Skip to content

Retry GetBuildInfo to absorb Artifactory index propagation lag #3682

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
agrasth wants to merge 2 commits into
base: master
Choose a base branch
from
+37 −6
Open

Retry GetBuildInfo to absorb Artifactory index propagation lag #3682

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
eabac66
Retry GetBuildInfo to absorb Artifactory index propagation lag
agrasth Aug 25, 2026
6e10efb
Fix CI lint: migrate reverse-proxy test helper off deprecated Director
agrasth Aug 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 10 additions & 5 deletions utils/tests/proxy/server/server.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,16 +47,21 @@ func getReverseProxyHandler(targetUrl string) (*httputil.ReverseProxy, error) {
return nil, err
}
origHost := target.Host
d := func(req *http.Request) {
req.URL.Host = origHost
req.Host = origHost
req.URL.Scheme = target.Scheme
// Rewrite replaces the deprecated Director (Go 1.26, staticcheck SA1019).
// pr.Out is a clone of pr.In that ReverseProxy sends upstream; unlike a
// nil Rewrite's defaults, defining this func means no other header
// rewriting happens automatically (X-Forwarded-For, etc.) -- matching
// Director's behavior exactly, since Director never set defaults either.
rewrite := func(pr *httputil.ProxyRequest) {
pr.Out.URL.Host = origHost
pr.Out.Host = origHost
pr.Out.URL.Scheme = target.Scheme
}
tr := &http.Transport{
TLSClientConfig: &tls.Config{InsecureSkipVerify: true},

@github-actions github-actions Bot Aug 25, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Static Application Security Testing (SAST) Vulnerability

Severity Finding
high
High		 TLS settings are configured insecurely, exposing communications to risks
Full description

Vulnerability Details
Rule ID: go-insecure-tls

Overview

Insecure TLS Configuration is a type of vulnerability that occurs when an
application uses weak or outdated cryptographic protocols, ciphers, or
configurations for secure communication over the network.

Vulnerable example

package main

import (
    "crypto/tls"
)

func main() {}

func insecureMinMaxTlsVersion() {
    {
        config := &tls.Config{}
        config.MinVersion = 0
    }
    {
        config := &tls.Config{}
        config.MinVersion = tls.VersionSSL30
    }
    {
        config := &tls.Config{}
        config.MaxVersion = tls.VersionSSL30
    }
    {
        config := &tls.Config{}
    }
}

func insecureCipherSuites() {
    config := &tls.Config{
        CipherSuites: []uint16{
            tls.TLS_RSA_WITH_RC4_128_SHA,
        },
    }
    _ = config
}

In this example, the MinVersion field is set to tls.VersionSSL30, which
uses the outdated SSL 3.0 protocol, making the application vulnerable to
attacks such as POODLE.

Remediation

package main

import (
    "crypto/tls"
)

func main() {}

func insecureMinMaxTlsVersion() {
    {
        config := &tls.Config{}
-       config.MinVersion = 0
+       config.MinVersion = tls.VersionTLS12
    }
    {
        config := &tls.Config{}
-       config.MinVersion = tls.VersionSSL30
+       config.MinVersion = tls.VersionTLS12
    }
    {
        config := &tls.Config{}
-       config.MaxVersion = tls.VersionSSL30
    }
    {
-       config := &tls.Config{}
+       config := &tls.Config{MinVersion: tls.VersionTLS12}
    }
}

func insecureCipherSuites() {
    config := &tls.Config{
        CipherSuites: []uint16{
-           tls.TLS_RSA_WITH_RC4_128_SHA,
+           tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
        },
+       MinVersion: tls.VersionTLS12,
    }
    _ = config
}

By using safe TLS versions (e.g., tls.VersionTLS12) and secure cipher suites we can
mitigate the risk of insecure TLS configurations and improve the security of the
application.

}
proxyErrLogger := log.New(os.Stdout, "PROXY-LOGGER", log.Ldate|log.Ltime|log.Lshortfile)
p := &httputil.ReverseProxy{Director: d, Transport: tr, ErrorLog: proxyErrLogger}
p := &httputil.ReverseProxy{Rewrite: rewrite, Transport: tr, ErrorLog: proxyErrLogger}
return p, nil
}

Expand Down
28 changes: 27 additions & 1 deletion utils/tests/utils.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -283,7 +283,24 @@ func DeleteFiles(deleteSpec *spec.SpecFiles, serverDetails *config.ServerDetails
return deleteCommand.DeleteFiles(reader)
}

// buildInfoIndexRetries and buildInfoIndexBackoff bound the retry in
// GetBuildInfo below: Artifactory's build-info search index can lag a
// freshly-published build by a second or two, especially under concurrent
// CI load (many PM compatibility tests hitting the same instance at once).
// Total worst-case wait is ~7.5s (0.5+1+2+4), which is negligible next to
// the seconds a full PM test takes, but eliminates a whole class of
// "Build info was not found" false failures immediately after a publish.
const (
buildInfoIndexRetries = 4
buildInfoIndexBackoff = 500 * time.Millisecond
)

// This function makes no assertion, caller is responsible to assert as needed.
//
// Retries when the build info is genuinely not there yet (found=false,
// err=nil is Artifactory's 404 signal — see BuildInfoService.GetBuildInfo)
// to absorb search-index propagation lag right after a publish. Any real
// error is returned immediately, unretried, exactly as before.
func GetBuildInfo(serverDetails *config.ServerDetails, buildName, buildNumber string) (pbi *buildinfo.PublishedBuildInfo, found bool, err error) {
servicesManager, err := artUtils.CreateServiceManager(serverDetails, -1, 0, false)
if err != nil {
Expand All @@ -292,7 +309,16 @@ func GetBuildInfo(serverDetails *config.ServerDetails, buildName, buildNumber st
params := services.NewBuildInfoParams()
params.BuildName = buildName
params.BuildNumber = buildNumber
return servicesManager.GetBuildInfo(params)

wait := buildInfoIndexBackoff
for attempt := 0; ; attempt++ {
pbi, found, err = servicesManager.GetBuildInfo(params)
if err != nil || found || attempt == buildInfoIndexRetries {
return pbi, found, err
}
time.Sleep(wait)
wait *= 2
}
}

func GetBuildRuns(serverDetails *config.ServerDetails, buildName string) (pbi *buildinfo.BuildRuns, found bool, err error) {
Expand Down
Loading