jfrog / jfrog/jfrog-cli-security
Results of build scan via JFrog CLI (or Azure DevOps plugin) are different from UI results
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Describe the bug
When I run a build scan via the JFrog CLI (or the Azure DevOps plugin) the results are different from the UI scan:
I think the problem might be related to the watch since the results are shown when I use the --vuln parameter.
Current behavior
Results of jf bs (or the Azure DevOps plugin) are different from the UI scan.
Reproduction steps
- Publish build to Artifactory and scan it with Xray
- Scan the same build via the jf bs CLI command
- Compare results
Expected behavior
Results should be identical.
JFrog CLI version
2.53.1
Operating system type and version
Windows 11
JFrog Artifactory version
7.41.4
JFrog Xray version
3.45.1
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the discrepancy with JFrog CLI 2.53.1 or the Azure DevOps plugin against the listed Artifactory and Xray versions. Compare the UI scan with jf bs, including behavior with and without --vuln and the watch, and consider the issue done when both interfaces report identical results.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, go
- Domain
- cli, devops, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100