jfrog / jfrog/jfrog-cli-security
jf docker scan ubuntu:latest fails,
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Describe the bug
Attempts to run "jf docker scan ..." fail consistently, with a "[Error] Xray indexer app failed indexing ...'
Current behavior
jf docker scan ubuntu:latest
07:16:23 [Debug] JFrog CLI version: 2.56.0
07:16:23 [Debug] OS/Arch: windows/amd64
07:16:23 [Info] Log path: C:\Users\username.jfrog\logs\jfrog-cli.2024-05-06.07-16-23.14136.log
Vulnerable Components
┌───────────────────────────────────────┐
│ No vulnerable components were found │
└───────────────────────────────────────┘
07:16:40 [Error] Xray indexer app failed indexing C:\Users\username\AppData\Local\Temp\2\jfrog.cli.temp.-1715004983-1987658830\image.tar with exit status 2: 2024/05/06 07:16:39 maxprocs: Leaving GOMAXPROCS=8: CPU quota undefined
2024-05-06T14:16:40.025Z [jfxia] [DEBUG] [] [filter:138 ] [BackgroundContext ] Initializing filtering service
panic: Failed to init license detection providers: failed to init license classifier
--- at /go/pkg/mod/jfrog.com/go-license-detective/v2@v2.0.19/provider/provider.go:24 (InitAllProviders) ---
Caused by: Failed to initialize license classifier: Unexpected path spdx_licenses/0BSD.txt
goroutine 1 [running]:
jfrog.com/go-license-detective/v2/textdetective.NewLicenseTextDetective(0x4ab12e0?)
/go/pkg/mod/jfrog.com/go-license-detective/v2@v2.0.19/textdetective/textdetective.go:44 +0x16a
jfrog.com/xray/common/license_detector.New(...)
/go/src/jfrog.com/xray/common/license_detector/detector.go:35
jfrog.com/xray/cmd/indexer-app/indexer_app.initializeApplication({0x4ab12e0, 0x56bc7c0})
/go/src/jfrog.com/xray/cmd/indexer-app/indexer_app/wire_gen.go:51 +0x7f
jfrog.com/xray/cmd/indexer-app/indexer_app.NewApp(...)
/go/src/jfrog.com/xray/cmd/indexer-app/indexer_app/application.go:34
jfrog.com/xray/cmd/indexer-app/indexer_app.(*indexerApp).initDependencies(0xc000694640?, {0x4ab12e0, 0x56bc7c0})
/go/src/jfrog.com/xray/cmd/indexer-app/indexer_app/indexer_app.go:140 +0x51
jfrog.com/xray/cmd/indexer-app/indexer_app.(*indexerApp).Index(0xc0001000c0?, {0x4ab12e0, 0x56bc7c0}, {0xc0001000c0, 0x55}, {0xc000040230, 0x4a})
/go/src/jfrog.com/xray/cmd/indexer-app/indexer_app/indexer_app.go:116 +0x3b
main.IndexerAppRunner.Run({{0x4aae170?, 0x56bc7c0?}}, {0x4ab12e0, 0x56bc7c0}, {0xc000136000?, 0x1c97dc0?, 0xc000100058?})
/go/src/jfrog.com/xray/cmd/indexer-app/indexer-app.go:59 +0x217
main.main()
/go/src/jfrog.com/xray/cmd/indexer-app/indexer-app.go:22 +0x92
/
Reproduction steps
jf docker scan ubuntu:latest
Expected behavior
"jf" command completion, without seeing: panic: Failed to init license detection providers: failed to init license classifier
JFrog CLI version
jf version 2.56.0
Operating system type and version
Windows 10 Enterprise 22H2
JFrog Artifactory version
7.47.12
JFrog Xray version
3.87.9
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce jf docker scan ubuntu:latest on the reported Windows and JFrog CLI versions, then trace the failure from cmd/indexer-app/indexer_app/indexer_app.go through license initialization and the reported go-license-detective provider error. Done means the scan completes without the license-classifier panic and preserves vulnerability scan output.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100