jfrog / jfrog/jfrog-cli-security
`jf docker scan` command exit code is always 0
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Describe the bug
When using jf docker scan command the exit code is always 0 even when the vulnerability was found or not. This is misleading since it was expected to throw a different exit code if the vulnerabilities are found.
Current behavior
β― jf docker scan node && echo "Exit code" $?
19:21:38 [π΅Info] Log path: /Users/jag/.jfrog/logs/jfrog-cli.2023-08-08.19-21-38.40675.log
π¬ The full scan results are available here: /var/folders/jl/bd9fsxtx56n261vylpl9nqtm0000gn/T/jfrog.cli.temp.-1691536948-3662802376
Vulnerabilities
ββββββββββββ¬βββββββββββββββββββββ¬ββββββββββ¬ββββββββββββββββββ¬βββββββββββ¬βββββββββββββ¬βββββββββ¬ββββββββββββββββ
β SEVERITY β DIRECT β DIRECT β IMPACTED β IMPACTED β FIXED β TYPE β CVE β
β β PACKAGE β PACKAGE β PACKAGE β PACKAGE β VERSIONS β β β
β β β VERSION β NAME β VERSION β β β β
ββββββββββββΌβββββββββββββββββββββΌββββββββββΌββββββββββββββββββΌβββββββββββΌβββββββββββββΌβββββββββΌββββββββββββββββ€
β πMedium β sha256__61f2871f54 β β 3.18:libcrypto3 β 3.1.1-r1 β [3.1.1-r2] β Alpine β CVE-2023-2975 β
β β 5a9b23a9340f96b331 β β β β β β β
.
.
.
ββββββββββββ΄βββββββββββββββββββββ΄ββββββββββ΄ββββββββββββββββββ΄βββββββββββ΄βββββββββββββ΄βββββββββ΄ββββββββββββββββ
19:22:28 [π΅Info] Scan completed successfully.
Exit code: 0
β― jf docker scan alpine && echo "Exit code: " $?
19:25:23 [π΅Info] Log path: /Users/jag/.jfrog/logs/jfrog-cli.2023-08-08.19-25-23.40914.log
π¬ The full scan results are available here: /var/folders/jl/bd9fsxtx56n261vylpl9nqtm0000gn/T/jfrog.cli.temp.-1691537134-468047909
βββββββββββββββββββββββββββββββββββββββ
β β¨ No vulnerabilities were found β¨ β
βββββββββββββββββββββββββββββββββββββββ
19:25:34 [π΅Info] Scan completed successfully.
Exit code: 0
Reproduction steps
Runa jf docker scan command with a vulnerable and non-vulnerable image and check the exit code
Expected behavior
If the scan is failed due to the violations was found, the exit code should be 3
JFrog CLI version
jf version 2.45.0
Operating system type and version
MacOS 13.5
JFrog Artifactory version
saas
JFrog Xray version
saas
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up β it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by running the reported jf docker scan command with both a vulnerable and a non-vulnerable image, then trace the docker scan command entry point in this Go module. Compare the command's returned status with the expected exit code of 3 when vulnerabilities are found and 0 when none are found.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100