Hacktoberfest 2026 : les issues que les mainteneurs ont marquées pour octobre, ouvertes et accessibles aux débutants. Parcourir les issues Hacktoberfest

Default Setup: GCP OIDC private registry (Artifact Registry, Maven) registered but requests sent unauthenticated (401)

Ouverte
  • Quelque chose ne va pas ?
#4,229 1 commentaire 0 réactions 0 personnes assignées Voir sur GitHub

Les mainteneurs répondent en général sous 1 jour

Personne n'a encore pris cette issue.

Évaluation

Difficulté
4/5
Temps estimé
3-5 jours
Accessibilité débutants
18/100
Type d'issue
Bug
Clarté
Plutôt claire
Activité
Active
Stack technique
gcp, github-actions, java, typescript
Domaine
authentication, build-system

Piste de recherche

Start from the proxy log lines this report quotes: the 'registered gcp OIDC credentials for maven repository' message and the 401s. Compare the registered URL (no port) with the requested URL (':443'), since the report suspects that mismatch. The payload does not name source files, so locate the credential-matching code by searching for 'oidc_gcp' and the registry URL. Done means proxy requests to the registry carry the federated token and no fallback to Maven Central occurs when replaces_base is true, which needs a GCP setup to verify.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Description

Summary

Default Setup (Code Quality and code scanning, Java, build-mode: none) with an organization-level maven_repository private registry on Google Artifact Registry using GCP OIDC (auth_type: oidc_gcp, direct Workload Identity Federation, no service account). The proxy registers the credentials and the token exchange succeeds, but requests to the registry are sent without credentials, so every artifact returns 401. This looks like the GCP equivalent of #3838, after GCP OIDC configurations started being accepted in #3850.

Environment

Item Value
Workflow Default Setup, dynamic/github-code-quality/codeql and code scanning default setup
CodeQL bundle / proxy codeql-bundle-v2.27.2, update-job-proxy 2.27.2 (commit: dev)
Runners GitHub-hosted ubuntu-latest and self-hosted (ARC); same behaviour
Registry maven_repository, https://<region>-maven.pkg.dev/<project>/<repo>, replaces_base: true
Auth oidc_gcp, workload_identity_provider set, no service_account, no audience

What happens

  1. "Setup proxy for registries" lists the registry with the GCP Workload Identity Provider, and proxy.log shows:
    registered gcp OIDC credentials for maven repository: https://<region>-maven.pkg.dev/<project>/<repo>
  2. Google STS logs show a successful token exchange for the job's OIDC subject (repo:<org>/<repo>:ref:refs/pull/<n>/head) right after the proxy starts.
  3. Every artifact request through the proxy then gets 401:
    [014] 401 https://<region>-maven.pkg.dev:443/<project>/<repo>/com/fasterxml/.../x.jar
    Remote response: {"error":"Unauthenticated request. Unauthenticated requests do not have permission \"artifactregistry.repositories.downloadArtifacts\" ..."}
    Artifact Registry audit logs show these requests with empty authenticationInfo (anonymous).
  4. The proxy then falls back to repo.maven.apache.org for each artifact despite replaces_base: true.

Why we think the token is fine

  • The same Workload Identity provider and IAM binding (principalSet://.../attribute.repository_owner/<org>, roles/artifactregistry.reader) authenticate normal workflows to the same Maven repository (federated token as oauth2accesstoken password): requests appear with the federated principal and succeed.
  • If we write our own Maven settings.xml with that federated token, Maven's requests go through the CodeQL proxy and succeed (200). Only requests that rely on the proxy to add credentials fail: the dependency fetches made by the Java extractor in build-mode: none.
  • Possibly relevant: the proxy logs request URLs with an explicit port (https://<host>:443/...) while the credentials are registered for https://<host>/....

Expected

The proxy attaches the federated access token (e.g. Basic oauth2accesstoken:<token>) to requests matching the registry URL, as it does for the OIDC providers fixed in #3838, and does not fall back to Maven Central when replaces_base is true.

Happy to share full proxy logs privately.

Langage dominant
TypeScript
Étoiles
1.7k
Forks
498
Merge moyen
1 j 17 h
PR mergées (30 j)
56

Préparer son environnement

Par où commencer

  1. Lisez l'issue en entier, puis le guide de contribution du projet.
  2. Signalez en commentaire que vous la prenez — cela évite que deux personnes fassent le même travail.
  3. Forkez le dépôt et travaillez sur une branche.
  4. Ouvrez une pull request qui référence le numéro de l'issue.

Autres issues de github/codeql-action

Toutes les issues de github/codeql-action

Issues similaires

Plus d'issues TypeScript

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.