|
1 | 1 | # CLI for JFrog Curation |
2 | 2 |
|
3 | | -## Overview |
| 3 | +**The JFrog Security documentation has a new home!**\ |
| 4 | +You can now find it [here](https://jfrog.com/help/p/security-home), including sections on: |
4 | 5 |
|
5 | | -JFrog Curation defends your software supply chain, enabling early blocking of malicious or risky open-source packages before they even enter. Seamlessly identify harmful, vulnerable, or risky packages, ensuring increased security, compliance, and developer productivity. |
6 | | - |
7 | | -For more information see [**here**](https://jfrog.com/curation/) |
8 | | - |
9 | | -The 'curation-audit' is a JFrog CLI command designed for developers to scan their projects and identify third-party dependencies that violate the restrictions set by the Curation service. This command provides detailed insights into the specific package policies that are being violated, leading to their blockage by the Curation service. Additionally, when feasible, 'curation-audit' may suggest alternative versions of the packages that comply with the Curation policies. |
10 | | - |
11 | | -Moreover, curation-audit supports waiver requests for eligible violations. If configured in the policy, developers can select the blocked package and request a waiver from the policy owner. |
12 | | - |
13 | | -## Supported package managers & build systems |
14 | | - |
15 | | -Curation-audit command supported package managers and build systems: |
16 | | - |
17 | | -* Npm (npm) |
18 | | -* Maven (mvn) - Requires xray 3.92 and above, and Artifactory 7.82 and above |
19 | | -* Pip (pip) - Requires xray 3.92 and above, and Artifactory 7.82 and above |
20 | | -* Go (go) - Requires xray 3.92 and above, and Artifactory 7.87 and above |
21 | | - |
22 | | -For a full list of the package managers and build systems supported by the curation-audit command and the required Artifactory and Xray versions to use it please see [**this matrix**](https://jfrog.com/help/r/jfrog-curation/curation-support-matrix) |
23 | | - |
24 | | -*** |
25 | | - |
26 | | -### Commands |
27 | | - |
28 | | -Audit your Project with JFrog CLI curation-audit command |
29 | | - |
30 | | -### Setup: |
31 | | - |
32 | | -Prerequisites: |
33 | | - |
34 | | -Some package types (except npm packages) require 'pass-through' curation configuration on the remote repositories in Artifactory, in addition to configuring curation on them. For more information, see [**this page**](https://jfrog.com/help/r/jfrog-curation/configure-curation-pass-through)**.** |
35 | | - |
36 | | -1. **Connect JFrog CLI to JFrog Platform** |
37 | | - |
38 | | - Connect the JFrog CLI to your JFrog Platform instance by running the following command: |
39 | | - |
40 | | - ``` |
41 | | - jf c add |
42 | | - ``` |
43 | | -
|
44 | | - * When prompted for the access token, use the token generated from Artifactory. For more details, refer to the [adding and editing configured servers documentation](https://docs.jfrog-applications.jfrog.io/jfrog-applications/jfrog-cli/configurations/jfrog-platform-configuration#adding-and-editing-configured-servers). |
45 | | -
|
46 | | - ``` |
47 | | - jf c show |
48 | | - ``` |
49 | | -
|
50 | | - * It should present Artifactory server just added (with default true) |
51 | | -2. **Configure JFrog CLI for Project**\ |
52 | | - Ensure your project is configured in the JFrog CLI with the repository you would like to resolve dependencies from. Here are details for each package manager: |
53 | | - * **NPM:** |
54 | | - * Set the resolved repository using the [**jf npmc**](https://docs.jfrog-applications.jfrog.io/jfrog-applications/jfrog-cli/binaries-management-with-jfrog-artifactory/package-managers-integration#setting-npm-repositories) command inside the project directory. |
55 | | - * **MAVEN:** |
56 | | - * Set the resolved repository using the [**jf mvnc**](https://docs.jfrog-applications.jfrog.io/jfrog-applications/jfrog-cli/binaries-management-with-jfrog-artifactory/package-managers-integration#setting-maven-repositories) command inside the project directory. |
57 | | - * **PIP:** |
58 | | - * Set the resolved repository using the [**jf pipc**](https://docs.jfrog-applications.jfrog.io/jfrog-applications/jfrog-cli/binaries-management-with-jfrog-artifactory/package-managers-integration#setting-python-repository) command inside the project directory (The only package installer supported for now by Python is "pip"). |
59 | | - * **GO:** |
60 | | - * Set the resolved repository using the [**jf goc**](https://docs.jfrog-applications.jfrog.io/jfrog-applications/jfrog-cli/binaries-management-with-jfrog-artifactory/package-managers-integration#examples-4) command inside the project directory. |
61 | | -
|
62 | | -#### Commands Params |
63 | | -
|
64 | | -| | | |
65 | | -|-----------------------|---------------------------------------------------------------------------------------------------------------------------------------| |
66 | | -| **Command name** | curation-audit | |
67 | | -| **Abbreviation** | ca | |
68 | | -| **Command options** | | |
69 | | -| `--format` | <p>[Default: table]<br><br>Defines the output format of the command. Acceptable values are: table and json.</p> | |
70 | | -| `--working-dirs` | <p>[Optional]<br><br>A comma separated list of relative working directories, to determine the audit targets locations.</p> | |
71 | | -| `--threads` | <p>[Default: 3]<br><br>The number of parallel threads used to determine the curation status for each package in the project tree.</p> | |
72 | | -| `--requirements-file` | <p>[Optional] [Pip]<br><br>Defines pip requirements file name. For example: 'requirements.txt'</p> | |
73 | | -
|
74 | | -#### Example 1 |
75 | | -
|
76 | | -Curation-Audit the project in the current directory. Displays all known packages that were blocked by Curation Policies. |
77 | | -
|
78 | | -``` |
79 | | -jf curation-audit |
80 | | -``` |
81 | | -
|
82 | | -#### Example 2 |
83 | | -
|
84 | | -Curation-Audit the projects according to the specific paths defined in the "working-dirs" option. Displays all known packages that were blocked by Curation Policies for all projects. The data is displayed in separate tables. |
85 | | -
|
86 | | -``` |
87 | | -jf curation-audit --working-dirs="/path/to/project/npm_project1,/path/to/project/npm_project2" |
88 | | -``` |
89 | | -
|
90 | | -#### Example 3 |
91 | | -
|
92 | | -Curation-Audit the project in the current directory using 5 threads to check the packages Curation status in parallel. Displays all known packages blocked by Curation Policies. |
93 | | -
|
94 | | -``` |
95 | | -jf curation-audit --threads=5 |
96 | | -``` |
97 | | -
|
98 | | -#### Example 4 |
99 | | -
|
100 | | -Curation-Audit Waiver Request Process: The developer specifies the required row(s) from the table for the blocked policies. They then add a description and submit the request. A summary table is presented at the end of the process. |
101 | | -
|
102 | | -``` |
103 | | -> jf curation-audit |
104 | | -Found 4 blocked packages for project sample-node-project:1.0.0 |
105 | | -Curation |
106 | | -┌────┬──────────────┬────────────┬──────────────┬─────────┬─────────┬──────────────┬──────────────┬──────────────┬──────────────┐ |
107 | | -│ ID │ DIRECT │ DIRECT │ BLOCKED │ BLOCKED │ PACKAGE │ VIOLATED │ VIOLATED CON │ EXPLANATION │ RECOMMENDATI │ |
108 | | -│ │ DEPENDENCY │ DEPENDENCY │ PACKAGE │ PACKAGE │ TYPE │ POLICY │ DITION │ │ ON │ |
109 | | -│ │ PACKAGE │ PACKAGE │ NAME │ VERSION │ │ NAME │ NAME │ │ │ |
110 | | -│ │ NAME │ VERSION │ │ │ │ │ │ │ │ |
111 | | -├────┼──────────────┼────────────┼──────────────┼─────────┼─────────┼──────────────┼──────────────┼──────────────┼──────────────┤ |
112 | | -│ 1 │ ansi-regex │ 3.0.0 │ ansi-regex │ 3.0.0 │ npm │ High CVE │ CVE with CVS │ Package vers │ Upgrade to t │ |
113 | | -│ │ │ │ │ │ │ │ S score betw │ ion contains │ he following │ |
114 | | -│ │ │ │ │ │ │ │ een 7.0 and │ the followin │ version(s): │ |
115 | | -│ │ │ │ │ │ │ │ 8.9 (with or │ g vulnerabil │ CVE-2021-380 │ |
116 | | -│ │ │ │ │ │ │ │ without a fi │ ity(s): │ 7: 6.0.1; 5. │ |
117 | | -│ │ │ │ │ │ │ │ x version av │ CVE-2021-380 │ 0.1; 4.1.1; │ |
118 | | -│ │ │ │ │ │ │ │ ailable) │ 7: 7.5 │ 3.0.1 │ |
119 | | -└────┴──────────────┴────────────┴──────────────┴─────────┴─────────┴──────────────┴──────────────┴──────────────┴──────────────┘ |
120 | | - |
121 | | -Do you want to request a waiver for any of the listed packages? (y/n) [n]? y |
122 | | -Please enter the row number(s) for which you want to request a waiver (comma-separated for multiple, range, or “all”) [all]: all |
123 | | -Please enter the reason for the waiver request: Example request |
124 | | -``` |
| 6 | +* [CLI](https://jfrog.com/help/r/jfrog-security-user-guide/developers/cli) |
| 7 | +* [Frogbot](https://jfrog.com/help/r/jfrog-security-user-guide/developers/frogbot) |
| 8 | +* [IDEs](https://jfrog.com/help/r/jfrog-security-user-guide/developers/ides) |
0 commit comments