-
Notifications
You must be signed in to change notification settings - Fork 22
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support maven cli for curation cli cmd. #13
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please add a description to the PR related to the changes.
Don't forget to update the Documentaion as well if needed.
Please add a link to the PR in core that is related to this.
make sure all the tests on both PR are passing before I will continue to review this.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please add integration tests for curation maven at https://github.com/jfrog/jfrog-cli-security/blob/main/scans_test.go
In this PR I added maven support for curation cli command.
In order to support maven, we first need to be able to get dependency graph from maven ecosystem without being blocked from curation service, this can not be done today as 'mvn dependency:graph' (or jfrog depTree plugin) download jars as part of building the dependency graph, this jars can be potentially blocked by curation service.
In order to overcome this, Artifactory developed a new api that add a flag to curation service on each request, this flag symbol that requested package should not be blocked and also not cached by Artifactory, this will allow curation cli command to build the dep tree successfully, all need to be done is add the new api to the registry url so the package manager will download all the packages through it.
In addition to that because we bypass curation service while building the tree we also added a dedicated cache for curation command, so if any "blocked" package will be download it won't go to the default cache.
Also added to the node graph of maven the type of each node, so when building the download url of each node in the graph it will be clear which type of file it is.
Maven support added silently(depend on env variable), when Artifactory will release official support to the "pass through" api, we will also make it official.
This PR depends on: jfrog/jfrog-cli-core#1118