jfrog / jfrog/frogbot

Does frogbot require Advanced Security?

Open
#604 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

question
Dominant language
Go
Stars
372
Forks
107
Avg merge
2d 20h
Merged PRs (30d)
5

Description

I setup frogbot on a test repo and noticed that while Running Frogbot "scan-repository" command it does a series of checks for 200's back from various jfrog endpoints. We did not purchase the advanced security license so we do not have access to contextual_analysis.

17:23:12 [Debug] Sending HTTP GET request to: https://companyname.jfrog.io/xray/api/v1/entitlements/feature/contextual_analysis
  Error: 2 [Error] got unexpected server response while attempting to get JFrog Xray entitlements response for contextual_analysis:
  server response: 404 Not Found

I noticed that the documentation makes note:

NOTE: SAST, Vulnerability Contextual Analysis, Secrets Detection and Infrastructure as Code scans require the [JFrog Advanced Security Package](https://jfrog.com/xray/).

but that doesnt seem to include dependency scanning or license scanning. However the UrlAccessChecker function still appears to require access to that endpoint in order to start a scan on the branch. I dug through your documentation, but failed to find a concrete answer or clear list of requirements for frogbot.

If this isn't something that can be used without Advanced Security it should probably be noted more clearly in the documentation. However if this is possible, I don't understand what I am missing to skip the checks for the endpoints my organization did not purchase.

Thanks!

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reading the UrlAccessChecker logic and the checks run during the scan-repository command, then compare them with the documented Advanced Security requirements. Done means the documentation clearly states which scans require Advanced Security and whether dependency and license scanning work without the unavailable entitlement endpoints.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, go
Domain
documentation, security
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.