jfrog / jfrog/jfrog-cli-security

jf audit gradle and Artifactory plugin resolution since 2.36.1

Open
#345 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
13
Forks
50
Avg merge
3d 48m
Merged PRs (30d)
26

Description

Describe the bug

After 2.36.1 jf cli version and this PR : https://github.com/jfrog/jfrog-cli-core/pull/719 , the jf audit command fail on gradle project with error :
Could not get unknown property 'artifactoryPublish' for project '...' of type org.gradle.api.Project.

The root cause seems to be that the init.gradle plugin generated and used in the following command do not contains anymore gradle artifactory plugin apply :

Running gradle deps tree command: ./gradlew clean generateDepTrees -I /tmp/jfrog.cli.temp.-1684849391-4160074373/gradledeptree.init -q -Dcom.jfrog.depsTreeOutputFile=/tmp/jfrog.cli.temp.-1684849391-4160074373/gradledeptree.out -Dcom.jfrog.includeAllBuildFiles=true

Current behavior
jf audit --watches ... --gradle

Task failed with an exception.
-----------
* Where:
Script '.../app.build.gradle' line: 43

* What went wrong:
A problem occurred evaluating script.
> Could not get unknown property 'artifactoryPublish' for project ':app' of type org.gradle.api.Project.
Reproduction steps

Have a simple gradle project (android for the example) with artifactoryPublish configuration like following :

    artifactoryPublish.dependsOn('build')
    artifactoryPublish {
        publications(publishing.publications.app)
    }

The important thing is to not configure gradle artifactory plugin in buildscript dependencies and not apply com.jfrog.artifactory

Then run the command jf audit --gradle

The error described above is raised since 2.36.1

Expected behavior

The expected behaviour is to have a functional jf audit command as before 2.36.1

Applying jfrog plugin in build.gradle is not a solution because, when I run jf gradle-config followed by jf gradle.. I raise the following error :

Failed to apply plugin class 'org.jfrog.gradle.plugin.artifactory.ArtifactoryPlugin'.
> Cannot cast object 'org.jfrog.gradle.plugin.artifactory.dsl.ArtifactoryPluginConvention@1c6cddbd' with class 'org.jfrog.gradle.plugin.artifactory.dsl.ArtifactoryPluginConvention' to class 'org.jfrog.gradle.plugin.artifactory.dsl.ArtifactoryPluginConvention'

Because the plugin is applied by the init.gradle file generated by jfrog CLI plugin.

JFrog CLI version

2.36.1 to 2.38.2

Operating system type and version

Ubuntu

JFrog Artifactory version

7.55.10

JFrog Xray version

3.71.6

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the jf audit Gradle dependency-tree command and the generated gradledeptree.init file used with ./gradlew. Reproduce the failure with a project using artifactoryPublish without declaring or applying the plugin in its buildscript, then verify that jf audit completes without the duplicate-plugin error described for jf gradle-config.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
build-system, cli
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.