Skip to content

Allow overriding the JFrog CLI certificates directory #3661

Description

@andreasvikke

Is your feature request related to a problem? Please describe.
JFrog CLI currently loads custom CA certificates only from

$JFROG_CLI_HOME_DIR/security/certs

This makes the certificates directory dependent on the CLI home directory.

In some CI environments, JFROG_CLI_HOME_DIR is managed dynamically by the integration.
For example, the JFrog Jenkins Plugin creates a per-build CLI home under a path similar to:

$WORKSPACE_TMP/jfrog/<build-number>/.jfrog

This makes it difficult to provide centrally managed CA certificates, for example trough a Kubernetes secret mounted at fixed path.

Describe the solution you'd like to see
Add a new environment variable such as

JFROG_CLI_CERTS_DIR

When set, JFrog CLI should use this directory for custom CA certificates.

Describe alternatives you've considered

  • Changing home dir path, but this is not always possible because CI integrations may override it.
  • Adding the CA to the container's system trust store, but this is not practical when CI users provide their own container images
  • Copying the CA into the dynamically created JFrog CLI home dir during build, which adds CI-specific workarounds and knowledge of the generated CLI home path.

Additional context
A seperate certificate direcory would be useful for:

  • immutable container images
  • centrally manged enterprise PKI
  • Jenkins and other CI-system using temporary or per-build CLI home dirs.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions