jfrog / jfrog/jfrog-cli-security
Xray scan fails to parse valid CPE from Amazon Linux 2023 (cpe:invalid wfn string)
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Describe the bug
I'm encountering a persistent issue where jf docker scan fails to parse a valid CPE URI from an amazonlinux:2023 image, even after explicitly setting a correct CPE_NAME in /etc/os-release. This results in the error:
Failed to parse CPE URI: cpe:invalid wfn string
This affects automated scans in CI/CD and causes confusion for developers due to non-actionable output.
Current behavior
Error:
2025-05-28T17:09:51.757Z [33m[jfxia][0m [DEBUG] [] [fileutil:157 ] [main ] checking if the file is supported executable usr/lib/motd
2025-05-28T17:09:51.757Z [33m[jfxia][0m [DEBUG] [] [fileutil:157 ] [main ] checking if the file is supported executable usr/lib/motd.d/30-banner
2025-05-28T17:09:51.757Z [33m[jfxia][0m [1m[31m[ERROR][0m [] [os_version:60 ] [main ] Failed to parse CPE URI: cpe:invalid wfn string.
2025-05-28T17:09:51.757Z [33m[jfxia][0m [DEBUG] [] [extractor:245 ] [main ]
OS Version Info:
ID: amzn
Distribution:
Version: 2023
2025-05-28T17:09:51.772Z [33m[jfxia][0m [DEBUG] [] [fileutil:157 ] [main ] checking if the file is supported executable usr/lib/rpm/macros
2025-05-28T17:09:51.773Z [33m[jfxia][0m [DEBUG] [] [fileutil:157 ] [main ] checking if the file is supported executable usr/lib/rpm/platform/aarch64-linux/macros
2025-05-28T17:09:51.773Z [33m[jfxia][0m [DEBUG] [] [fileutil:157 ] [main ] checking if the file is supported executable usr/lib/rpm/platform/alpha-linux/macros
Observed Behavior:
Despite the image containing a valid CPE_NAME (cpe:2.3⭕amazon:amazon_linux:2023) and trying to set a valid CPE_NAME (cpe:2.3⭕amzn:amazon_linux:2023) and adding a Distribution=amazonlinux field to /etc/os-release, the CLI scan fails with cpe:invalid wfn string.
Debug logs show:
OS Version Info:
ID: amzn
Distribution:
Version: 2023
Reproduction steps
- Pull image:
docker pull public.ecr.aws/amazonlinux/amazonlinux:2023 - Scan image:
jf docker scan public.ecr.aws/amazonlinux/amazonlinux:2023 --watches "Default_Watch"
Expected behavior
Xray should use the explicitly set and valid CPE_NAME from /etc/os-release, or at least generate a fallback CPE that conforms to the CPE 2.3 specification.
The scan should not error due to OS-level metadata if it is complete and syntactically correct.
JFrog CLI version
2.76.0
Operating system type and version
macOS 15.5
JFrog Artifactory version
No response
JFrog Xray version
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the failure with public.ecr.aws/amazonlinux/amazonlinux:2023 using jf docker scan, then trace the CLI's OS metadata and CPE parsing path. Inspect how /etc/os-release fields such as ID, Version, Distribution, and CPE_NAME are handled. Done means the scan accepts the valid CPE_NAME or generates a specification-conforming fallback without the parsing error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100