pub.dev (Dart and Flutter)

Point dart pub and flutter pub at the Package Firewall with PUB_HOSTED_URL and a bearer token.


Hosted URL	`https://packages.vulnetix.com/pub`
Ecosystem ID	`pub`
Plan	Add-on
Mode	filter: `/api/packages/<name>` is filtered by version
Cooldown	yes
Default mirror	`https://pub.dev`

Dart rejects credentials in PUB_HOSTED_URL and cannot send Basic auth. It stores one bearer token per hosted URL, and the firewall accepts base64("<orgUUID>:<apiKey>") as that token.

Automatic setup

vulnetix package-firewall pub
source ~/.config/vulnetix/package-firewall/pub.env

~/.config/vulnetix/package-firewall/pub.env:

export PUB_HOSTED_URL="https://packages.vulnetix.com/pub"

~/.config/dart/pub-tokens.json (written whole, existing file backed up):

{
  "hosted": [
    {
      "token": "BASE64_OF_ORGUUID_COLON_APIKEY",
      "url": "https://packages.vulnetix.com/pub"
    }
  ],
  "version": 1
}

Manual equivalent

--env-var stores the variable name, not the token, so PUB_VULNETIX_TOKEN must be set wherever dart pub runs.

export PUB_HOSTED_URL="https://packages.vulnetix.com/pub"
export PUB_VULNETIX_TOKEN=$(printf '%s:%s' "$VULNETIX_ORG_ID" "$VULNETIX_API_KEY" | base64 | tr -d '\n')
dart pub token add https://packages.vulnetix.com/pub --env-var PUB_VULNETIX_TOKEN

Use and verify

dart pub token list
dart pub get
flutter pub get