jfrog / jfrog/jfrog-cli-security

`jf docker scan --fail=true` does not actually fail

Open
#394 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
13
Forks
50
Avg merge
3d 48m
Merged PRs (30d)
26

Description

Describe the bug

When scanning a Docker Image in a Jenkins job, using the CLI-plugin, we execute the following command:
jf 'docker scan <DOCKER_IMAGE> --fail=true --watches=<SPECIFIC_WATCH>'

The output lists show a fine list of Security Violations that should trigger the exit code to return as 3.

Current behavior

Running the "jf docker scan"-command produces a success, not a fail with an exit code of 3

Image

Image

The job run with debug output:

docker_scan_does_not_fail-DEBUG.txt

Reproduction steps

Executing the below stage does not fail as expected

    stage('Jfrog CLI') {
        withEnv([
            "JFROG_BINARY_PATH=${tool 'jfrog-cli'}",
            "JFROG_CLI_HOME_DIR=${env.WORKSPACE_TMP}/jfrog/${env.BUILD_NUMBER}/.jfrog",
            "JFROG_CLI_LOG_LEVEL=DEBUG",
            "PATH+=${tool 'jfrog-cli'}"
            ]) {
            try {
                jf 'docker scan <DOCKER_IMAGE> --fail=true --watches=<FAIL_Critical_All_Resources>'
            } catch (error) {
                currentBuild.result = 'FAILURE'
            }
        }
    }
Expected behavior

Something like this at the end of the stage

Image

and the build marked as FAILURE

JFrog CLI-Core version

I do not know which version is correct here.
The JFrog Jenkins plugin is version 1.5.8

JFrog CLI version (if applicable)

2.74.0

Operating system type and version

Debian Linux (Jenkins inbound-agent docker image)

JFrog Artifactory version

7.49.6

JFrog Xray version

3.107.21

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing jf docker scan <DOCKER_IMAGE> --fail=true --watches=<SPECIFIC_WATCH> with CLI version 2.74.0 and the supplied debug output, then trace why security violations do not produce exit code 3. Done means the command returns exit code 3 and the Jenkins stage is marked FAILURE when the scan finds violations.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.