goharbor/harbor · error · NotFoundError

NOT_FOUND

NOT_FOUND

Error message

repository %q does not match project repository filter

What it means

Error "repository %q does not match project repository filter" thrown in goharbor/harbor.

Source

Thrown at src/server/middleware/repoproxy/proxy.go:284

	}
	log.Debugf("repository %q match result: %v (filter: %q, kind: %s)", repository, matched, filterPattern, filterKind)
	return matched
}

// checkRepositoryFilter returns a NotFoundError if the project has a proxy_cache_filter_pattern
// set and the artifact's repository does not match it. It is enforced for both manifest and
// blob requests so the filter acts as an access boundary rather than a manifest-only convenience,
// since a client that knows a blob digest out-of-band could otherwise bypass the filter.
func checkRepositoryFilter(p *proModels.Project, art lib.ArtifactInfo) error {
	filterPattern, ok := p.GetMetadata(proModels.ProMetaProxyCacheFilterPattern)
	if !ok || filterPattern == "" {
		return nil
	}
	filterKind, _ := p.GetMetadata(proModels.ProMetaProxyCacheFilterKind)
	remoteRepo := strings.TrimPrefix(art.Repository, art.ProjectName+"/")
	if !matchRepositoryFilter(remoteRepo, filterPattern, filterKind) {
		log.Debugf("blocked proxy cache pull for project %q repository %q: repository does not match filter %q (kind: %s)", p.Name, remoteRepo, filterPattern, filterKind)
		return errors.NotFoundError(fmt.Errorf("repository %q does not match project repository filter", remoteRepo))
	}
	return nil
}

// upstreamRegistryConnectionKey get upstream registry connection key
func upstreamRegistryConnectionKey(art lib.ArtifactInfo) string {
	limitOnProject := os.Getenv(upstreamRegistryLimitOnProject)
	if strings.EqualFold("true", limitOnProject) {
		return fmt.Sprintf("{upstream_registry_connection}:%s", art.ProjectName)
	}
	return fmt.Sprintf("{upstream_registry_connection}:%s:%s", art.Repository, art.Digest)
}

func handleManifest(w http.ResponseWriter, r *http.Request, next http.Handler) error {
	ctx := r.Context()
	art, p, proxyCtl, err := preCheck(ctx, true)
	if err != nil {
		return err

View on GitHub (pinned to 7b2fd08cc5)

When it happens

Trigger: Thrown at src/server/middleware/repoproxy/proxy.go:284 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of goharbor/harbor@7b2fd08cc5 (2026-08-16). Data as JSON: /api/errors/db104d3ef0f4b6fa. Report an issue: GitHub.