denyip/v1.0.0 => 200.

The hash generated is the same for both urls because the download step is ok for both urls : https://plugins.traefik.io/public/download/github.com/kevtainer/denyip/v1.0.0, https://plugins.traefik.io/public/download/github.com/kvncrw/denyip/v1.0.0.

The X-Plugin-Hash is the same for both requests : fc7cd1f681547e0ca35ea2aeacbe78a7ccd7f5f0a6bcf3b8e4a00e28ea6aaec0

What happens behind https://plugins.traefik.io/public/validate ?
Should we fail all plugins if only 1 has an error ?

I'd be glad to help if needed.

[juliens]

@nikonhub just so you know, the validate endpoint is in the repository: https://github.com/traefik/plugin-service

[lol768]

Is it possible google/go-github#3081 is related?

[crudbetter]

Hi @juliens - I started looking into this (within https://github.com/traefik/plugin-service). In doing so it looks like the plugin service has a dependency that now can't be found - github.com/traefik/hub-trace-kpi/trace. Indeed I can't find a repo in the traefik organisation that might be it (thought it might have been renamed and the plugin service not updated). Any ideas?

[juliens]

Hi @crudbetter , it should be fix now.

[crudbetter]

Hi @juliens - yes spotted that thanks.

I've been digging into this issue by setting up a local reproduction scenario. I've so far found it a useful exercise in setting up traefik talking to the plugin-service. I then realised I needed to run piceus in order to scrape GitHub and seed the plugin catalog that the plugin-service backs onto.

I've succeeded in that and have a document in mongo for github.com/kvncrw/denyip but not for github.com/kevtainer/denyip. This makes sense as the former exists in GitHub, but the latter now doesn't.

So - does TraefikLabs have a document for github.com/kevtainer/denyip in their public plugin catalog (mongo)?

I imagine that is the case - and I could also copy and amend the document I do have - but it might be useful to confirm before continuing.

Thanks!

[nmengin]

Hey @crudbetter,

As the issue targets plugin-service, I move it to the repository.