jfrog / jfrog/jfrog-cli-security
jf audit –npm command detecting licenses as unknown for the transitive dependencies.
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Describe the bug
Here is a behavior observed with the CLI (2.50.1) while scanning any npm project using the jf audit --npm command where it shows as an 'unknown' license for the dependency keytar and the same when deployed to the Artifactory and scanned, Xray detects the license as shown in the below screenshot.
For the keytar component, Xray detects the MIT license in Artifactory:
For the same component, JFrog CLI detects an unknown license when it's part of the npm project and we scanned the project with jf audit command
jf audit --npm --watches=test-watch
Current behavior
It shows unknown for the known licenses.
Reproduction steps
No response
Expected behavior
JFrog CLI should be able to detect the licenses and should not generate a violation as 'Unknown'.
JFrog CLI version
2.50.1
Operating system type and version
Rhel 8
JFrog Artifactory version
7.68.14
JFrog Xray version
3.82.11
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing jf audit --npm against an npm project containing the keytar dependency, using the reported CLI version and watch configuration. Compare the dependency's reported license with Artifactory/Xray's MIT result; done means known licenses are detected and no Unknown-license violation is generated.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, node.js
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100