Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

Default Setup: GCP OIDC private registry (Artifact Registry, Maven) registered but requests sent unauthenticated (401)

Abierto
  • ¿Algo no está bien?
#4,229 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
4/5
Tiempo estimado
3-5 días
Aptitud para principiantes
18/100
Tipo de issue
Error
Claridad
Bastante claro
Estado de actividad
Activo
Stack tecnológico
gcp, github-actions, java, typescript
Área
authentication, build-system

Línea de trabajo

Start from the proxy log lines this report quotes: the 'registered gcp OIDC credentials for maven repository' message and the 401s. Compare the registered URL (no port) with the requested URL (':443'), since the report suspects that mismatch. The payload does not name source files, so locate the credential-matching code by searching for 'oidc_gcp' and the registry URL. Done means proxy requests to the registry carry the federated token and no fallback to Maven Central occurs when replaces_base is true, which needs a GCP setup to verify.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

Summary

Default Setup (Code Quality and code scanning, Java, build-mode: none) with an organization-level maven_repository private registry on Google Artifact Registry using GCP OIDC (auth_type: oidc_gcp, direct Workload Identity Federation, no service account). The proxy registers the credentials and the token exchange succeeds, but requests to the registry are sent without credentials, so every artifact returns 401. This looks like the GCP equivalent of #3838, after GCP OIDC configurations started being accepted in #3850.

Environment

Item Value
Workflow Default Setup, dynamic/github-code-quality/codeql and code scanning default setup
CodeQL bundle / proxy codeql-bundle-v2.27.2, update-job-proxy 2.27.2 (commit: dev)
Runners GitHub-hosted ubuntu-latest and self-hosted (ARC); same behaviour
Registry maven_repository, https://<region>-maven.pkg.dev/<project>/<repo>, replaces_base: true
Auth oidc_gcp, workload_identity_provider set, no service_account, no audience

What happens

  1. "Setup proxy for registries" lists the registry with the GCP Workload Identity Provider, and proxy.log shows:
    registered gcp OIDC credentials for maven repository: https://<region>-maven.pkg.dev/<project>/<repo>
  2. Google STS logs show a successful token exchange for the job's OIDC subject (repo:<org>/<repo>:ref:refs/pull/<n>/head) right after the proxy starts.
  3. Every artifact request through the proxy then gets 401:
    [014] 401 https://<region>-maven.pkg.dev:443/<project>/<repo>/com/fasterxml/.../x.jar
    Remote response: {"error":"Unauthenticated request. Unauthenticated requests do not have permission \"artifactregistry.repositories.downloadArtifacts\" ..."}
    Artifact Registry audit logs show these requests with empty authenticationInfo (anonymous).
  4. The proxy then falls back to repo.maven.apache.org for each artifact despite replaces_base: true.

Why we think the token is fine

  • The same Workload Identity provider and IAM binding (principalSet://.../attribute.repository_owner/<org>, roles/artifactregistry.reader) authenticate normal workflows to the same Maven repository (federated token as oauth2accesstoken password): requests appear with the federated principal and succeed.
  • If we write our own Maven settings.xml with that federated token, Maven's requests go through the CodeQL proxy and succeed (200). Only requests that rely on the proxy to add credentials fail: the dependency fetches made by the Java extractor in build-mode: none.
  • Possibly relevant: the proxy logs request URLs with an explicit port (https://<host>:443/...) while the credentials are registered for https://<host>/....

Expected

The proxy attaches the federated access token (e.g. Basic oauth2accesstoken:<token>) to requests matching the registry URL, as it does for the OIDC providers fixed in #3838, and does not fall back to Maven Central when replaces_base is true.

Happy to share full proxy logs privately.

Lenguaje dominante
TypeScript
Estrellas
1.7k
Forks
498
Merge medio
1 d 17 h
PR fusionados (30 d)
56

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de github/codeql-action

Todos los issues de github/codeql-action

Issues similares

Más issues de TypeScript

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.