From 54e1f72bc9526f4bb9bc763946386b8d12ce7c23 Mon Sep 17 00:00:00 2001 From: "Sean E. Millichamp" Date: Tue, 18 Aug 2026 14:05:17 -0400 Subject: [PATCH] Pass Forge auth token to module resolution If the user has configured an authentication token for a Forge API-compatible endpoint, and if the user is running a version of puppetfile-resolver which supports receiving configuration for an authentication token, then pass it. Otherwise, warn the user that the metadata retrieval will not be authenticated. This is required for JFrog Artifactory Puppet repositories starting with Artifactory Self-Managed 7.161.16 or Artifactory SaaS 7.164.0, which resolved CVE-2026-66379. Signed-off-by: Sean E. Millichamp --- lib/bolt/module_installer/resolver.rb | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/lib/bolt/module_installer/resolver.rb b/lib/bolt/module_installer/resolver.rb index 86816f9e8..11c58189e 100644 --- a/lib/bolt/module_installer/resolver.rb +++ b/lib/bolt/module_installer/resolver.rb @@ -63,6 +63,15 @@ def resolve(specs, config = {}) obj.forge.proxy = config.dig('forge', 'proxy') || config.dig('proxy') obj.git.proxy = config.dig('proxy') obj.forge.forge_api = config.dig('forge', 'baseurl') + auth_token = config.dig('forge', 'authorization_token') + next if auth_token.nil? + + if obj.forge.respond_to?(:token) + obj.forge.token = auth_token + else + logger = Bolt::Logger.logger(self) + logger.warn("Unable to authenticate for metadata retrieval when using puppetfile-resolver <= 0.6.3") + end end end