Overview:
In Artifactory, preventing accidental overwrites of deployed artifacts is essential for maintaining data integrity. This knowledge base provides instructions on how to prevent users or groups from overwriting artifacts.
Preventing Overwrites Using Permission Targets:
To avoid overwrites, administrators have the option to remove the "Delete/Overwrite" permission from users or groups responsible for deploying in the designated repository. By doing so, deployed artifacts are protected from unintentional overwrites. It's important to note that non-unique Maven snapshots can always be overwritten if the "Deploy" permission is granted.
That being said, please note that for the remote repository to function properly and to be able to serve fresh metadata, the “Delete/Overwrite” permission needs to be granted for the corresponding users or groups.
Refer to the Permission Details documentation for a deeper understanding of Artifactory permissions.
Utilizing User Plugin to Prevent Overwrites:
JFrog offers the Artifactory Restrict Overwrite User Plugin as an effective solution. This plugin prevents overwrites of artifacts within a specified set of repositories. It acts as a safeguard against accidental modifications to critical artifacts. With this plugin enabled, any attempt to deploy, move, or copy an artifact to a location where another artifact already exists will result in an error.
For in-depth information about the Artifactory Restrict Overwrite User Plugin, please visit our GitHub repository: Artifactory Restrict Overwrite User Plugin.
To deploy the Artifactory Restrict Overwrite User Plugin, follow the steps below:
1. On your Artifactory server, navigate to the directory '$JFROG_HOME/artifactory/var/etc/artifactory/plugins' and create a file named 'restrictOverwrite.groovy'.
2. Copy the content of this file and paste it in restrictOverwrite.groovy and save.
3. Create another file with the name restrictOverwrite.json and add the repositories you would like to restrict overwriting in this format then save:
["REPO_NAME_1","REPO_NAME_2"]
Replace the placeholders with the relevant repository names.
4. Execute the reload plugin REST API:
curl -u<ADMIN_USERNAME>:<PASSWORD> -X POST "https://<JFROG_URL>/artifactory/api/plugins/reload"
After following the above steps, overwriting artifacts in the repositories specified in the restrictOverwrite.json file will be restricted.
Using Workers:
This solution is natively supported on Cloud instances. For Self-hosted instances, it requires that both Artifactory and Workers are deployed via Kubernetes. In both cases, JFrog Advanced Security (JAS) must be enabled for this feature to work.
1. In the UI, navigate to the Administration module → Workers and click on ‘New Worker’ and ‘New Event Driven Worker’:
2. Click on ‘Add’ under ‘Before Upload’.
3. Click on the Drop down list under ‘Code samples’ and click on ‘restrict-overwrite’ and ‘Apply’:
4. Click the gear icon in the upper-right corner and add the repositories where you want to restrict artifact overwriting:
5. Enable the ‘Enable Worker’ toggle located in the top-right corner, and click Save to apply the changes.
By following these methods, Artifactory users can protect their repositories from unintended overwrites, guaranteeing the stability of their critical artifacts.