jfrog / jfrog/jfrog-cli

Allow overriding the JFrog CLI certificates directory

Open
#3,661 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

feature request
Dominant language
Go
Stars
595
Forks
307
Avg merge
4d 17h
Merged PRs (30d)
17

Description

Is your feature request related to a problem? Please describe.
JFrog CLI currently loads custom CA certificates only from

$JFROG_CLI_HOME_DIR/security/certs

This makes the certificates directory dependent on the CLI home directory.

In some CI environments, JFROG_CLI_HOME_DIR is managed dynamically by the integration.
For example, the JFrog Jenkins Plugin creates a per-build CLI home under a path similar to:

$WORKSPACE_TMP/jfrog/<build-number>/.jfrog

This makes it difficult to provide centrally managed CA certificates, for example trough a Kubernetes secret mounted at fixed path.

Describe the solution you'd like to see
Add a new environment variable such as

JFROG_CLI_CERTS_DIR

When set, JFrog CLI should use this directory for custom CA certificates.

Describe alternatives you've considered

  • Changing home dir path, but this is not always possible because CI integrations may override it.
  • Adding the CA to the container's system trust store, but this is not practical when CI users provide their own container images
  • Copying the CA into the dynamically created JFrog CLI home dir during build, which adds CI-specific workarounds and knowledge of the generated CLI home path.

Additional context
A seperate certificate direcory would be useful for:

  • immutable container images
  • centrally manged enterprise PKI
  • Jenkins and other CI-system using temporary or per-build CLI home dirs.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No implementation files or tests are named in the issue. Start by locating the JFrog CLI code that loads custom CA certificates from $JFROG_CLI_HOME_DIR/security/certs, then trace its environment-variable handling; done means JFROG_CLI_CERTS_DIR selects an alternate certificate directory while the existing default still works, with coverage for both paths.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, security
Issue type
Feature
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.