Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

Default Setup: GCP OIDC private registry (Artifact Registry, Maven) registered but requests sent unauthenticated (401)

Aperta
  • Qualcosa non va?
#4,229 1 commento 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
18/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Attiva
Stack tecnologico
gcp, github-actions, java, typescript
Ambito
authentication, build-system

Direzione di ricerca

Start from the proxy log lines this report quotes: the 'registered gcp OIDC credentials for maven repository' message and the 401s. Compare the registered URL (no port) with the requested URL (':443'), since the report suspects that mismatch. The payload does not name source files, so locate the credential-matching code by searching for 'oidc_gcp' and the registry URL. Done means proxy requests to the registry carry the federated token and no fallback to Maven Central occurs when replaces_base is true, which needs a GCP setup to verify.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

Default Setup (Code Quality and code scanning, Java, build-mode: none) with an organization-level maven_repository private registry on Google Artifact Registry using GCP OIDC (auth_type: oidc_gcp, direct Workload Identity Federation, no service account). The proxy registers the credentials and the token exchange succeeds, but requests to the registry are sent without credentials, so every artifact returns 401. This looks like the GCP equivalent of #3838, after GCP OIDC configurations started being accepted in #3850.

Environment

Item Value
Workflow Default Setup, dynamic/github-code-quality/codeql and code scanning default setup
CodeQL bundle / proxy codeql-bundle-v2.27.2, update-job-proxy 2.27.2 (commit: dev)
Runners GitHub-hosted ubuntu-latest and self-hosted (ARC); same behaviour
Registry maven_repository, https://<region>-maven.pkg.dev/<project>/<repo>, replaces_base: true
Auth oidc_gcp, workload_identity_provider set, no service_account, no audience

What happens

  1. "Setup proxy for registries" lists the registry with the GCP Workload Identity Provider, and proxy.log shows:
    registered gcp OIDC credentials for maven repository: https://<region>-maven.pkg.dev/<project>/<repo>
  2. Google STS logs show a successful token exchange for the job's OIDC subject (repo:<org>/<repo>:ref:refs/pull/<n>/head) right after the proxy starts.
  3. Every artifact request through the proxy then gets 401:
    [014] 401 https://<region>-maven.pkg.dev:443/<project>/<repo>/com/fasterxml/.../x.jar
    Remote response: {"error":"Unauthenticated request. Unauthenticated requests do not have permission \"artifactregistry.repositories.downloadArtifacts\" ..."}
    Artifact Registry audit logs show these requests with empty authenticationInfo (anonymous).
  4. The proxy then falls back to repo.maven.apache.org for each artifact despite replaces_base: true.

Why we think the token is fine

  • The same Workload Identity provider and IAM binding (principalSet://.../attribute.repository_owner/<org>, roles/artifactregistry.reader) authenticate normal workflows to the same Maven repository (federated token as oauth2accesstoken password): requests appear with the federated principal and succeed.
  • If we write our own Maven settings.xml with that federated token, Maven's requests go through the CodeQL proxy and succeed (200). Only requests that rely on the proxy to add credentials fail: the dependency fetches made by the Java extractor in build-mode: none.
  • Possibly relevant: the proxy logs request URLs with an explicit port (https://<host>:443/...) while the credentials are registered for https://<host>/....

Expected

The proxy attaches the federated access token (e.g. Basic oauth2accesstoken:<token>) to requests matching the registry URL, as it does for the OIDC providers fixed in #3838, and does not fall back to Maven Central when replaces_base is true.

Happy to share full proxy logs privately.

Lingua principale
TypeScript
Stelle
1.7k
Fork
498
Merge medio
1g 17h
PR unite (30g)
56

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di github/codeql-action

Tutte le issue di github/codeql-action

Issue simili

Altre issue su TypeScript

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.