From 3c68fadd0802d61925d3a26cbd291444d73697ef Mon Sep 17 00:00:00 2001 From: Daniel Mohedano Date: Mon, 11 May 2026 16:03:02 +0200 Subject: [PATCH 1/4] feat: add variables for base URL and auth headers for Java download --- README.md | 6 ++++-- install_test_visibility.sh | 38 +++++++++++++++++++++++++++++++------- 2 files changed, 35 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index 7158c9e..ffa236b 100644 --- a/README.md +++ b/README.md @@ -21,11 +21,13 @@ DD_CIVISIBILITY_INSTRUMENTATION_LANGUAGES=... DD_API_KEY=... ./install_test_visi The script parameters are - `DD_CIVISIBILITY_INSTRUMENTATION_LANGUAGES`: (required) List of languages to be instrumented. Can be either `all` or any of `java`, `js`, `python`, `dotnet`, `ruby`, `go` (multiple languages can be specified as a space-separated list). -- `DD_API_KEY`: (required for .NET tracer installation) Datadog API key. Can be found at https://app.datadoghq.com/organization-settings/api-keys +- `DD_API_KEY`: (required for .NET tracer installation) Datadog API key. Can be found at - `DD_TRACER_FOLDER`: (optional) The folder where the tracing libraries will be installed, defaults to `./.datadog` -- `DD_SITE`: (optional) Datadog site, defaults to US1. See https://docs.datadoghq.com/getting_started/site for more information about sites. +- `DD_SITE`: (optional) Datadog site, defaults to US1. See for more information about sites. - `DD_SET_TRACER_VERSION_DOTNET`: (optional) Version of the .NET tracer to install. If not provided, the latest version is installed. - `DD_SET_TRACER_VERSION_JAVA`: (optional) Version of the Java tracer to install (without the `v` prefix, e.g. `1.37.1`). If not provided, the latest version is installed. +- `DD_SET_TRACER_REPOSITORY_URL_JAVA`: (optional) Base URL of a Maven repository (or proxy/mirror) used to download the Java tracer JAR and its `.sha256`. The path under the base must follow the standard Maven layout for `com.datadoghq:dd-java-agent` (i.e. `//dd-java-agent-.jar`, plus `/maven-metadata.xml` when `DD_SET_TRACER_VERSION_JAVA` is not pinned). Trailing slashes are tolerated. Defaults to `https://repo1.maven.org/maven2/com/datadoghq/dd-java-agent`. +- `DD_SET_AUTH_HEADER_JAVA`: (optional) HTTP header used to authenticate against `DD_SET_TRACER_REPOSITORY_URL_JAVA`, provided as a complete `Name: Value` string (e.g. `Authorization: Bearer `). Passed verbatim to `curl -H` / `wget --header` on every Java tracer download. Only meaningful when `DD_SET_TRACER_REPOSITORY_URL_JAVA` is set. - `DD_SET_TRACER_VERSION_JS`: (optional) Version of the JS tracer to install. If not provided, the latest version is installed. - `DD_SET_TRACER_VERSION_PYTHON`: (optional) Version of the Python tracer to install. If not provided, the latest version is installed. - `DD_SET_COVERAGE_VERSION_PYTHON`: (optional) Version of the Python `coverage` package to install. Defaults to `7.13.5`. diff --git a/install_test_visibility.sh b/install_test_visibility.sh index 2d548ab..57aa9c7 100755 --- a/install_test_visibility.sh +++ b/install_test_visibility.sh @@ -25,8 +25,11 @@ extract_minor_version() { } install_java_tracer() { + local repository_base_url + repository_base_url="$(get_java_tracer_repository_base_url)" + if [ -z "$DD_SET_TRACER_VERSION_JAVA" ]; then - DD_SET_TRACER_VERSION_JAVA=$(get_latest_java_tracer_version) + DD_SET_TRACER_VERSION_JAVA=$(get_latest_java_tracer_version "$repository_base_url") fi local filepath_tracer @@ -34,8 +37,8 @@ install_java_tracer() { local filepath_checksum filepath_checksum="$ARTIFACTS_FOLDER/dd-java-agent.jar.sha256" - download_file "https://repo1.maven.org/maven2/com/datadoghq/dd-java-agent/$DD_SET_TRACER_VERSION_JAVA/dd-java-agent-$DD_SET_TRACER_VERSION_JAVA.jar" $filepath_tracer - download_file "https://repo1.maven.org/maven2/com/datadoghq/dd-java-agent/$DD_SET_TRACER_VERSION_JAVA/dd-java-agent-$DD_SET_TRACER_VERSION_JAVA.jar.sha256" $filepath_checksum + download_file "$repository_base_url/$DD_SET_TRACER_VERSION_JAVA/dd-java-agent-$DD_SET_TRACER_VERSION_JAVA.jar" "$filepath_tracer" "${DD_SET_AUTH_HEADER_JAVA:-}" + download_file "$repository_base_url/$DD_SET_TRACER_VERSION_JAVA/dd-java-agent-$DD_SET_TRACER_VERSION_JAVA.jar.sha256" "$filepath_checksum" "${DD_SET_AUTH_HEADER_JAVA:-}" if ! verify_checksum "$(cat $filepath_checksum)" "$filepath_tracer"; then return 1 @@ -89,14 +92,26 @@ verify_checksum() { fi } +get_java_tracer_repository_base_url() { + local base_url="${DD_SET_TRACER_REPOSITORY_URL_JAVA:-https://repo1.maven.org/maven2/com/datadoghq/dd-java-agent}" + # Trim trailing slashes so callers can append "//..." uniformly + # regardless of whether the override was provided with or without one. + while [ "${base_url%/}" != "$base_url" ]; do + base_url="${base_url%/}" + done + echo "$base_url" +} + get_latest_java_tracer_version() { + local repository_base_url="$1" + local filepath_metadata filepath_metadata="$ARTIFACTS_FOLDER/maven-metadata.xml" local filepath_checksum filepath_checksum="$ARTIFACTS_FOLDER/maven-metadata.xml.sha256" - download_file "https://repo1.maven.org/maven2/com/datadoghq/dd-java-agent/maven-metadata.xml" $filepath_metadata - download_file "https://repo1.maven.org/maven2/com/datadoghq/dd-java-agent/maven-metadata.xml.sha256" $filepath_checksum + download_file "$repository_base_url/maven-metadata.xml" "$filepath_metadata" "${DD_SET_AUTH_HEADER_JAVA:-}" + download_file "$repository_base_url/maven-metadata.xml.sha256" "$filepath_checksum" "${DD_SET_AUTH_HEADER_JAVA:-}" if ! verify_checksum "$(cat $filepath_checksum)" "$filepath_metadata"; then return 1 @@ -113,10 +128,19 @@ get_latest_java_tracer_version() { download_file() { local url=$1 local filepath=$2 + local auth_header="${3:-}" if command -v curl >/dev/null 2>&1; then - curl -Lo "$filepath" "$url" + if [ -n "$auth_header" ]; then + curl -Lo "$filepath" -H "$auth_header" "$url" + else + curl -Lo "$filepath" "$url" + fi elif command -v wget >/dev/null 2>&1; then - wget -O "$filepath" "$url" + if [ -n "$auth_header" ]; then + wget -O "$filepath" --header="$auth_header" "$url" + else + wget -O "$filepath" "$url" + fi else >&2 echo "Error: Neither wget nor curl is installed." return 1 From 21060bd325fd7caa7f4de231e71a38cd6876f2bd Mon Sep 17 00:00:00 2001 From: Daniel Mohedano Date: Mon, 11 May 2026 16:05:47 +0200 Subject: [PATCH 2/4] chore: update script version to 14 --- .gitlab-ci.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 993dded..ac0c386 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -6,7 +6,7 @@ variables: #DATADOG_AGENT_BUILDERS: v9930706-ef9d493 DATADOG_AGENT_BUILDERS: v47979770-a5a4cfd0 S3_CP_CMD: aws s3 cp --only-show-errors --region us-east-1 --sse AES256 - SCRIPT_VERSION: 13 + SCRIPT_VERSION: 14 deploy: #image: 486234852809.dkr.ecr.us-east-1.amazonaws.com/ci/datadog-agent-builders/gitlab_agent_deploy:$DATADOG_AGENT_BUILDERS From 115d8578502ca1cdd4c6468b846ae5ddfc2404aa Mon Sep 17 00:00:00 2001 From: Daniel Mohedano Date: Mon, 11 May 2026 16:28:42 +0200 Subject: [PATCH 3/4] fix: avoid forwarding auth header to maven central --- README.md | 2 +- install_test_visibility.sh | 29 ++++++++++++++++++++++++++++- 2 files changed, 29 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index ffa236b..5abd156 100644 --- a/README.md +++ b/README.md @@ -27,7 +27,7 @@ The script parameters are - `DD_SET_TRACER_VERSION_DOTNET`: (optional) Version of the .NET tracer to install. If not provided, the latest version is installed. - `DD_SET_TRACER_VERSION_JAVA`: (optional) Version of the Java tracer to install (without the `v` prefix, e.g. `1.37.1`). If not provided, the latest version is installed. - `DD_SET_TRACER_REPOSITORY_URL_JAVA`: (optional) Base URL of a Maven repository (or proxy/mirror) used to download the Java tracer JAR and its `.sha256`. The path under the base must follow the standard Maven layout for `com.datadoghq:dd-java-agent` (i.e. `//dd-java-agent-.jar`, plus `/maven-metadata.xml` when `DD_SET_TRACER_VERSION_JAVA` is not pinned). Trailing slashes are tolerated. Defaults to `https://repo1.maven.org/maven2/com/datadoghq/dd-java-agent`. -- `DD_SET_AUTH_HEADER_JAVA`: (optional) HTTP header used to authenticate against `DD_SET_TRACER_REPOSITORY_URL_JAVA`, provided as a complete `Name: Value` string (e.g. `Authorization: Bearer `). Passed verbatim to `curl -H` / `wget --header` on every Java tracer download. Only meaningful when `DD_SET_TRACER_REPOSITORY_URL_JAVA` is set. +- `DD_SET_AUTH_HEADER_JAVA`: (optional) HTTP header used to authenticate against `DD_SET_TRACER_REPOSITORY_URL_JAVA`, provided as a complete `Name: Value` string (e.g. `Authorization: Bearer `). Passed verbatim to `curl -H` / `wget --header` on every Java tracer download. Requires `DD_SET_TRACER_REPOSITORY_URL_JAVA` to be set to a custom repository URL. - `DD_SET_TRACER_VERSION_JS`: (optional) Version of the JS tracer to install. If not provided, the latest version is installed. - `DD_SET_TRACER_VERSION_PYTHON`: (optional) Version of the Python tracer to install. If not provided, the latest version is installed. - `DD_SET_COVERAGE_VERSION_PYTHON`: (optional) Version of the Python `coverage` package to install. Defaults to `7.13.5`. diff --git a/install_test_visibility.sh b/install_test_visibility.sh index 57aa9c7..18cc320 100755 --- a/install_test_visibility.sh +++ b/install_test_visibility.sh @@ -16,6 +16,8 @@ if ! mkdir -p $ARTIFACTS_FOLDER; then return 1 fi +DEFAULT_JAVA_TRACER_REPOSITORY_URL="https://repo1.maven.org/maven2/com/datadoghq/dd-java-agent" + extract_major_version() { echo "$1" | cut -d '.' -f 1 } @@ -25,6 +27,10 @@ extract_minor_version() { } install_java_tracer() { + if ! validate_java_auth_header_configuration; then + return 1 + fi + local repository_base_url repository_base_url="$(get_java_tracer_repository_base_url)" @@ -77,6 +83,22 @@ install_java_tracer() { echo "DD_TRACER_VERSION_JAVA=$(command -v java >/dev/null 2>&1 && java -jar $filepath_tracer || unzip -p $filepath_tracer META-INF/MANIFEST.MF | grep -i implementation-version | cut -d' ' -f2)" } +validate_java_auth_header_configuration() { + if [ -n "${DD_SET_AUTH_HEADER_JAVA:-}" ] && [ -z "${DD_SET_TRACER_REPOSITORY_URL_JAVA:-}" ]; then + >&2 echo "Error: DD_SET_AUTH_HEADER_JAVA requires DD_SET_TRACER_REPOSITORY_URL_JAVA to be set to a custom repository URL." + return 1 + fi + + if [ -n "${DD_SET_AUTH_HEADER_JAVA:-}" ]; then + local repository_base_url + repository_base_url="$(normalize_java_tracer_repository_base_url "$DD_SET_TRACER_REPOSITORY_URL_JAVA")" + if [ "$repository_base_url" = "$DEFAULT_JAVA_TRACER_REPOSITORY_URL" ]; then + >&2 echo "Error: DD_SET_AUTH_HEADER_JAVA cannot be used with the default Maven Central repository. Set DD_SET_TRACER_REPOSITORY_URL_JAVA to a custom repository URL." + return 1 + fi + fi +} + verify_checksum() { if command -v sha256sum >/dev/null 2>&1; then if ! echo "$1 $2" | sha256sum --quiet -c -; then @@ -93,7 +115,12 @@ verify_checksum() { } get_java_tracer_repository_base_url() { - local base_url="${DD_SET_TRACER_REPOSITORY_URL_JAVA:-https://repo1.maven.org/maven2/com/datadoghq/dd-java-agent}" + local base_url="${DD_SET_TRACER_REPOSITORY_URL_JAVA:-$DEFAULT_JAVA_TRACER_REPOSITORY_URL}" + normalize_java_tracer_repository_base_url "$base_url" +} + +normalize_java_tracer_repository_base_url() { + local base_url="$1" # Trim trailing slashes so callers can append "//..." uniformly # regardless of whether the override was provided with or without one. while [ "${base_url%/}" != "$base_url" ]; do From 227c9f784f07b474eb434fae2bb4b14432bb5ba1 Mon Sep 17 00:00:00 2001 From: Daniel Mohedano Date: Tue, 12 May 2026 09:41:18 +0200 Subject: [PATCH 4/4] fix: avoid redirects with auth headers --- README.md | 2 +- install_test_visibility.sh | 6 ++++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 5abd156..aecef9f 100644 --- a/README.md +++ b/README.md @@ -27,7 +27,7 @@ The script parameters are - `DD_SET_TRACER_VERSION_DOTNET`: (optional) Version of the .NET tracer to install. If not provided, the latest version is installed. - `DD_SET_TRACER_VERSION_JAVA`: (optional) Version of the Java tracer to install (without the `v` prefix, e.g. `1.37.1`). If not provided, the latest version is installed. - `DD_SET_TRACER_REPOSITORY_URL_JAVA`: (optional) Base URL of a Maven repository (or proxy/mirror) used to download the Java tracer JAR and its `.sha256`. The path under the base must follow the standard Maven layout for `com.datadoghq:dd-java-agent` (i.e. `//dd-java-agent-.jar`, plus `/maven-metadata.xml` when `DD_SET_TRACER_VERSION_JAVA` is not pinned). Trailing slashes are tolerated. Defaults to `https://repo1.maven.org/maven2/com/datadoghq/dd-java-agent`. -- `DD_SET_AUTH_HEADER_JAVA`: (optional) HTTP header used to authenticate against `DD_SET_TRACER_REPOSITORY_URL_JAVA`, provided as a complete `Name: Value` string (e.g. `Authorization: Bearer `). Passed verbatim to `curl -H` / `wget --header` on every Java tracer download. Requires `DD_SET_TRACER_REPOSITORY_URL_JAVA` to be set to a custom repository URL. +- `DD_SET_AUTH_HEADER_JAVA`: (optional) HTTP header used to authenticate against `DD_SET_TRACER_REPOSITORY_URL_JAVA`, provided as a complete `Name: Value` string (e.g. `Authorization: Bearer `). Passed verbatim to `curl -H` / `wget --header` on every Java tracer download. Requires `DD_SET_TRACER_REPOSITORY_URL_JAVA` to be set to a custom repository URL. Redirects are not followed when this option is set, to avoid forwarding credentials to another location; configure `DD_SET_TRACER_REPOSITORY_URL_JAVA` as the final repository URL. - `DD_SET_TRACER_VERSION_JS`: (optional) Version of the JS tracer to install. If not provided, the latest version is installed. - `DD_SET_TRACER_VERSION_PYTHON`: (optional) Version of the Python tracer to install. If not provided, the latest version is installed. - `DD_SET_COVERAGE_VERSION_PYTHON`: (optional) Version of the Python `coverage` package to install. Defaults to `7.13.5`. diff --git a/install_test_visibility.sh b/install_test_visibility.sh index 18cc320..edd30e3 100755 --- a/install_test_visibility.sh +++ b/install_test_visibility.sh @@ -158,13 +158,15 @@ download_file() { local auth_header="${3:-}" if command -v curl >/dev/null 2>&1; then if [ -n "$auth_header" ]; then - curl -Lo "$filepath" -H "$auth_header" "$url" + # Do not follow redirects while sending a caller-provided secret header. + curl -Lo "$filepath" --max-redirs 0 -H "$auth_header" "$url" else curl -Lo "$filepath" "$url" fi elif command -v wget >/dev/null 2>&1; then if [ -n "$auth_header" ]; then - wget -O "$filepath" --header="$auth_header" "$url" + # Do not follow redirects while sending a caller-provided secret header. + wget --max-redirect=0 -O "$filepath" --header="$auth_header" "$url" else wget -O "$filepath" "$url" fi