You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Describe the solution you'd like to see
Currently there are several commands that do not support --insecure-tls option but should support it, example jf rt repo-create. The usage report also does not adhere to the insecure tls option since nothing is saved on the server level.
Since the TLS certificates are on the JFP server and not a single endpoint it would make sense to set the TLS validation on the server level instead of the individual command.
This would also make sure that all commands that talk to a server we want to ignore TLS validation on will work.
Allow a user to set a flag on each configured server that will select if calls to the server should validate certificates or not.
Let the user set this for each service URL or for all endpoints.
Example: --insecure-tls would set it for all endpoints --artifactory-insecure-tls would set it for --artifactory-url --distribution-insecure-tls would set it for --distribution-url --mission-control-insecure-tls would set it for --mission-control-url --pipelines-insecure-tls would set it for --pipelines-url --xray-insecure-tls would set it for --xray-url
The text was updated successfully, but these errors were encountered:
jf pip command does not support --insecure-tls causing issues when setting build info.
If jf pip is called with --build-name=x --build-number=1 a call is made to the resolve repository configured. This call fails due to invalid certs since we can't tell jf cli to ignore it.
14:52:41 [🟠Warn] (Attempt 1) - Failure occurred while sending GET request to https://domain/artifactory/api/repositories/11jopfd-pypi-test-virtual: Get "https://domain/artifactory/api/repositories/11jopfd-pypi-test-virtual": tls: failed to verify certificate: x509: certificate signed by unknown authority
14:52:41 [🟠Warn] (Attempt 2) - Failure occurred while sending GET request to https://domain/artifactory/api/repositories/11jopfd-pypi-test-virtual: Get "https://domain/artifactory/api/repositories/11jopfd-pypi-test-virtual": tls: failed to verify certificate: x509: certificate signed by unknown authority
14:52:41 [🟠Warn] (Attempt 3) - Failure occurred while sending GET request to https://domain/artifactory/api/repositories/11jopfd-pypi-test-virtual: Get "https://domain/artifactory/api/repositories/11jopfd-pypi-test-virtual": tls: failed to verify certificate: x509: certificate signed by unknown authority
14:52:41 [🟠Warn] (Attempt 4) - Failure occurred while sending GET request to https://domain/artifactory/api/repositories/11jopfd-pypi-test-virtual: Get "https://domain/artifactory/api/repositories/11jopfd-pypi-test-virtual": tls: failed to verify certificate: x509: certificate signed by unknown authority
14:52:41 [🚨Error] failed to get details for repository '11jopfd-pypi-test-virtual'. Error:
Get "https://domain/artifactory/api/repositories/11jopfd-pypi-test-virtual": tls: failed to verify certificate: x509: certificate signed by unknown authority
Additionally, if --insecure-tls were supported, the call to pip needs to have --trusted-host=<fqdn> for pip to also ignore the invalid certs. This can currently be worked around by export PIP_TRUSTED_HOST=<fqdn> before running the jf pip command.
To get around this issue we need to add the --insecure option to the curl command. This should happen by default if a server is configured with insecure TLS.
Describe the solution you'd like to see
Currently there are several commands that do not support
--insecure-tls
option but should support it, examplejf rt repo-create
. The usage report also does not adhere to the insecure tls option since nothing is saved on the server level.Since the TLS certificates are on the JFP server and not a single endpoint it would make sense to set the TLS validation on the server level instead of the individual command.
This would also make sure that all commands that talk to a server we want to ignore TLS validation on will work.
Allow a user to set a flag on each configured server that will select if calls to the server should validate certificates or not.
Let the user set this for each service URL or for all endpoints.
Example:
--insecure-tls
would set it for all endpoints--artifactory-insecure-tls
would set it for--artifactory-url
--distribution-insecure-tls
would set it for--distribution-url
--mission-control-insecure-tls
would set it for--mission-control-url
--pipelines-insecure-tls
would set it for--pipelines-url
--xray-insecure-tls
would set it for--xray-url
The text was updated successfully, but these errors were encountered: