jfrog / jfrog/jfrog-cli-security

jf audit –npm command detecting licenses as unknown for the transitive dependencies.

Open
#372 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
13
Forks
50
Avg merge
3d 48m
Merged PRs (30d)
26

Description

Describe the bug

Here is a behavior observed with the CLI (2.50.1) while scanning any npm project using the jf audit --npm command where it shows as an 'unknown' license for the dependency keytar and the same when deployed to the Artifactory and scanned, Xray detects the license as shown in the below screenshot.

For the keytar component, Xray detects the MIT license in Artifactory:
image

For the same component, JFrog CLI detects an unknown license when it's part of the npm project and we scanned the project with jf audit command

jf audit --npm --watches=test-watch

image

Current behavior

It shows unknown for the known licenses.
image

Reproduction steps

No response

Expected behavior

JFrog CLI should be able to detect the licenses and should not generate a violation as 'Unknown'.

JFrog CLI version

2.50.1

Operating system type and version

Rhel 8

JFrog Artifactory version

7.68.14

JFrog Xray version

3.82.11

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing jf audit --npm against an npm project containing the keytar dependency, using the reported CLI version and watch configuration. Compare the dependency's reported license with Artifactory/Xray's MIT result; done means known licenses are detected and no Unknown-license violation is generated.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, node.js
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.