jfrog / jfrog/jfrog-cli-security

jf audit --mvn fail on mvn version

Open
#89 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
13
Forks
50
Avg merge
3d 48m
Merged PRs (30d)
26

Description

Describe the bug

jf audit fail to run for maven project

According to docs: "Version 3.1.0 or above of Maven is supported."
According to local execution: "requires Maven version 3.6.3"

[ERROR] Failed to execute goal com.jfrog:maven-dep-tree:1.1.0:tree (default-cli) on project myProject: The plugin com.jfrog:maven-dep-tree:1.1.0 requires Maven version 3.6.3

Current behavior

% jf audit
16:31:27 [Debug] JFrog CLI version: 2.56.1
16:31:27 [Debug] OS/Arch: linux/386
16:31:27 [Debug] Trace ID for JFrog Platform logs: 058034d09f3754e6
16:31:27 [Debug] Sending HTTP GET request to: https://artifactory.company.com/xsc/api/v1/system/version
16:31:27 [🔵Info] Log path: /tmp/.jfrog/logs/jfrog-cli.2024-06-20.16-31-27.3733.log
16:31:36 [Debug] Sending an error report to JFrog analytics...
16:31:36 [Debug] Sending HTTP GET request to: https://artifactory.company.com/xsc/api/v1/system/version
16:31:36 [Debug] failed to check availability of Xsc service:server response: 404 Not Found
404 page not found

Reporting to JFrog analytics is skipped...
16:31:36 [🚨Error] audit command in '/tmp/cms' failed:
failed while building 'maven' dependency tree:
failed running command 'mvn com.jfrog:maven-dep-tree:1.1.0:tree -DdepsTreeOutputFile=/tmp/project/jfrog.cli.temp.-1718890292-3492778425/mavendeptree.out -B -s /tmp/project/jfrog.cli.temp.-1718890292-3492778425/settings.xml': exit status 1

Reproduction steps

No response

Expected behavior

No response

JFrog CLI-Security version

See log

JFrog CLI version (if applicable)

See log

Operating system type and version

See log

JFrog Xray version

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the jf audit Maven dependency-tree path and compare the documented Maven requirement with the mvn com.jfrog:maven-dep-tree:1.1.0:tree command shown in the report. Reproduce the failure with the reported Maven versions and update the behavior or documentation so the supported version is consistent and the audit completes.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
build-system, cli
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.