jfrog / jfrog/jfrog-cli-security

Support passing --url and credentials to jf docker scan command

Open
#363 1 comment 5 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

feature request
Dominant language
Go
Stars
13
Forks
50
Avg merge
3d 48m
Merged PRs (30d)
26

Description

Is your feature request related to a problem? Please describe.
Feature:
There are users/customers that would like to use the JFrog CLI but have restrictions with creating configuration files or even saving credentials in them.
users credentials should be used (each team has service user)
for security reason they don’t want to store credentials in config files on Agents VMs
they don’t use Artifactory to store docker images because they have another repository
Artifactory plugin is incompatible with latest Bamboo Data Center version so they can’t use it

The problem is that this doesn't work:
jf docker scan –url=’’ --user=’’ --password=’

The issue is that the --url and the credentials can only be passed through a service-id configuration file.

Describe the solution you'd like to see
We would like to be able to support the above credentials to this command and other package types as well.

Describe alternatives you've considered
The current workaround is to first save the docker image as a .tar file (using docker save command) and then scan the tar with jf scan and this command is supported with credentials and url.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the jf docker scan command and the service-id configuration handling for its URL and credentials. Compare it with the jf scan tar workaround, then verify that the requested flags work without saving credentials in a configuration file and assess whether other package types share the same limitation.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, go
Domain
cli, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.