jenkinsci / jenkinsci/jfrog-plugin

Use system credential instead of global one

Open
#31 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Java
Stars
16
Forks
85
PR merge metrics
No merged PRs in 30d

Description

Describe the bug

the plugin currently only accepts global credentials that are available to all jenkins users/jobs/.. This poses a security risk as this credential can be read by any user. Instead the plugin should be able to accept a system credential which can only be accessed by jenkins administrators

Current behavior

see above

Reproduction steps

No response

Expected behavior

No response

JFrog plugin version

1.5.0

JFrog CLI version

2.56.1

Operating system type and version

linux

JFrog Artifactory version

No response

JFrog Xray version

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating how the plugin currently retrieves and configures Jenkins credentials for JFrog CLI operations. Trace the credential selection and permission checks, then verify that a system credential can be used by administrators without exposing it to other Jenkins users or jobs.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
devops, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.