jfrog / jfrog/jfrog-cli-security

jf curation-audit support for dotNet project

Open
#575 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

feature request
Dominant language
Go
Stars
13
Forks
50
Avg merge
3d 48m
Merged PRs (30d)
26

Description

Is your feature request related to a problem? Please describe.
I am getting the error trying to run jf curation-audit command on multi-module dotNet project

jf ca .                           
13:06:22 [Debug] JFrog CLI version: 2.79.0
13:06:22 [Debug] OS/Arch: darwin/arm64
13:06:22 [Debug] Trace ID for JFrog Platform logs: 9c9759e59289795c
13:06:22 [Debug] Using <psazuse> server-id configuration
13:06:22 [🔵Info] Log path: /Users/alexsh/.jfrog/logs/jfrog-cli.2025-10-01.13-06-22.60177.log
13:06:25 [🔵Info] Trace ID for JFrog Platform logs: 9c9759e59289795c
13:06:25 [🚨Error] 'dotnet restore' command failed: exit status 1 - MSBUILD : error MSB1011: Specify which project or solution file to use because this folder contains more than one project or solution file.

Log file lists dotNet as not supported package manager in log file

[Info] Running curation audit on project: /Users/alexsh/projects/customers/...../eShopOnWeb
[Debug] Sending HTTP GET request to: https://psazuse.jfrog.io/artifactory/api/system/version
[Debug] mapped 1 working directories with indicators/descriptors:
{
  "/Users/alexsh/projects/customers/...../eShopOnWeb": [
    "/Users/alexsh/projects/customers/...../eShopOnWeb/Everything.sln",
    "/Users/alexsh/projects/customers/...../eShopOnWeb/eShopOnWeb.sln"
  ]
}
[Debug] Detected 2 technologies at /Users/alexsh/projects/customers/...../eShopOnWeb: [dotnet nuget].
[Info] Detected: dotnet, nuget.
[Info] It looks like this project uses 'dotnet' to download its dependencies. This package manager however isn't supported by this command.

Describe the solution you'd like to see
A list of packages blocked by Curation policy with the prompt to create waivers. This is standard output of jf ca command.

Additional context
I am able to run jf rt dotnet restore eShopOnWeb.sln command, so it seems like jf ca command is triggering 'dotnet restore' that requires Project file to be specified when executed on multi-module dotNet application.
It appears to be a blocker as developers need to have a list of blocked packages from the curated repository, but not able as jf ca errors out.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing jf ca . in the multi-module eShopOnWeb project and compare it with jf rt dotnet restore eShopOnWeb.sln. The work is done when curation audit handles multiple solution files and reports blocked packages with prompts to create waivers instead of failing during restore.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp, go
Domain
devtools, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.