jfrog / jfrog/jfrog-cli-security
It is possible to force jf audit to calculate nuget dependencies?
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Hello,
I am trying to run a jf audit in a dotnet project during an azuredevops pipeline :
(jf audit --exclusions=".git;node_modules;target;venv;test;.vcxproj;.vcxproj.filters;*.sln;*yml;yaml;.js;npm;" --mvn=false --npm=false --pip=false --pipenv=false --pnpm=false --licenses=true --sca --secrets --iac --sast --without-contextual-analysis)
but I'm having a problem I don't understand.
When I do simply dotnet restore, then jf audit does this stage :
12:04:49 [Info] Calculating NuGet dependencies...
12:04:50 [Info] Calculating NuGet dependencies...
And jf audit is working without problems.
However, if I do the restore using ArtifactoryDotnetCore@1 task, jf audit seems to skip this part of nuget dependency calculation and then an error is thrown:
failed to generate SBOM for app: failed to build dependency tree: failed getting artifactory repository config: failed while reading nuget.yaml config file: Server ID 'someservername' does not exist.
please run 'jf dotnet-config' with your resolver repository information
Is this a known error? Has anyone else experienced it before?
Is there any way to force the audit to perform this calculation?
Thanks for help!!
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source files, tests, or entry points are named. Start by reproducing the Azure DevOps pipeline with dotnet restore and ArtifactoryDotnetCore@1, then compare the jf audit dependency-calculation paths and nuget.yaml handling. Done means the audit reliably calculates NuGet dependencies or reports a clear configuration requirement in both restore flows.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- cli, devops, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 32/100