jfrog / jfrog/jfrog-cli-security
jf audit gradle and Artifactory plugin resolution since 2.36.1
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Describe the bug
After 2.36.1 jf cli version and this PR : https://github.com/jfrog/jfrog-cli-core/pull/719 , the jf audit command fail on gradle project with error :
Could not get unknown property 'artifactoryPublish' for project '...' of type org.gradle.api.Project.
The root cause seems to be that the init.gradle plugin generated and used in the following command do not contains anymore gradle artifactory plugin apply :
Running gradle deps tree command: ./gradlew clean generateDepTrees -I /tmp/jfrog.cli.temp.-1684849391-4160074373/gradledeptree.init -q -Dcom.jfrog.depsTreeOutputFile=/tmp/jfrog.cli.temp.-1684849391-4160074373/gradledeptree.out -Dcom.jfrog.includeAllBuildFiles=true
Current behavior
jf audit --watches ... --gradle
Task failed with an exception.
-----------
* Where:
Script '.../app.build.gradle' line: 43
* What went wrong:
A problem occurred evaluating script.
> Could not get unknown property 'artifactoryPublish' for project ':app' of type org.gradle.api.Project.
Reproduction steps
Have a simple gradle project (android for the example) with artifactoryPublish configuration like following :
artifactoryPublish.dependsOn('build')
artifactoryPublish {
publications(publishing.publications.app)
}
The important thing is to not configure gradle artifactory plugin in buildscript dependencies and not apply com.jfrog.artifactory
Then run the command jf audit --gradle
The error described above is raised since 2.36.1
Expected behavior
The expected behaviour is to have a functional jf audit command as before 2.36.1
Applying jfrog plugin in build.gradle is not a solution because, when I run jf gradle-config followed by jf gradle.. I raise the following error :
Failed to apply plugin class 'org.jfrog.gradle.plugin.artifactory.ArtifactoryPlugin'.
> Cannot cast object 'org.jfrog.gradle.plugin.artifactory.dsl.ArtifactoryPluginConvention@1c6cddbd' with class 'org.jfrog.gradle.plugin.artifactory.dsl.ArtifactoryPluginConvention' to class 'org.jfrog.gradle.plugin.artifactory.dsl.ArtifactoryPluginConvention'
Because the plugin is applied by the init.gradle file generated by jfrog CLI plugin.
JFrog CLI version
2.36.1 to 2.38.2
Operating system type and version
Ubuntu
JFrog Artifactory version
7.55.10
JFrog Xray version
3.71.6
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing the jf audit Gradle dependency-tree command and the generated gradledeptree.init file used with ./gradlew. Reproduce the failure with a project using artifactoryPublish without declaring or applying the plugin in its buildscript, then verify that jf audit completes without the duplicate-plugin error described for jf gradle-config.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- build-system, cli
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100