Skip to content

Signature validation - Fallback to use storage API#1337

Merged
orto17 merged 3 commits into
jfrog:devfrom
orto17:sig-validation-fix-v2
May 31, 2026
Merged

Signature validation - Fallback to use storage API#1337
orto17 merged 3 commits into
jfrog:devfrom
orto17:sig-validation-fix-v2

Conversation

@orto17

@orto17 orto17 commented May 28, 2026

Copy link
Copy Markdown
Contributor
  • All tests passed. If this feature is not already covered by the tests, I added new tests.
  • This pull request is on the dev branch.
  • I used gofmt for formatting the code before submitting the pull request.
  • Update documentation about new features / new supported technologies

@orto17 orto17 changed the title fallback to a different checksum api Signature validation - Fallback to use storage API May 28, 2026
@orto17 orto17 added the safe to test Approve running integration tests on a pull request label May 31, 2026
@github-actions github-actions Bot removed the safe to test Approve running integration tests on a pull request label May 31, 2026

@eranturgeman eranturgeman left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Review: Signature Validation — Storage API Fallback

Verdict: REQUEST_CHANGES

The verifyArtifact.sh fix is correct and solves the immediate release-pipeline failure. The refactoring into load_remote_checksums_jf/curlcompare_local_to_remote is clean.

One functional bug exists in getFrogbot.sh's storage_request(): the auth guard uses REMOTE_PATH as a proxy for "private instance" instead of checking for credentials directly. This diverges from the correct pattern already used in verifyArtifact_storage_request_curl() in the same PR, and will silently omit auth for users who set FROGBOT_BASE_URL without REMOTE_PATH.

CI status: Azure Integration Tests (all 3 platforms) and Bitbucket Server Integration Tests are failing. Please confirm whether these are pre-existing infrastructure failures or regressions introduced by this PR.

Comment thread buildscripts/getFrogbot.sh Outdated
Comment thread buildscripts/getFrogbot.sh Outdated
Comment thread release/buildAndUpload.sh
Comment thread buildscripts/verifyArtifact.sh
@orto17 orto17 added the safe to test Approve running integration tests on a pull request label May 31, 2026
@github-actions github-actions Bot removed the safe to test Approve running integration tests on a pull request label May 31, 2026
@orto17 orto17 merged commit dba75ae into jfrog:dev May 31, 2026
24 of 33 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants