Image proxy (#8996)

Author: sigurdm

app/test/shared/versions_test.dart

@@ -65,7 +65,7 @@ void main() {
     'accepted runtime versions should be lexicographically ordered',
     () {
       for (final version in acceptedRuntimeVersions) {
-        expect(runtimeVersionPattern.hasMatch(version), isTrue);
+        expect(version, matches(runtimeVersionPattern));
       }
       final sorted = [...acceptedRuntimeVersions]
         ..sort((a, b) => -a.compareTo(b));
@@ -77,23 +77,29 @@ void main() {
     expect(acceptedRuntimeVersions, hasLength(lessThan(6)));
   });
 
-  test('runtime sdk version should match CI and dockerfile', () async {
+  test('runtime sdk version should match CI and dockerfiles', () async {
     final String docker = await File('../Dockerfile.app').readAsString();
-    expect(docker.contains('\nFROM dart:$runtimeSdkVersion\n'), isTrue);
+    expect(docker, contains('\nFROM dart:$runtimeSdkVersion\n'));
     final ci = await File('../.github/workflows/all-test.yml').readAsString();
-    expect(ci.contains("DART_SDK_VERSION: '$runtimeSdkVersion'"), isTrue);
+    expect(ci, contains("DART_SDK_VERSION: '$runtimeSdkVersion'"));
+    final imageProxyDocker = await File(
+      '../pkg/image_proxy/Dockerfile',
+    ).readAsString();
+    expect(imageProxyDocker, contains('\nFROM dart:$runtimeSdkVersion '));
   });
 
   test('Dart SDK versions should match Dockerfile.worker', () async {
     final dockerfileContent = await File('../Dockerfile.worker').readAsString();
     expect(
-      dockerfileContent.contains(
-            'tool/setup-dart.sh /home/worker/dart/stable stable/raw/hash/',
-          ) ||
-          dockerfileContent.contains(
-            'tool/setup-dart.sh /home/worker/dart/stable $toolStableDartSdkVersion',
-          ),
-      isTrue,
+      dockerfileContent,
+      anyOf(
+        contains(
+          'tool/setup-dart.sh /home/worker/dart/stable stable/raw/hash/',
+        ),
+        contains(
+          'tool/setup-dart.sh /home/worker/dart/stable $toolStableDartSdkVersion',
+        ),
+      ),
     );
   });
 
@@ -166,7 +172,7 @@ and do not format to also bump the runtimeVersion.''',
     // roll traffic backwards.
     // Avoid this by temporarily hardcoding gcBeforeRuntimeVersion to not be
     // the last version of acceptedRuntimeVersions.
-    expect(gcBeforeRuntimeVersion != runtimeVersion, isTrue);
+    expect(gcBeforeRuntimeVersion, isNot(runtimeVersion));
   });
 
   scopedTest('GC is returning correct values for known versions', () {

pkg/image_proxy/Dockerfile

@@ -0,0 +1,21 @@
+# Use latest stable channel SDK.
+FROM dart:3.9.0 AS build
+
+ENV PUB_ENVIRONMENT="bot"
+ENV PUB_CACHE="/project/.pub-cache"
+
+# Resolve app dependencies.
+WORKDIR /app
+COPY . .
+RUN dart pub get --enforce-lockfile
+RUN dart compile exe pkg/image_proxy/bin/server.dart -o server
+
+# Build minimal serving image from AOT-compiled `/server`
+# and the pre-built AOT-runtime in the `/runtime/` directory of the base image.
+FROM scratch
+COPY --from=build /runtime/ /
+COPY --from=build /app/server /app/bin/
+
+# Start server.
+EXPOSE 8080
+CMD ["/app/bin/server"]

pkg/image_proxy/README.md

@@ -0,0 +1,20 @@
+# Image proxy for pub.dev.
+
+
+Will forward requests to a url, when given a request like:
+```
+https://external-image.pub.dev/<base64(hmac(url,hmac_kms(date))>/<date>/<urlencode(url)>
+```
+
+date is a "microsecond after epoch" timestamp of a specific date's midnight.
+
+hmac_kms is calculated in KMS with the key version at HMAC_KEY_ID.
+
+## Development
+
+To build the docker image (from the repository root):
+
+```
+docker build -t image-proxy-server . --file pkg/image_proxy/Dockerfile
+```
+

pkg/image_proxy/bin/server.dart

@@ -0,0 +1,5 @@
+// Copyright (c) 2025, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+export 'package:pub_dev_image_proxy/image_proxy_service.dart' show main;