Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Default Setup: GCP OIDC private registry (Artifact Registry, Maven) registered but requests sent unauthenticated (401)

オープン
  • 何か問題がありますか？
#4,229 コメント 1 件 リアクション 0 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

まだ誰も着手していません。

評価

難易度
4/5
見積もり時間
3〜5日
初心者へのやさしさ
18/100
issue の種類
バグ
明瞭さ
おおむね明確
活発さ
活発
技術スタック
gcp, github-actions, java, typescript
領域
authentication, build-system

調査の方向性

Start from the proxy log lines this report quotes: the 'registered gcp OIDC credentials for maven repository' message and the 401s. Compare the registered URL (no port) with the requested URL (':443'), since the report suspects that mismatch. The payload does not name source files, so locate the credential-matching code by searching for 'oidc_gcp' and the registry URL. Done means proxy requests to the registry carry the federated token and no fallback to Maven Central occurs when replaces_base is true, which needs a GCP setup to verify.

索引モデルが issue の本文から書いたものです。

説明

Summary

Default Setup (Code Quality and code scanning, Java, build-mode: none) with an organization-level maven_repository private registry on Google Artifact Registry using GCP OIDC (auth_type: oidc_gcp, direct Workload Identity Federation, no service account). The proxy registers the credentials and the token exchange succeeds, but requests to the registry are sent without credentials, so every artifact returns 401. This looks like the GCP equivalent of #3838, after GCP OIDC configurations started being accepted in #3850.

Environment

Item Value
Workflow Default Setup, dynamic/github-code-quality/codeql and code scanning default setup
CodeQL bundle / proxy codeql-bundle-v2.27.2, update-job-proxy 2.27.2 (commit: dev)
Runners GitHub-hosted ubuntu-latest and self-hosted (ARC); same behaviour
Registry maven_repository, https://<region>-maven.pkg.dev/<project>/<repo>, replaces_base: true
Auth oidc_gcp, workload_identity_provider set, no service_account, no audience

What happens

  1. "Setup proxy for registries" lists the registry with the GCP Workload Identity Provider, and proxy.log shows:
    registered gcp OIDC credentials for maven repository: https://<region>-maven.pkg.dev/<project>/<repo>
  2. Google STS logs show a successful token exchange for the job's OIDC subject (repo:<org>/<repo>:ref:refs/pull/<n>/head) right after the proxy starts.
  3. Every artifact request through the proxy then gets 401:
    [014] 401 https://<region>-maven.pkg.dev:443/<project>/<repo>/com/fasterxml/.../x.jar
    Remote response: {"error":"Unauthenticated request. Unauthenticated requests do not have permission \"artifactregistry.repositories.downloadArtifacts\" ..."}
    Artifact Registry audit logs show these requests with empty authenticationInfo (anonymous).
  4. The proxy then falls back to repo.maven.apache.org for each artifact despite replaces_base: true.

Why we think the token is fine

  • The same Workload Identity provider and IAM binding (principalSet://.../attribute.repository_owner/<org>, roles/artifactregistry.reader) authenticate normal workflows to the same Maven repository (federated token as oauth2accesstoken password): requests appear with the federated principal and succeed.
  • If we write our own Maven settings.xml with that federated token, Maven's requests go through the CodeQL proxy and succeed (200). Only requests that rely on the proxy to add credentials fail: the dependency fetches made by the Java extractor in build-mode: none.
  • Possibly relevant: the proxy logs request URLs with an explicit port (https://<host>:443/...) while the credentials are registered for https://<host>/....

Expected

The proxy attaches the federated access token (e.g. Basic oauth2accesstoken:<token>) to requests matching the registry URL, as it does for the OIDC providers fixed in #3838, and does not fall back to Maven Central when replaces_base is true.

Happy to share full proxy logs privately.

主要言語
TypeScript
スター
1.7k
フォーク
498
平均マージ
1日 17時間
マージ済み PR（30日）
56

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

github/codeql-action のほかの issue

github/codeql-action の issue をすべて見る

似ている issue

TypeScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。