GOPROXY pointing to a (basic auth secured) JFrog Artifactory URL leads to a 401 "Failed to decode basic authentication token"

[aboukhal]

What would you like help with?

I think I found a bug

How are you running Renovate?

Self-hosted

If you're self-hosting Renovate, tell us which platform (GitHub, GitLab, etc) and which version of Renovate.

Version 37.438.3-full on OpenShift

Please tell us more about your question or problem

We are using JFrog Artifactory as a proxy for the official Go Proxy because we are running in an airgapped environment.
We have configured it through setting the appropriate GOPROXY and GOSUMDB environment variables.

When running Renovate in DEBUG log level, it encounters a 401 (Unauthorized) error.
The configuration seems to be properly picked up as it is sending the GET to https://**redacted**@our.artifactory/artifactory/api/go/our-go-repo/github.com/sigstore/cosign/v2/@v/list. It receives a message from the server of Failed to decode basic authentication token. Looking at the Artifactory source code, this happens if the received token is not Base64 encoded.

The URL is correct and if we replace **redacted** with the actual credentials from the environment variable, we receive the proper response with the version numbers.

It feels like the only place left is the **redacted** bit. Are the credentials being mangled in this call somehow (not properly Base64 encoded)? Is there a way to temporarily disable sanitation of the secrets in the log for testing purposes?

renovate/lib/modules/datasource/go/releases-goproxy.ts

Line 132 in 6ef9445

const url = `${baseUrl}/${this.encodeCase(packageName)}/@v/list`;

Logs (if relevant)

Logs

DEBUG: Goproxy error: trying next URL provided with GOPROXY
(repository=OUR_PROJECT/go-renovatedev)
       "err": {
         "name": "HTTPError",
         "code": "ERR_NON_2XX_3XX_RESPONSE",
         "timings": {
           "start": 1721655432891,
           "socket": 1721655432891,
           "lookup": 1721655432893,
           "connect": 1721655432896,
           "secureConnect": 1721655432902,
           "upload": 1721655432902,
           "response": 1721655432923,
           "end": 1721655432924,
           "phases": {
             "wait": 0,
             "dns": 2,
             "tcp": 3,
             "tls": 6,
             "request": 0,
             "firstByte": 21,
             "download": 1,
             "total": 33
           }
         },
         "message": "Response code 401 (Unauthorized)",
         "stack": "HTTPError: Response code 401 (Unauthorized)\n    at
Request.<anonymous>
([/usr/local/renovate/node_modules/.pnpm/got@11.8.6/node_modules/got/dist/source/as-promise/index.js:118:42)\n](mailto:/usr/local/renovate/node_modules/.pnpm/got@11.8.6/node_modules/got/dist/source/as-promise/index.js:118:42)\n)
    at processTicksAndRejections (node:internal/process/task_queues:95:5)",
         "options": {
           "headers": {
             "user-agent": "RenovateBot/37.438.3 (
https://github.com/renovatebot/renovate)",
             "authorization": "***********",
             "accept-encoding": "gzip, deflate, br"
           },
           "url": "https://**redacted**@our.artifactory/artifactory/api/go/our-go-repo/github.com/sigstore/cosign/v2/@v/list",
           "hostType": "go-proxy",
           "username": "OUR_USER",
           "password": "***********",
           "method": "GET",
           "http2": false
         },
         "response": {
           "statusCode": 401,
           "statusMessage": "Unauthorized",
           "body": "{\n  \"errors\" : [ {\n    \"status\" : 401,\n
\"message\" : \"Failed to decode basic authentication token\"\n  } ]\n}",
           "headers": {
             "date": "Mon, 22 Jul 2024 13:37:12 GMT",
             "server": "Apache/2.4.37 (Red Hat Enterprise Linux)
OpenSSL/1.1.1k",
             "x-content-type-options": "nosniff",
             "strict-transport-security": "",
             "www-authenticate": "Basic realm=\"Artifactory Realm\"",
             "content-type": "application/json;charset=ISO-8859-1",
             "content-length": "108",
             "connection": "close"
           },
           "httpVersion": "1.1",
           "retryCount": 0
         }
       }
DEBUG: Failed to look up go package github.com/sigstore/cosign/v2

[aboukhal]

I was able to solve this myself. There is some strange interaction going on between hostRules and the GOPROXY. After making sure that all hostRules had a hostType and I wasn't using a generic host rule any more, Renovate did not alter the GOPROXY on the flight.

Everything works as intended. The documentation did not state any interaction between hostRules and GOPROXY, however.