jfrog / jfrog/jfrog-cli-security
Security Violations and License Compliance Violations table not displaying in console output
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Describe the bug
After upgrading from jf cli 2.63.2 to 2.67.0, the jf build-scan is no longer displaying the Security Violations and License Compliance Violations table in the console output
Current behavior
Current behavior when running jf build-scan with version 2.67.0:
13:07:29 [Info] Scan of build ### is in progress
13:07:29 [Info] Waiting for Build Scan to complete...
13:07:30 [Info] The scan data is available at: https://###
The full scan results are available here: .jfrog\jfrog.cli.temp.-1726250850-2443012921
13:07:30 [Info] Trace ID for JFrog Platform logs: f2b9a375525fbbac
13:07:30 [Error] One or more of the violations found are set to fail builds that include them
The old behavior with 2.63.2
13:07:17 [Info] Scan of build ### is in progress
13:07:18 [Info] Waiting for Build Scan to complete...
13:07:28 [Info] The scan data is available at: https://###
The full scan results are available here: .jfrog\jfrog.cli.temp.-1726250848-220682823
Security Violations
┌──────────┬───────────────────────────┬─────────┬───────────────────────────┬──────────┬──────────┬───────┬────────────────┐
│ SEVERITY │ DIRECT │ DIRECT │ IMPACTED │ IMPACTED │ FIXED │ TYPE │ CVE │
│ │ PACKAGE │ PACKAGE │ PACKAGE │ PACKAGE │ VERSIONS │ │ │
│ │ │ VERSION │ NAME │ VERSION │ │ │ │
├──────────┼───────────────────────────┼─────────┼───────────────────────────┼──────────┼──────────┼───────┼────────────────┤
│ Critical │ jpetstore-1.06-20240913.1 │ │ com.thoughtworks.xstream: │ 1.3.1 │ [1.4.16] │ Maven │ CVE-2021-21345 │
│ │ 80712-1.war │ │ xstream │ │ │ │ │
│ │ │ │ │ │ │ │ │
└──────────┴───────────────────────────┴─────────┴───────────────────────────┴──────────┴──────────┴───────┴────────────────┘
License Compliance Violations
+---------------------------------------------+
| No license compliance violations were found |
+---------------------------------------------+
13:07:28 [Info] Trace ID for JFrog Platform logs: 6099fde7470bdc3c
13:07:28 [Error] One or more of the violations found are set to fail builds that include them
Reproduction steps
Upload artifact to artifactory and run jf build-scan to wait for scan to complete
Expected behavior
Expected Security Violations and License Compliance Violations table to display indicating violations to user
JFrog CLI-Security version
??
JFrog CLI version (if applicable)
2.67.0
Operating system type and version
Windows 2019
JFrog Xray version
3.102.3
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue concerns the jf build-scan command in jfrog-cli-security; no source files or tests are named. Reproduce it on Windows 2019 with JFrog CLI 2.67.0 by uploading an artifact and waiting for the scan, then compare the output with 2.63.2. Done means both Security Violations and License Compliance Violations tables display before the failure message.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100