jfrog / jfrog/jfrog-cli-security

jf docker scan ubuntu:latest fails,

Open
#319 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
13
Forks
50
Avg merge
3d 48m
Merged PRs (30d)
26

Description

Describe the bug

Attempts to run "jf docker scan ..." fail consistently, with a "[Error] Xray indexer app failed indexing ...'

Current behavior

jf docker scan ubuntu:latest
07:16:23 [Debug] JFrog CLI version: 2.56.0
07:16:23 [Debug] OS/Arch: windows/amd64
07:16:23 [Info] Log path: C:\Users\username.jfrog\logs\jfrog-cli.2024-05-06.07-16-23.14136.log

Vulnerable Components
┌───────────────────────────────────────┐
│ No vulnerable components were found │
└───────────────────────────────────────┘
07:16:40 [Error] Xray indexer app failed indexing C:\Users\username\AppData\Local\Temp\2\jfrog.cli.temp.-1715004983-1987658830\image.tar with exit status 2: 2024/05/06 07:16:39 maxprocs: Leaving GOMAXPROCS=8: CPU quota undefined
2024-05-06T14:16:40.025Z [jfxia] [DEBUG] [] [filter:138 ] [BackgroundContext ] Initializing filtering service
panic: Failed to init license detection providers: failed to init license classifier
--- at /go/pkg/mod/jfrog.com/go-license-detective/v2@v2.0.19/provider/provider.go:24 (InitAllProviders) ---
Caused by: Failed to initialize license classifier: Unexpected path spdx_licenses/0BSD.txt

goroutine 1 [running]:
jfrog.com/go-license-detective/v2/textdetective.NewLicenseTextDetective(0x4ab12e0?)
/go/pkg/mod/jfrog.com/go-license-detective/v2@v2.0.19/textdetective/textdetective.go:44 +0x16a
jfrog.com/xray/common/license_detector.New(...)
/go/src/jfrog.com/xray/common/license_detector/detector.go:35
jfrog.com/xray/cmd/indexer-app/indexer_app.initializeApplication({0x4ab12e0, 0x56bc7c0})
/go/src/jfrog.com/xray/cmd/indexer-app/indexer_app/wire_gen.go:51 +0x7f
jfrog.com/xray/cmd/indexer-app/indexer_app.NewApp(...)
/go/src/jfrog.com/xray/cmd/indexer-app/indexer_app/application.go:34
jfrog.com/xray/cmd/indexer-app/indexer_app.(*indexerApp).initDependencies(0xc000694640?, {0x4ab12e0, 0x56bc7c0})
/go/src/jfrog.com/xray/cmd/indexer-app/indexer_app/indexer_app.go:140 +0x51
jfrog.com/xray/cmd/indexer-app/indexer_app.(*indexerApp).Index(0xc0001000c0?, {0x4ab12e0, 0x56bc7c0}, {0xc0001000c0, 0x55}, {0xc000040230, 0x4a})
/go/src/jfrog.com/xray/cmd/indexer-app/indexer_app/indexer_app.go:116 +0x3b
main.IndexerAppRunner.Run({{0x4aae170?, 0x56bc7c0?}}, {0x4ab12e0, 0x56bc7c0}, {0xc000136000?, 0x1c97dc0?, 0xc000100058?})
/go/src/jfrog.com/xray/cmd/indexer-app/indexer-app.go:59 +0x217
main.main()
/go/src/jfrog.com/xray/cmd/indexer-app/indexer-app.go:22 +0x92
/

Reproduction steps

jf docker scan ubuntu:latest

Expected behavior

"jf" command completion, without seeing: panic: Failed to init license detection providers: failed to init license classifier

JFrog CLI version

jf version 2.56.0

Operating system type and version

Windows 10 Enterprise 22H2

JFrog Artifactory version

7.47.12

JFrog Xray version

3.87.9

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce jf docker scan ubuntu:latest on the reported Windows and JFrog CLI versions, then trace the failure from cmd/indexer-app/indexer_app/indexer_app.go through license initialization and the reported go-license-detective provider error. Done means the scan completes without the license-classifier panic and preserves vulnerability scan output.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, go
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.