From 02da796c397e056a71f36447bc4a14b82719969a Mon Sep 17 00:00:00 2001 From: Reshmi Date: Mon, 8 Jun 2026 15:36:06 +0530 Subject: [PATCH 1/4] RTECO 1296 fix repeated 401 errors before fallback authentication --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index e10c4379c..304c221c0 100644 --- a/go.mod +++ b/go.mod @@ -249,6 +249,6 @@ require ( // replace github.com/jfrog/build-info-go => github.com/jfrog/build-info-go v1.13.1-0.20260428071432-1e9d9a1991ad -// replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260518123155-036d9195c4e9 +replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260608100004-84615ce7840d //replace github.com/jfrog/jfrog-client-go => github.com/jfrog/jfrog-client-go v1.54.2-0.20251007084958-5eeaa42c31a6 diff --git a/go.sum b/go.sum index 6a3ee31a0..fed8a3e02 100644 --- a/go.sum +++ b/go.sum @@ -414,8 +414,8 @@ github.com/jfrog/jfrog-cli-application v1.0.2-0.20260511133105-55a0ab56fd64 h1:b github.com/jfrog/jfrog-cli-application v1.0.2-0.20260511133105-55a0ab56fd64/go.mod h1:cKqb/JgN+XuD4RhOxvSZnyGyXw3cJsTZfQT3rk9MCho= github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260603105750-3886c0f01286 h1:IF9Fyhfd7hilnuHO2AezV3lE9SF2FSxRxs4gfcU3f1U= github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260603105750-3886c0f01286/go.mod h1:GQEGVW3wT1XPykXNsEiPQrF8/+01JvDVcGGYb5vqJuE= -github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260601130310-8d52a530da18 h1:tPv7XscDFAZaijVwMQNb+HmuucUMYQdjuA5frdGzhF0= -github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260601130310-8d52a530da18/go.mod h1:9R90mhbczGXwW5EGlDs7F08ejQU/xdoDhYHMvzBiqgE= +github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260608100004-84615ce7840d h1:GX8JF/MrAaW61zYoiUgAFKG+yHP7j0NunNgytdRWzIU= +github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260608100004-84615ce7840d/go.mod h1:9R90mhbczGXwW5EGlDs7F08ejQU/xdoDhYHMvzBiqgE= github.com/jfrog/jfrog-cli-evidence v0.9.5-0.20260601141509-8df6c9a4bc9b h1:V0FxnU3xh29y8yJHWymm6rPr1MrjG1DdPQlr3ckImwk= github.com/jfrog/jfrog-cli-evidence v0.9.5-0.20260601141509-8df6c9a4bc9b/go.mod h1:t2luv7YHtrKe/Yf1xLZgLOkkiPtk1DsKj0OLXL2GwYo= github.com/jfrog/jfrog-cli-platform-services v1.10.1-0.20260601140139-4cefb6add7b7 h1:wqOk6luH2NFVhK+3p7DyHCa0e5Prie4QQpo5hPyCFwI= From d6321c71f6987005739dd2fb3c66d61504a5e356 Mon Sep 17 00:00:00 2001 From: Reshmi Date: Mon, 8 Jun 2026 15:50:13 +0530 Subject: [PATCH 2/4] Revert Fix reference token privilege escalation (#1540) --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 304c221c0..003f215f7 100644 --- a/go.mod +++ b/go.mod @@ -249,6 +249,6 @@ require ( // replace github.com/jfrog/build-info-go => github.com/jfrog/build-info-go v1.13.1-0.20260428071432-1e9d9a1991ad -replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260608100004-84615ce7840d +replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260608101344-b28be1f61ab7 //replace github.com/jfrog/jfrog-client-go => github.com/jfrog/jfrog-client-go v1.54.2-0.20251007084958-5eeaa42c31a6 diff --git a/go.sum b/go.sum index fed8a3e02..4d2404ee6 100644 --- a/go.sum +++ b/go.sum @@ -414,8 +414,8 @@ github.com/jfrog/jfrog-cli-application v1.0.2-0.20260511133105-55a0ab56fd64 h1:b github.com/jfrog/jfrog-cli-application v1.0.2-0.20260511133105-55a0ab56fd64/go.mod h1:cKqb/JgN+XuD4RhOxvSZnyGyXw3cJsTZfQT3rk9MCho= github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260603105750-3886c0f01286 h1:IF9Fyhfd7hilnuHO2AezV3lE9SF2FSxRxs4gfcU3f1U= github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260603105750-3886c0f01286/go.mod h1:GQEGVW3wT1XPykXNsEiPQrF8/+01JvDVcGGYb5vqJuE= -github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260608100004-84615ce7840d h1:GX8JF/MrAaW61zYoiUgAFKG+yHP7j0NunNgytdRWzIU= -github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260608100004-84615ce7840d/go.mod h1:9R90mhbczGXwW5EGlDs7F08ejQU/xdoDhYHMvzBiqgE= +github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260608101344-b28be1f61ab7 h1:xWWYSaAZfOk62pkySylGT9pqSNzycMYM+hqYWQkc95k= +github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260608101344-b28be1f61ab7/go.mod h1:9R90mhbczGXwW5EGlDs7F08ejQU/xdoDhYHMvzBiqgE= github.com/jfrog/jfrog-cli-evidence v0.9.5-0.20260601141509-8df6c9a4bc9b h1:V0FxnU3xh29y8yJHWymm6rPr1MrjG1DdPQlr3ckImwk= github.com/jfrog/jfrog-cli-evidence v0.9.5-0.20260601141509-8df6c9a4bc9b/go.mod h1:t2luv7YHtrKe/Yf1xLZgLOkkiPtk1DsKj0OLXL2GwYo= github.com/jfrog/jfrog-cli-platform-services v1.10.1-0.20260601140139-4cefb6add7b7 h1:wqOk6luH2NFVhK+3p7DyHCa0e5Prie4QQpo5hPyCFwI= From 3b5c6da1aabaec0ad5bbe28adf724706d6b9f1d8 Mon Sep 17 00:00:00 2001 From: Reshmi Date: Mon, 8 Jun 2026 16:48:19 +0530 Subject: [PATCH 3/4] add e2e for basic auth --- artifactory_test.go | 39 +++++++++++++++++++++++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/artifactory_test.go b/artifactory_test.go index c4ba40f42..9d5bd245b 100644 --- a/artifactory_test.go +++ b/artifactory_test.go @@ -6563,6 +6563,45 @@ func TestRefreshableArtifactoryTokens(t *testing.T) { cleanArtifactoryTest() } +// TestBasicAuthRefreshTokenAndPing verifies the username/password (basic auth) flow end to end: +// configuring a server with user + password arms deferred refreshable-token creation, and the first +// command (ping) authenticates successfully and triggers creation of the refreshable Artifactory token. +func TestBasicAuthRefreshTokenAndPing(t *testing.T) { + initArtifactoryTest(t, "") + + // This flow is only relevant for username/password authentication. + if *tests.JfrogAccessToken != "" { + t.Skip("Test only with username and password, skipping...") + } + + // Configure a server with username + password. No token is created at this point + _, err := createServerConfigAndReturnPassphrase(t) + defer deleteServerConfig(t) + assert.NoError(t, err) + + // Right after 'config add' there is no refreshable token yet, only the armed refresh interval. + preDetails, err := config.GetSpecificConfig(tests.ServerId, false, false) + assert.NoError(t, err) + assert.Empty(t, preDetails.AccessToken, "no access token should exist before the first command") + assert.Empty(t, preDetails.ArtifactoryRefreshToken, "no refresh token should exist before the first command") + assert.Equal(t, coreutils.TokenRefreshDefaultInterval, preDetails.ArtifactoryTokenRefreshInterval, + "the refresh interval should be armed so the token is created on the first command") + + // Run ping using only the stored server-id (no inline credentials), so the CLI authenticates with + // the configured username/password and creates the refreshable token as part of the command. + err = coretests.NewJfrogCli(execMain, "jfrog rt", "--server-id="+tests.ServerId).Exec("ping") + assert.NoError(t, err, "ping should succeed using the configured username/password") + + // Assert the refreshable Artifactory token was generated by the basic-auth flow. + curAccessToken, curRefreshToken, curArtifactoryRefreshToken, err := getTokensFromConfig(t) + assert.NoError(t, err) + assert.NotEmpty(t, curAccessToken, "an access token should be created after the first command") + assert.NotEmpty(t, curArtifactoryRefreshToken, "an Artifactory refresh token should be created after the first command") + assert.Empty(t, curRefreshToken, "the access refresh token must remain empty for the Artifactory-API flow") + + cleanArtifactoryTest() +} + func setArtifactoryRefreshTokenInConfig(t *testing.T, serverId, token string) error { details, err := config.GetAllServersConfigs() if err != nil { From 6f5c60897f3a30b24bd0a345d1ab4559e999fca4 Mon Sep 17 00:00:00 2001 From: Reshmi Date: Tue, 9 Jun 2026 10:16:22 +0530 Subject: [PATCH 4/4] update cli core deps --- go.mod | 4 ++-- go.sum | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/go.mod b/go.mod index 003f215f7..10840aa1c 100644 --- a/go.mod +++ b/go.mod @@ -22,7 +22,7 @@ require ( github.com/jfrog/gofrog v1.7.6 github.com/jfrog/jfrog-cli-application v1.0.2-0.20260511133105-55a0ab56fd64 github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260603105750-3886c0f01286 - github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260601130310-8d52a530da18 + github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260608181453-edba164ca573 github.com/jfrog/jfrog-cli-evidence v0.9.5-0.20260601141509-8df6c9a4bc9b github.com/jfrog/jfrog-cli-platform-services v1.10.1-0.20260601140139-4cefb6add7b7 github.com/jfrog/jfrog-cli-security v1.29.3 @@ -249,6 +249,6 @@ require ( // replace github.com/jfrog/build-info-go => github.com/jfrog/build-info-go v1.13.1-0.20260428071432-1e9d9a1991ad -replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260608101344-b28be1f61ab7 +// replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260608101344-b28be1f61ab7 //replace github.com/jfrog/jfrog-client-go => github.com/jfrog/jfrog-client-go v1.54.2-0.20251007084958-5eeaa42c31a6 diff --git a/go.sum b/go.sum index 4d2404ee6..057508495 100644 --- a/go.sum +++ b/go.sum @@ -414,8 +414,8 @@ github.com/jfrog/jfrog-cli-application v1.0.2-0.20260511133105-55a0ab56fd64 h1:b github.com/jfrog/jfrog-cli-application v1.0.2-0.20260511133105-55a0ab56fd64/go.mod h1:cKqb/JgN+XuD4RhOxvSZnyGyXw3cJsTZfQT3rk9MCho= github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260603105750-3886c0f01286 h1:IF9Fyhfd7hilnuHO2AezV3lE9SF2FSxRxs4gfcU3f1U= github.com/jfrog/jfrog-cli-artifactory v0.8.1-0.20260603105750-3886c0f01286/go.mod h1:GQEGVW3wT1XPykXNsEiPQrF8/+01JvDVcGGYb5vqJuE= -github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260608101344-b28be1f61ab7 h1:xWWYSaAZfOk62pkySylGT9pqSNzycMYM+hqYWQkc95k= -github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260608101344-b28be1f61ab7/go.mod h1:9R90mhbczGXwW5EGlDs7F08ejQU/xdoDhYHMvzBiqgE= +github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260608181453-edba164ca573 h1:04OOWU1PRShmy5AffB81v9Zo94MZ+Ffp5Z2YSo+185U= +github.com/jfrog/jfrog-cli-core/v2 v2.60.1-0.20260608181453-edba164ca573/go.mod h1:9R90mhbczGXwW5EGlDs7F08ejQU/xdoDhYHMvzBiqgE= github.com/jfrog/jfrog-cli-evidence v0.9.5-0.20260601141509-8df6c9a4bc9b h1:V0FxnU3xh29y8yJHWymm6rPr1MrjG1DdPQlr3ckImwk= github.com/jfrog/jfrog-cli-evidence v0.9.5-0.20260601141509-8df6c9a4bc9b/go.mod h1:t2luv7YHtrKe/Yf1xLZgLOkkiPtk1DsKj0OLXL2GwYo= github.com/jfrog/jfrog-cli-platform-services v1.10.1-0.20260601140139-4cefb6add7b7 h1:wqOk6luH2NFVhK+3p7DyHCa0e5Prie4QQpo5hPyCFwI=