Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set insecure tls on server level instead of command level #2749

Open
gangefors opened this issue Nov 7, 2024 · 2 comments
Open

Set insecure tls on server level instead of command level #2749

gangefors opened this issue Nov 7, 2024 · 2 comments
Labels
feature request New feature or request

Comments

@gangefors
Copy link

gangefors commented Nov 7, 2024

Describe the solution you'd like to see
Currently there are several commands that do not support --insecure-tls option but should support it, example jf rt repo-create. The usage report also does not adhere to the insecure tls option since nothing is saved on the server level.
Since the TLS certificates are on the JFP server and not a single endpoint it would make sense to set the TLS validation on the server level instead of the individual command.
This would also make sure that all commands that talk to a server we want to ignore TLS validation on will work.

Allow a user to set a flag on each configured server that will select if calls to the server should validate certificates or not.
Let the user set this for each service URL or for all endpoints.

Example:
--insecure-tls would set it for all endpoints
--artifactory-insecure-tls would set it for --artifactory-url
--distribution-insecure-tls would set it for --distribution-url
--mission-control-insecure-tls would set it for --mission-control-url
--pipelines-insecure-tls would set it for --pipelines-url
--xray-insecure-tls would set it for --xray-url

@gangefors gangefors added the feature request New feature or request label Nov 7, 2024
@gangefors
Copy link
Author

gangefors commented Dec 5, 2024

jf pip command does not support --insecure-tls causing issues when setting build info.

If jf pip is called with --build-name=x --build-number=1 a call is made to the resolve repository configured. This call fails due to invalid certs since we can't tell jf cli to ignore it.

14:52:41 [🟠Warn] (Attempt 1) - Failure occurred while sending GET request to https://domain/artifactory/api/repositories/11jopfd-pypi-test-virtual: Get "https://domain/artifactory/api/repositories/11jopfd-pypi-test-virtual": tls: failed to verify certificate: x509: certificate signed by unknown authority
14:52:41 [🟠Warn] (Attempt 2) - Failure occurred while sending GET request to https://domain/artifactory/api/repositories/11jopfd-pypi-test-virtual: Get "https://domain/artifactory/api/repositories/11jopfd-pypi-test-virtual": tls: failed to verify certificate: x509: certificate signed by unknown authority
14:52:41 [🟠Warn] (Attempt 3) - Failure occurred while sending GET request to https://domain/artifactory/api/repositories/11jopfd-pypi-test-virtual: Get "https://domain/artifactory/api/repositories/11jopfd-pypi-test-virtual": tls: failed to verify certificate: x509: certificate signed by unknown authority
14:52:41 [🟠Warn] (Attempt 4) - Failure occurred while sending GET request to https://domain/artifactory/api/repositories/11jopfd-pypi-test-virtual: Get "https://domain/artifactory/api/repositories/11jopfd-pypi-test-virtual": tls: failed to verify certificate: x509: certificate signed by unknown authority
14:52:41 [🚨Error] failed to get details for repository '11jopfd-pypi-test-virtual'. Error:
Get "https://domain/artifactory/api/repositories/11jopfd-pypi-test-virtual": tls: failed to verify certificate: x509: certificate signed by unknown authority

Additionally, if --insecure-tls were supported, the call to pip needs to have --trusted-host=<fqdn> for pip to also ignore the invalid certs. This can currently be worked around by export PIP_TRUSTED_HOST=<fqdn> before running the jf pip command.

@gangefors
Copy link
Author

jf curl command does not support --insecure-tls.

To get around this issue we need to add the --insecure option to the curl command. This should happen by default if a server is configured with insecure TLS.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
feature request New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant