Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support maven cli for curation cli cmd. #13

Merged
merged 19 commits into from
Feb 14, 2024
Merged

Conversation

asafambar
Copy link
Contributor

@asafambar asafambar commented Jan 25, 2024

In this PR I added maven support for curation cli command.

In order to support maven, we first need to be able to get dependency graph from maven ecosystem without being blocked from curation service, this can not be done today as 'mvn dependency:graph' (or jfrog depTree plugin) download jars as part of building the dependency graph, this jars can be potentially blocked by curation service.

In order to overcome this, Artifactory developed a new api that add a flag to curation service on each request, this flag symbol that requested package should not be blocked and also not cached by Artifactory, this will allow curation cli command to build the dep tree successfully, all need to be done is add the new api to the registry url so the package manager will download all the packages through it.

In addition to that because we bypass curation service while building the tree we also added a dedicated cache for curation command, so if any "blocked" package will be download it won't go to the default cache.

Also added to the node graph of maven the type of each node, so when building the download url of each node in the graph it will be clear which type of file it is.

Maven support added silently(depend on env variable), when Artifactory will release official support to the "pass through" api, we will also make it official.

This PR depends on: jfrog/jfrog-cli-core#1118

@attiasas attiasas added the safe to test Approve running integration tests on a pull request label Jan 25, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Jan 25, 2024
@attiasas attiasas added improvement Automatically generated release notes safe to test Approve running integration tests on a pull request labels Feb 4, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Feb 4, 2024
Copy link
Contributor

@attiasas attiasas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add a description to the PR related to the changes.
Don't forget to update the Documentaion as well if needed.
Please add a link to the PR in core that is related to this.
make sure all the tests on both PR are passing before I will continue to review this.

config/general.go Outdated Show resolved Hide resolved
@attiasas attiasas added the safe to test Approve running integration tests on a pull request label Feb 4, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Feb 4, 2024
Copy link
Contributor

@attiasas attiasas left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please add integration tests for curation maven at https://github.com/jfrog/jfrog-cli-security/blob/main/scans_test.go

config/general.go Outdated Show resolved Hide resolved
config/general.go Outdated Show resolved Hide resolved
config/general.go Outdated Show resolved Hide resolved
commands/curation/curationaudit.go Show resolved Hide resolved
commands/curation/curationaudit.go Outdated Show resolved Hide resolved
commands/curation/curationaudit.go Outdated Show resolved Hide resolved
commands/curation/curationaudit.go Show resolved Hide resolved
commands/curation/curationaudit.go Outdated Show resolved Hide resolved
commands/audit/scarunner.go Outdated Show resolved Hide resolved
commands/audit/scarunner.go Outdated Show resolved Hide resolved
@attiasas attiasas added the safe to test Approve running integration tests on a pull request label Feb 13, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Feb 13, 2024
@attiasas attiasas added the safe to test Approve running integration tests on a pull request label Feb 13, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Feb 13, 2024
@attiasas attiasas added the safe to test Approve running integration tests on a pull request label Feb 13, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Feb 13, 2024
@attiasas attiasas added the safe to test Approve running integration tests on a pull request label Feb 14, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Feb 14, 2024
Copy link

👍 Frogbot scanned this pull request and found that it did not add vulnerable dependencies.


@attiasas attiasas added the safe to test Approve running integration tests on a pull request label Feb 14, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Feb 14, 2024
@attiasas attiasas added the safe to test Approve running integration tests on a pull request label Feb 14, 2024
@github-actions github-actions bot removed the safe to test Approve running integration tests on a pull request label Feb 14, 2024
@attiasas attiasas merged commit d8ecf2a into jfrog:dev Feb 14, 2024
7 of 8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
improvement Automatically generated release notes
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants