Proxy auto config (PAC) supports specifying different proxies for different URLs. Unfortunately, a PAC file is just a file that contains a JavaScript function to pick the proxy, so they're crazily over-powered for the task, and support for them isn't very broad. Browsers support them, but I guess most command line tools wouldn't.
Another solution: a HTTP proxy server listening on localhost to which you sent HTTPS requests using GET https:// instead of CONNECT. Then the proxy server could have all the logic about which requests to handle via the cache versus which to fetch directly. It could also handle authentication to a cache server if that is required.
The problem is most clients don’t do GET https://, because in your old-school corporate web proxy use case, the proxy server is remote, and sending HTTPS requests to it over HTTP eliminates the security of HTTPS.
If only there was some standard environment variable like artifact_proxy, which had to be a localhost http URI, and which tools would understand as meaning “send HTTP GET to this proxy, even for https://, delegating all the TLS stuff to it, but only if you are trying to download a build artifact, not for any runtime use”
The hard part wouldn’t be implementing this idea (the local proxy server and the environment variable), the hard part would be getting all the different tool developers to agree to support it
Comments
Proxy auto config (PAC) supports specifying different proxies for different URLs. Unfortunately, a PAC file is just a file that contains a JavaScript function to pick the proxy, so they're crazily over-powered for the task, and support for them isn't very broad. Browsers support them, but I guess most command line tools wouldn't.
https://en.m.wikipedia.org/wiki/Proxy_auto-config
Another solution: a HTTP proxy server listening on localhost to which you sent HTTPS requests using GET https:// instead of CONNECT. Then the proxy server could have all the logic about which requests to handle via the cache versus which to fetch directly. It could also handle authentication to a cache server if that is required.
The problem is most clients don’t do GET https://, because in your old-school corporate web proxy use case, the proxy server is remote, and sending HTTPS requests to it over HTTP eliminates the security of HTTPS.
If only there was some standard environment variable like artifact_proxy, which had to be a localhost http URI, and which tools would understand as meaning “send HTTP GET to this proxy, even for https://, delegating all the TLS stuff to it, but only if you are trying to download a build artifact, not for any runtime use”
The hard part wouldn’t be implementing this idea (the local proxy server and the environment variable), the hard part would be getting all the different tool developers to agree to support it