jfrog / jfrog/jfrog-cli-security
`jf audit --mvn --project=myproject --use-wrapper=true` still tries to use mvn on the PATH
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Describe the bug
Sadly Issue #418 not resolved by PR #420.
jf audit --mvn --project=myproject --use-wrapper=true still tries to use mvn on the PATH. No logs saying that mvnw wasn't found or wasn't able to be used.
Current behavior
jf audit --mvn --project=myproject --use-wrapper=true still tries to use mvn on the PATH. No logs saying that mvnw wasn't found or wasn't able to be used.
Reproduction steps
+ jf --version
jf version 2.77.0
+ jf mvn-config --server-id-resolve jfrog-core-edge --server-id-deploy jfrog-central --repo-resolve-releases a4me-maven-releases-vir --repo-resolve-snapshots a4me-maven-snapshots-vir --repo-deploy-releases a4me-maven-np-releases-loc --repo-deploy-snapshots a4me-maven-np-snapshots-loc --use-wrapper=true
04:59:33 [Info] maven build config successfully created.
+ cat .jfrog/projects/maven.yaml
version: 1
type: maven
resolver:
serverId: jfrog-core-edge
snapshotRepo: a4me-maven-snapshots-vir
releaseRepo: a4me-maven-releases-vir
deployer:
serverId: jfrog-central
snapshotRepo: a4me-maven-np-snapshots-loc
releaseRepo: a4me-maven-np-releases-loc
useWrapper: true
+ jf audit --mvn --extended-table=true --format=simple-json --project=a4me --use-wrapper=true
04:59:37 [Info] Performing scans on 1 targets:
[
{
"target": "/home/runner/_work/jenkins-usage-reporting/jenkins-usage-reporting",
"technology": "maven"
}
]
04:59:37 [Info] Calculating Maven dependencies...
04:59:38 [Info] [Thread 2] The 'Analyzer Manager' app is not cached locally. Downloading it now...
04:59:38 [Info] Downloading JFrog's Dependency from https://centraluhg.jfrog.io/artifactory/glb-mvn-releasesjfrog-rem/artifactory/xsc-gen-exe-analyzer-manager-local/v1/1.20.2/linux-amd64/analyzerManager.zip
04:59:46 [Info] Extracting archive: /tmp/jfrog.cli.temp.-1752209978-1046640624/analyzerManager.zip to /tmp/jfrog.cli.temp.-1752209978-1046640624/
04:59:51 [Info] [Thread 1] Running secrets scan...
04:59:51 [Info] [Thread 0] Running SAST scan...
04:59:51 [Info] [Thread 2] Running IaC scan...
04:59:56 [Info] [Thread 2] No iac findings
04:59:58 [Info] [Thread 1] No secrets findings
05:00:00 [Info] [Thread 0] No sast findings
{
"vulnerabilities": null,
"securityViolations": null,
"licensesViolations": null,
"licenses": null,
"operationalRiskViolations": null,
"secrets": null,
"iac": null,
"sast": null,
"secretsViolations": null,
"iacViolations": null,
"sastViolations": null,
"errors": [
{
"filePath": "/home/runner/_work/jenkins-usage-reporting/jenkins-usage-reporting",
"errorMessage": "failed to build dependency tree: failed while building 'maven' dependency tree: failed running command 'mvn org.apache.maven.plugins:maven-install-plugin:3.1.1:install-file -Dfile=/tmp/jfrog.cli.temp.-1752209977-2881375266/maven-dep-tree.jar -B -s /tmp/jfrog.cli.temp.-1752209977-2881375266/settings.xml': exec: \"mvn\": executable file not found in $PATH"
}
],
"scansStatus": {
"sastScanStatusCode": 0,
"iacScanStatusCode": 0,
"secretsScanStatusCode": 0
},
"multiScanId": "d8376a9e-5e13-11f0-994f-3e862cfe5e90"
}
05:00:00 [Info] Trace ID for JFrog Platform logs: d1b76da73214e99a
Error: 0 [Error] target '/home/runner/_work/jenkins-usage-reporting/jenkins-usage-reporting [maven]' errors:
failed to build dependency tree: failed while building 'maven' dependency tree: failed running command 'mvn org.apache.maven.plugins:maven-install-plugin:3.1.1:install-file -Dfile=/tmp/jfrog.cli.temp.-1752209977-2881375266/maven-dep-tree.jar -B -s /tmp/jfrog.cli.temp.-1752209977-2881375266/settings.xml': exec: "mvn": executable file not found in $PATH
Error: Process completed with exit code 1.
Expected behavior
jf audit --mvn --project=myproject --use-wrapper=true still tries to use mvn on the PATH. No logs saying that mvnw wasn't found or wasn't able to be used.
JFrog CLI-Security version
#420
JFrog CLI version (if applicable)
2.77.0
Operating system type and version
Linux Runner v '2.323.0'
JFrog Xray version
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the jf audit --mvn --project=myproject --use-wrapper=true command with the .jfrog/projects/maven.yaml configuration shown in the report. Trace the Maven dependency-tree invocation and verify that the wrapper is selected when available, with a clear log when mvnw cannot be found or used; the command should no longer require mvn on PATH.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100