Holding images until scanned needs malware scanning

What it means

The request to PUT /orgs/{org}/dependency-proxy would have left block_until_scanned on with malware_scan off. block_until_scanned holds a proxied image back until ClamAV has a verdict for every layer, and with malware_scan off the proxy does not ClamAV-scan what it fetches, so there would be nothing to wait for. Nothing in the request was saved.

Example detail messages returned with this error:

• block_until_scanned needs malware_scan: with malware scanning off there is no scan to wait for. Turn malware_scan on, or block_until_scanned off.

What to do

Send malware_scan: true together with block_until_scanned: true, or turn both off in one request (malware_scan: false, block_until_scanned: false). See Dependency proxy fetches.

Response shape

All fremforge API errors are RFC 9457 problem+json:

{
  "type": "https://docs.frem.sh/reference/api/errors/scan-pair",
  "title": "Bad Request",
  "status": 400,
  "detail": "..."
}

Branch on type, not on title or detail - those are human-readable and may be reworded.