jfrog / jfrog/jfrog-cli-security
Support passing --url and credentials to jf docker scan command
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Is your feature request related to a problem? Please describe.
Feature:
There are users/customers that would like to use the JFrog CLI but have restrictions with creating configuration files or even saving credentials in them.
users credentials should be used (each team has service user)
for security reason they don’t want to store credentials in config files on Agents VMs
they don’t use Artifactory to store docker images because they have another repository
Artifactory plugin is incompatible with latest Bamboo Data Center version so they can’t use it
The problem is that this doesn't work:
jf docker scan –url=’’ --user=’’ --password=’
The issue is that the --url and the credentials can only be passed through a service-id configuration file.
Describe the solution you'd like to see
We would like to be able to support the above credentials to this command and other package types as well.
Describe alternatives you've considered
The current workaround is to first save the docker image as a .tar file (using docker save command) and then scan the tar with jf scan and this command is supported with credentials and url.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the jf docker scan command and the service-id configuration handling for its URL and credentials. Compare it with the jf scan tar workaround, then verify that the requested flags work without saving credentials in a configuration file and assess whether other package types share the same limitation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100