jfrog / jfrog/jfrog-cli-security

`jf audit --mvn --project=myproject --use-wrapper=true` still tries to use mvn on the PATH

Open
#495 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
13
Forks
50
Avg merge
3d 48m
Merged PRs (30d)
26

Description

Describe the bug

Sadly Issue #418 not resolved by PR #420.

jf audit --mvn --project=myproject --use-wrapper=true still tries to use mvn on the PATH. No logs saying that mvnw wasn't found or wasn't able to be used.

Current behavior

jf audit --mvn --project=myproject --use-wrapper=true still tries to use mvn on the PATH. No logs saying that mvnw wasn't found or wasn't able to be used.

Reproduction steps
+ jf --version
jf version 2.77.0
+ jf mvn-config --server-id-resolve jfrog-core-edge --server-id-deploy jfrog-central --repo-resolve-releases a4me-maven-releases-vir --repo-resolve-snapshots a4me-maven-snapshots-vir --repo-deploy-releases a4me-maven-np-releases-loc --repo-deploy-snapshots a4me-maven-np-snapshots-loc --use-wrapper=true
04:59:33 [Info] maven build config successfully created.
+ cat .jfrog/projects/maven.yaml
version: 1
type: maven
resolver:
    serverId: jfrog-core-edge
    snapshotRepo: a4me-maven-snapshots-vir
    releaseRepo: a4me-maven-releases-vir
deployer:
    serverId: jfrog-central
    snapshotRepo: a4me-maven-np-snapshots-loc
    releaseRepo: a4me-maven-np-releases-loc
useWrapper: true

+ jf audit --mvn --extended-table=true --format=simple-json --project=a4me --use-wrapper=true
04:59:37 [Info] Performing scans on 1 targets:
[
  {
    "target": "/home/runner/_work/jenkins-usage-reporting/jenkins-usage-reporting",
    "technology": "maven"
  }
]
04:59:37 [Info] Calculating Maven dependencies...
04:59:38 [Info] [Thread 2] The 'Analyzer Manager' app is not cached locally. Downloading it now...
04:59:38 [Info] Downloading JFrog's Dependency from https://centraluhg.jfrog.io/artifactory/glb-mvn-releasesjfrog-rem/artifactory/xsc-gen-exe-analyzer-manager-local/v1/1.20.2/linux-amd64/analyzerManager.zip
04:59:46 [Info] Extracting archive: /tmp/jfrog.cli.temp.-1752209978-1046640624/analyzerManager.zip to /tmp/jfrog.cli.temp.-1752209978-1046640624/
04:59:51 [Info] [Thread 1] Running secrets scan...
04:59:51 [Info] [Thread 0] Running SAST scan...
04:59:51 [Info] [Thread 2] Running IaC scan...
04:59:56 [Info] [Thread 2] No iac findings
04:59:58 [Info] [Thread 1] No secrets findings
05:00:00 [Info] [Thread 0] No sast findings
{
  "vulnerabilities": null,
  "securityViolations": null,
  "licensesViolations": null,
  "licenses": null,
  "operationalRiskViolations": null,
  "secrets": null,
  "iac": null,
  "sast": null,
  "secretsViolations": null,
  "iacViolations": null,
  "sastViolations": null,
  "errors": [
    {
      "filePath": "/home/runner/_work/jenkins-usage-reporting/jenkins-usage-reporting",
      "errorMessage": "failed to build dependency tree: failed while building 'maven' dependency tree: failed running command 'mvn org.apache.maven.plugins:maven-install-plugin:3.1.1:install-file -Dfile=/tmp/jfrog.cli.temp.-1752209977-2881375266/maven-dep-tree.jar -B -s /tmp/jfrog.cli.temp.-1752209977-2881375266/settings.xml': exec: \"mvn\": executable file not found in $PATH"
    }
  ],
  "scansStatus": {
    "sastScanStatusCode": 0,
    "iacScanStatusCode": 0,
    "secretsScanStatusCode": 0
  },
  "multiScanId": "d8376a9e-5e13-11f0-994f-3e862cfe5e90"
}
05:00:00 [Info] Trace ID for JFrog Platform logs: d1b76da73214e99a
Error: 0 [Error] target '/home/runner/_work/jenkins-usage-reporting/jenkins-usage-reporting [maven]' errors:
failed to build dependency tree: failed while building 'maven' dependency tree: failed running command 'mvn org.apache.maven.plugins:maven-install-plugin:3.1.1:install-file -Dfile=/tmp/jfrog.cli.temp.-1752209977-2881375266/maven-dep-tree.jar -B -s /tmp/jfrog.cli.temp.-1752209977-2881375266/settings.xml': exec: "mvn": executable file not found in $PATH
Error: Process completed with exit code 1.
Expected behavior

jf audit --mvn --project=myproject --use-wrapper=true still tries to use mvn on the PATH. No logs saying that mvnw wasn't found or wasn't able to be used.

JFrog CLI-Security version

#420

JFrog CLI version (if applicable)

2.77.0

Operating system type and version

Linux Runner v '2.323.0'

JFrog Xray version

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the jf audit --mvn --project=myproject --use-wrapper=true command with the .jfrog/projects/maven.yaml configuration shown in the report. Trace the Maven dependency-tree invocation and verify that the wrapper is selected when available, with a clear log when mvnw cannot be found or used; the command should no longer require mvn on PATH.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.