[soulteary]

CentOS Stream repositories use Metalink to discover mirrors and bind downloads to repomd.xml checksums. Until now, using apt-proxy required disabling Metalink and choosing a fixed base URL. This change adds an opt-in local Metalink endpoint so DNF can keep its discovery and checksum workflow while metadata and RPM downloads pass through the proxy cache.

• Parse bounded MirrorManager Metalink v3 XML, preserve repomd size/timestamp/checksums, and rewrite resources to fixed public proxy snapshot URLs.
• Fetch only explicitly allowed mirror hosts through DNS-pinned direct transports, intersect existing upstream restrictions, and reject unsafe URLs, redirects, private requests and inconsistent snapshots.
• Verify candidate repomd.xml before selection or fallback. Mirror-specific authorization, throttling and other artifact failures try the remaining verified candidates. Equivalent mirrors of the same repository snapshot share a canonical artifact cache key; issued routes retain their original generation across refresh.
• Respect upstream freshness/privacy, coalesce discovery requests, bound retained snapshots and temporary resources, and integrate successful SIGHUP/API mirror refresh.
• Document CentOS setup in both READMEs and add a signed DNF client matrix for Stream 9 and 10.

Validation:

• Full go test -race -short -count=1 -covermode=atomic ./...: passed; repository coverage 83.2%.
• Metalink-focused race regressions: passed; package coverage 85.0%.
• go vet ./..., golangci-lint v2.14.0, gofmt and diff checks: passed.
• Real Stream 9 / Stream 10 DNF clients on Linux ARM64: passed with metadata/RPM signatures, upstream TLS verification, native variables/countme, mirror fallback, digest rejection and traced client connections restricted to the proxy.
• Cleaning the DNF cache and reinstalling kept origin RPM GET counts at 1 → 1 for both clients.
• Seven matrix entrypoint regressions passed. The new GitHub Actions matrix runs both clients on AMD64.

Client repository Metalink URLs must point to the local endpoint; this does not require a CONNECT tunnel. Operators configure a fixed public proxy origin and an explicit list of eligible returned mirror hosts. Availability of every public CentOS mirror is outside the isolated client matrix.

Closes #70.

[soulteary]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T05:24:42.065403Z	b0f1507	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 58014adc4a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[soulteary]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: b0f15078d9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".