Is "JFrog - Retrieve Artifact" change in JFrog Artifactory action pack, version 10.8.1506 described correctly?

[Anon Anon]

The "What's New" section at  JFrog Artifactory - CA Release Automation - 6.0 - CA Technologies Documentation reads as follows:

What's New

The following update was made for 10.8.1506.

• The JFrog password is masked and no longer written as plain text in the Nolio agent log.
• To run the action, "JFrog - Retrieve Artifact" requires users to have JFrog Artifactory admin privileges.

 

Is the second bullet point correct? It seems that it should indicate that the action *does not require* admin privileges. That would represent a fix to a problem reported a few months ago.

[Anon Anon]

Having tested the new version of the jfrog plugin for a fix to the need for admin privileged artifactory credentials when retrieving an artifact, I can see no change in behavior over previous versions of the action pack. The nolio_all.log file on the agent running the "JFrog - Retrieve Artifact" action still indicates that prior to actually attempting to download the specified artifact, a directory listing api call is made to artifactory that does require higher privileges than is necessary to download a specific artifact.

 

 

When tested, this action produces the following log entries:

 

2016-06-03 09:23:42,882 [job-66151-jobServer-66274-6:JFrog - Retrieve Artifacts(P877.F16246.E16247):JFrog - Retrieve Artifacts] DEBUG (com.nolio.platform.shared.executables.actions.jfrog.RetrieveArtifactAction:184) - repository check URL :: http://<ip address>:8081/artifactory/api/repositories/ext

2016-06-03 09:23:42,882 [job-66151-jobServer-66274-6:JFrog - Retrieve Artifacts(P877.F16246.E16247):JFrog - Retrieve Artifacts] DEBUG (com.nolio.platform.shared.executables.actions.jfrog.utils.Utils:430) - username :: ***************

2016-06-03 09:23:42,913 [job-66151-jobServer-66274-6:JFrog - Retrieve Artifacts(P877.F16246.E16247):JFrog - Retrieve Artifacts] DEBUG (com.nolio.platform.shared.executables.actions.jfrog.RetrieveArtifactAction:189) - repositoryResponse :: HTTP/1.1 401 Unauthorized

2016-06-03 09:23:42,913 [job-66151-jobServer-66274-6:JFrog - Retrieve Artifacts(P877.F16246.E16247):JFrog - Retrieve Artifacts] DEBUG (com.nolio.platform.shared.executables.actions.jfrog.RetrieveArtifactAction:236) - Error in validating repository

2016-06-03 09:23:42,913 [job-66151-jobServer-66274-6:JFrog - Retrieve Artifacts(P877.F16246.E16247):JFrog - Retrieve Artifacts] INFO  (com.nolio.platform.shared.datamodel.Action:334) - ------------------------Finished action [JFrog - Retrieve Artifacts(P877.F16246.E16247):JFrog - Retrieve Artifacts] result [false, There is an error while fetching Repository details. Please refer logs.]------------------------

 

Having upgraded the jfrog action pack prior to this test, I have the following jfrog related jars in the agent's actionslib directory:

 

6/2/2016   6:10 PM               0   nolio-jfrog-actions-10.8.1505.1.jar

6/2/2016   6:10 PM     213707   nolio-jfrog-actions-10.8.1506.1.jar

 

So, the same question remains for version 1506.1 as we had with 1505.1 with respect to the "JFrog - Retrieve Artifacts" action... why is an api call that requires admin privileges being run as a repo check prior to a artifact retrieval that requires no authentication at all?

[tamme01]

Updated Artifactory JFrog action pack (v10.8.1508) is now available for download. This action pack resolves 2 issue:

(1) jFrog Actions not supporting dash/hyphen in hostname

(2)jFrog retrieve artifact action required Admin rights