etingertal/xray-cli

xray-cli

Intro

This is a sample project for demonstrating JFrog Xray CLI capabilites of:

• Dependecies Scanning
• On-Demand Binary scanning

Pre-requisties

• JFrog CLI v2.1.0 (or above)
  • M2_HOME environment variable is needed to be set
  • JFrog CLI configuration should be set with an Access Token
• Artifactory (7.21.3 and above) & Xray (3.29.0 and above) working installation
  • For Docker scanning: JFrog CLI (2.11.0 and above), Artifactory (7.31.10 and above) & Xray (3.40.3 and above) working installation
• Maven - for compiling & packaging the Java sample project ("petclinic")

Usage

• Dependecies Scanning CLI

  • Maven:

    • Vulnerabilites scanning (without Policy or Watch defined)

      cd spring-petclinic-main/
      jfrog xr audit-mvn
      

      Output:
    • Violations scanning (based on existing Watch in Xray) in JSON format

      cd spring-petclinic-main/
      jfrog xr audit-mvn --watches "all-builds" --format json
      

      Output:

  • Docker:

    • Vulnerabilites scanning (without Policy or Watch defined)

      cd docker-image/
      jfrog s thomseno-h2.tar
      

      Output:

    • Violations scanning (based on existing Watch in Xray)

      cd docker-image/
      jfrog s thomseno-h2.tar --watches "all-builds"
      

      Output:

• On-Demand Binary scanning CLI

  NOTE: mvn package is needed for creating the JAR file under the target/ directory

  • Vulnerabilites scanning (without Policy or Watch defined)

    cd docker-image/
    jfrog xr s spring-petclinic-2.4.5.jar
    

    Output:

  • Violations scanning (based on existing Watch in Xray)

    cd spring-petclinic-main/target/
    jfrog xr s spring-petclinic-2.4.5.jar --watches "all-builds"
    

    Output: