Frogbot.sh used creds when not needed, breaking the working
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 372
- Forks
- 107
- Avg merge
- 2d 20h
- Merged PRs (30d)
- 5
Description
Describe the bug
Since 2.34.0 the 'download_to()' function was rewritten. It no longer checks if ${REMOTE_PATH} is set and just uses 'JF_USER' in the curl command.
This breaks the use case that we want to download Frogbot executable from JFrog directly but do have out own Artifactory that needs authentication. So JF_URL, JF_USER and JF_PASSWORD are set but only needed for the executable, not Frogbot.sh
Current behavior
But skipping the REMOTE_PATH check the current Frogbot.sh uses the JF_USER/JF_PASSWORD for the Jfrog which gives a 401. Which is correct as the user doesn't exists on release.jfrog.io.
Reproduction steps
No response
Expected behavior
No response
JFrog Frogbot version
2.34.0
Package manager info
NA
Git provider
GitHub
JFrog Frogbot configuration yaml file
none
Operating system type and version
x86 linux
JFrog Xray version
NA
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in Frogbot.sh at the download_to() function and trace how REMOTE_PATH, JF_USER, and JF_PASSWORD are used in the curl command. Reproduce the x86 Linux setup with JF_URL, JF_USER, and JF_PASSWORD set while downloading directly from release.jfrog.io. Done means the script downloads successfully without sending the Artifactory credentials when REMOTE_PATH is not set.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- shell
- Domain
- devops
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100