Add repo_verify_origin config option

src/hex_core.erl

@@ -26,6 +26,7 @@ J1i2xWFndWa6nfFnRxZmCStCOZWYYPlaxr+FZceFbpMwzTNs4g3d4tLNUcbKAIH4
     repo_url => binary(),
     repo_public_key => binary(),
     repo_verify => boolean(),
+    repo_verify_origin => boolean(),
     organization => binary()
 }.
 
@@ -39,5 +40,6 @@ default_config() ->
         repo_name => <<"hexpm">>,
         repo_url => <<"https://repo.hex.pm">>,
         repo_public_key => ?HEXPM_PUBLIC_KEY,
-        repo_verify => true
+        repo_verify => true,
+        repo_verify_origin => true
     }.

src/hex_registry.erl

@@ -28,6 +28,10 @@ encode_names(Names) ->
 
 %% @doc
 %% Decode message created with encode_names/1.
+decode_names(Payload, no_verify) ->
+    #{packages := Packages} = hex_pb_names:decode_msg(Payload, 'Names'),
+    {ok, Packages};
+
 decode_names(Payload, Repository) ->
     case hex_pb_names:decode_msg(Payload, 'Names') of
         #{repository := Repository, packages := Packages} ->
@@ -43,6 +47,10 @@ encode_versions(Versions) ->
 
 %% @doc
 %% Decode message created with encode_versions/1.
+decode_versions(Payload, no_verify) ->
+    #{packages := Packages} = hex_pb_versions:decode_msg(Payload, 'Versions'),
+    {ok, Packages};
+
 decode_versions(Payload, Repository) ->
     case hex_pb_versions:decode_msg(Payload, 'Versions') of
         #{repository := Repository, packages := Packages} ->
@@ -58,6 +66,10 @@ encode_package(Package) ->
 
 %% @doc
 %% Decode message created with encode_package/1.
+decode_package(Payload, no_verify, no_verify) ->
+    #{releases := Releases} = hex_pb_package:decode_msg(Payload, 'Package'),
+    {ok, Releases};
+
 decode_package(Payload, Repository, Package) ->
     case hex_pb_package:decode_msg(Payload, 'Package') of
         #{repository := Repository, name := Package, releases := Releases} ->

src/hex_repo.erl

@@ -65,7 +65,13 @@ get_versions(#{repo_name := Repository} = Config) when is_map(Config) ->
 %% '''
 %% @end
 get_package(#{repo_name := Repository} = Config, Name) when is_binary(Name) and is_map(Config) ->
-    Decoder = fun(Data) -> hex_registry:decode_package(Data, Repository, Name) end,
+    Verify = maps:get(repo_verify_origin, Config, true),
+    Decoder = fun(Data) ->
+        case Verify of
+            true -> hex_registry:decode_package(Data, Repository, Name);
+            false -> hex_registry:decode_package(Data, no_verify, no_verify)
+        end
+    end,
     get_protobuf(Config, <<"/packages/", Name/binary>>, Decoder).
 
 %% @doc

test/hex_registry_SUITE.erl

@@ -23,6 +23,7 @@ names_test(_Config) ->
     },
     Payload = hex_registry:encode_names(Names),
     ?assertMatch({ok, Packages}, hex_registry:decode_names(Payload, <<"hexpm">>)),
+    ?assertMatch({ok, Packages}, hex_registry:decode_names(Payload, no_verify)),
     ?assertMatch({error, unverified}, hex_registry:decode_names(Payload, <<"other_repo">>)),
     ok.
 
@@ -45,6 +46,7 @@ versions_test(_Config) ->
     },
     Payload = hex_registry:encode_versions(Versions),
     ?assertMatch({ok, Packages}, hex_registry:decode_versions(Payload, <<"hexpm">>)),
+    ?assertMatch({ok, Packages}, hex_registry:decode_versions(Payload, no_verify)),
     ?assertMatch({error, unverified}, hex_registry:decode_versions(Payload, <<"other_repo">>)),
     ok.
 
@@ -82,6 +84,7 @@ package_test(_Config) ->
     },
     Payload = hex_registry:encode_package(Package),
     ?assertMatch({ok, Releases}, hex_registry:decode_package(Payload, <<"hexpm">>, <<"foobar">>)),
+    ?assertMatch({ok, Releases}, hex_registry:decode_package(Payload, no_verify, no_verify)),
     ?assertMatch({error, unverified}, hex_registry:decode_package(Payload, <<"other_repo">>, <<"foobar">>)),
     ?assertMatch({error, unverified}, hex_registry:decode_package(Payload, <<"hexpm">>, <<"other_package">>)),
     ok.