jfrog / jfrog/jfrog-cli-security
jf curation-audit support for dotNet project
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Is your feature request related to a problem? Please describe.
I am getting the error trying to run jf curation-audit command on multi-module dotNet project
jf ca .
13:06:22 [Debug] JFrog CLI version: 2.79.0
13:06:22 [Debug] OS/Arch: darwin/arm64
13:06:22 [Debug] Trace ID for JFrog Platform logs: 9c9759e59289795c
13:06:22 [Debug] Using <psazuse> server-id configuration
13:06:22 [🔵Info] Log path: /Users/alexsh/.jfrog/logs/jfrog-cli.2025-10-01.13-06-22.60177.log
13:06:25 [🔵Info] Trace ID for JFrog Platform logs: 9c9759e59289795c
13:06:25 [🚨Error] 'dotnet restore' command failed: exit status 1 - MSBUILD : error MSB1011: Specify which project or solution file to use because this folder contains more than one project or solution file.
Log file lists dotNet as not supported package manager in log file
[Info] Running curation audit on project: /Users/alexsh/projects/customers/...../eShopOnWeb
[Debug] Sending HTTP GET request to: https://psazuse.jfrog.io/artifactory/api/system/version
[Debug] mapped 1 working directories with indicators/descriptors:
{
"/Users/alexsh/projects/customers/...../eShopOnWeb": [
"/Users/alexsh/projects/customers/...../eShopOnWeb/Everything.sln",
"/Users/alexsh/projects/customers/...../eShopOnWeb/eShopOnWeb.sln"
]
}
[Debug] Detected 2 technologies at /Users/alexsh/projects/customers/...../eShopOnWeb: [dotnet nuget].
[Info] Detected: dotnet, nuget.
[Info] It looks like this project uses 'dotnet' to download its dependencies. This package manager however isn't supported by this command.
Describe the solution you'd like to see
A list of packages blocked by Curation policy with the prompt to create waivers. This is standard output of jf ca command.
Additional context
I am able to run jf rt dotnet restore eShopOnWeb.sln command, so it seems like jf ca command is triggering 'dotnet restore' that requires Project file to be specified when executed on multi-module dotNet application.
It appears to be a blocker as developers need to have a list of blocked packages from the curated repository, but not able as jf ca errors out.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing jf ca . in the multi-module eShopOnWeb project and compare it with jf rt dotnet restore eShopOnWeb.sln. The work is done when curation audit handles multiple solution files and reports blocked packages with prompts to create waivers instead of failing during restore.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- csharp, go
- Domain
- devtools, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100