From 9e1ddaa0b14776ee446725ee30a5e096b5e652f5 Mon Sep 17 00:00:00 2001 From: Assaf Attias <49212512+attiasas@users.noreply.github.com> Date: Wed, 27 Nov 2024 12:53:18 +0200 Subject: [PATCH] Update Dependencies (#249) --- .github/actions/install-and-setup/action.yml | 2 +- audit_test.go | 4 +--- commands/audit/sca/nuget/nuget.go | 6 +++--- commands/audit/sca/nuget/nuget_test.go | 2 +- commands/curation/curationaudit_test.go | 2 ++ go.mod | 17 ++++++----------- go.sum | 12 ++++++------ 7 files changed, 20 insertions(+), 25 deletions(-) diff --git a/.github/actions/install-and-setup/action.yml b/.github/actions/install-and-setup/action.yml index a948756f7..31039dd95 100644 --- a/.github/actions/install-and-setup/action.yml +++ b/.github/actions/install-and-setup/action.yml @@ -8,7 +8,7 @@ runs: - name: Setup Go uses: actions/setup-go@v5 with: - go-version: 1.22.x + go-version: 1.23.x # - name: Setup Go with cache # uses: jfrog/.github/actions/install-go-with-cache@main diff --git a/audit_test.go b/audit_test.go index 1eb3c44f1..52d437249 100644 --- a/audit_test.go +++ b/audit_test.go @@ -756,9 +756,7 @@ func TestXrayAuditJasSimpleJsonWithXrayUrl(t *testing.T) { // custom excluded folders func TestXrayAuditJasSimpleJsonWithCustomExclusions(t *testing.T) { - cliToRun := integration.GetTestCli(cli.GetJfrogCliSecurityApp(), true) - - output := testXrayAuditJas(t, cliToRun, filepath.Join("jas", "jas"), "3", false, false, false, "non_existing_folder") + output := testXrayAuditJas(t, securityTests.PlatformCli, filepath.Join("jas", "jas"), "3", false, false, false, "non_existing_folder") validations.VerifySimpleJsonResults(t, output, validations.ValidationParams{ Sast: 2, Iac: 9, diff --git a/commands/audit/sca/nuget/nuget.go b/commands/audit/sca/nuget/nuget.go index 72280f656..76f6a8267 100644 --- a/commands/audit/sca/nuget/nuget.go +++ b/commands/audit/sca/nuget/nuget.go @@ -93,7 +93,7 @@ func restoreInTempDirAndGetBuildInfo(params utils.AuditParams, wd string, exclus } log.Info("Dependencies sources were not detected nor 'install' command provided. Running 'restore' command") - sol, err := runDotnetRestoreAndLoadSolution(params, tmpWd, exclusionPattern) + sol, err := runDotnetRestoreAndLoadSolution(params, tmpWd, exclusionPattern, params.InsecureTls()) if err != nil { return } @@ -116,7 +116,7 @@ func isInstallRequired(params utils.AuditParams, sol solution.Solution, skipAuto return installRequired, nil } -func runDotnetRestoreAndLoadSolution(params utils.AuditParams, tmpWd, exclusionPattern string) (sol solution.Solution, err error) { +func runDotnetRestoreAndLoadSolution(params utils.AuditParams, tmpWd, exclusionPattern string, allowInsecureConnections bool) (sol solution.Solution, err error) { toolName := params.InstallCommandName() if toolName == "" { // Determine if the project is a NuGet or .NET project @@ -148,7 +148,7 @@ func runDotnetRestoreAndLoadSolution(params utils.AuditParams, tmpWd, exclusionP log.Info(fmt.Sprintf("Resolving dependencies from '%s' from repo '%s'", serverDetails.Url, depsRepo)) var configFile *os.File - configFile, err = dotnet.InitNewConfig(tmpWd, depsRepo, serverDetails, false) + configFile, err = dotnet.InitNewConfig(tmpWd, depsRepo, serverDetails, false, allowInsecureConnections) if err != nil { err = fmt.Errorf("failed while attempting to generate a configuration file for setting up Artifactory as a resolution server") return diff --git a/commands/audit/sca/nuget/nuget_test.go b/commands/audit/sca/nuget/nuget_test.go index 4b0b0325f..2a04fedcc 100644 --- a/commands/audit/sca/nuget/nuget_test.go +++ b/commands/audit/sca/nuget/nuget_test.go @@ -141,7 +141,7 @@ func TestRunDotnetRestoreAndLoadSolution(t *testing.T) { assert.Empty(t, sol.GetDependenciesSources()) params := &xrayUtils2.AuditBasicParams{} - sol, err = runDotnetRestoreAndLoadSolution(params, tempDirPath, "") + sol, err = runDotnetRestoreAndLoadSolution(params, tempDirPath, "", true) assert.NoError(t, err) assert.NotEmpty(t, sol.GetProjects()) assert.NotEmpty(t, sol.GetDependenciesSources()) diff --git a/commands/curation/curationaudit_test.go b/commands/curation/curationaudit_test.go index 943e49579..f9c769ef0 100644 --- a/commands/curation/curationaudit_test.go +++ b/commands/curation/curationaudit_test.go @@ -507,6 +507,8 @@ func createCurationCmdAndRun(tt testCase) (cmdResults map[string]*CurationReport curationCmd := NewCurationAuditCommand() curationCmd.SetIsCurationCmd(true) curationCmd.parallelRequests = 3 + // For tests, we use localhost http server (nuget have issues without setting insecureTls) + curationCmd.SetInsecureTls(true) curationCmd.SetIgnoreConfigFile(tt.shouldIgnoreConfigFile) cmdResults = map[string]*CurationReport{} err = curationCmd.doCurateAudit(cmdResults) diff --git a/go.mod b/go.mod index cbf7b91dd..7e2154ef4 100644 --- a/go.mod +++ b/go.mod @@ -1,19 +1,17 @@ module github.com/jfrog/jfrog-cli-security -go 1.22.9 - -toolchain go1.23.3 +go 1.23.3 require ( github.com/beevik/etree v1.4.0 github.com/google/go-github/v56 v56.0.0 github.com/gookit/color v1.5.4 - github.com/jfrog/build-info-go v1.10.5 + github.com/jfrog/build-info-go v1.10.6 github.com/jfrog/froggit-go v1.16.2 github.com/jfrog/gofrog v1.7.6 github.com/jfrog/jfrog-apps-config v1.0.1 - github.com/jfrog/jfrog-cli-core/v2 v2.56.7 - github.com/jfrog/jfrog-client-go v1.47.6 + github.com/jfrog/jfrog-cli-core/v2 v2.57.0 + github.com/jfrog/jfrog-client-go v1.48.1 github.com/magiconair/properties v1.8.7 github.com/owenrumney/go-sarif/v2 v2.3.0 github.com/stretchr/testify v1.9.0 @@ -113,13 +111,10 @@ require ( gopkg.in/warnings.v0 v0.1.2 // indirect ) -// replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 dev - -replace github.com/jfrog/jfrog-client-go => github.com/jfrog/jfrog-client-go v1.28.1-0.20241124172451-50bd3e54f1e0 +// replace github.com/jfrog/jfrog-client-go => github.com/jfrog/jfrog-client-go dev -// replace github.com/jfrog/jfrog-client-go => ../cli-projects/jfrog-client-go +// replace github.com/jfrog/jfrog-cli-core/v2 => github.com/jfrog/jfrog-cli-core/v2 dev -// replace github.com/jfrog/jfrog-client-go => github.com/attiasas/jfrog-client-go v0.0.0-20241118103817-1d4e8d19de4f // replace github.com/jfrog/build-info-go => github.com/jfrog/build-info-go dev diff --git a/go.sum b/go.sum index 22da96e35..3e9e856a1 100644 --- a/go.sum +++ b/go.sum @@ -119,18 +119,18 @@ github.com/jedib0t/go-pretty/v6 v6.6.1 h1:iJ65Xjb680rHcikRj6DSIbzCex2huitmc7bDtx github.com/jedib0t/go-pretty/v6 v6.6.1/go.mod h1:zbn98qrYlh95FIhwwsbIip0LYpwSG8SUOScs+v9/t0E= github.com/jfrog/archiver/v3 v3.6.1 h1:LOxnkw9pOn45DzCbZNFV6K0+6dCsQ0L8mR3ZcujO5eI= github.com/jfrog/archiver/v3 v3.6.1/go.mod h1:VgR+3WZS4N+i9FaDwLZbq+jeU4B4zctXL+gL4EMzfLw= -github.com/jfrog/build-info-go v1.10.5 h1:cW03JlPlKv7RMUU896uLUxyLWXAmCgR5Y5QX0fwgz0Q= -github.com/jfrog/build-info-go v1.10.5/go.mod h1:JcISnovFXKx3wWf3p1fcMmlPdt6adxScXvoJN4WXqIE= +github.com/jfrog/build-info-go v1.10.6 h1:zH1ZhXlVfi5DlFyunygHjrdOcnv5qxfeLqmsfD4+lc4= +github.com/jfrog/build-info-go v1.10.6/go.mod h1:JcISnovFXKx3wWf3p1fcMmlPdt6adxScXvoJN4WXqIE= github.com/jfrog/froggit-go v1.16.2 h1:F//S83iXH14qsCwYzv0zB2JtjS2pJVEsUoEmYA+37dQ= github.com/jfrog/froggit-go v1.16.2/go.mod h1:5VpdQfAcbuyFl9x/x8HGm7kVk719kEtW/8YJFvKcHPA= github.com/jfrog/gofrog v1.7.6 h1:QmfAiRzVyaI7JYGsB7cxfAJePAZTzFz0gRWZSE27c6s= github.com/jfrog/gofrog v1.7.6/go.mod h1:ntr1txqNOZtHplmaNd7rS4f8jpA5Apx8em70oYEe7+4= github.com/jfrog/jfrog-apps-config v1.0.1 h1:mtv6k7g8A8BVhlHGlSveapqf4mJfonwvXYLipdsOFMY= github.com/jfrog/jfrog-apps-config v1.0.1/go.mod h1:8AIIr1oY9JuH5dylz2S6f8Ym2MaadPLR6noCBO4C22w= -github.com/jfrog/jfrog-cli-core/v2 v2.56.7 h1:pB4ronzVk60k/lf9bUL9HxBZ8PbMW6LhbIFld9NXNNc= -github.com/jfrog/jfrog-cli-core/v2 v2.56.7/go.mod h1:puLwWcnXYCJqUOvhscXRJiKNzPdj0adP+zadKy6A/gU= -github.com/jfrog/jfrog-client-go v1.28.1-0.20241124172451-50bd3e54f1e0 h1:YROG+bJY4QJEz9KdKUbBlbOHXY1vnDhhi0/cXrEgu9E= -github.com/jfrog/jfrog-client-go v1.28.1-0.20241124172451-50bd3e54f1e0/go.mod h1:1a7bmQHkRmPEza9wva2+WVrYzrGbosrMymq57kyG5gU= +github.com/jfrog/jfrog-cli-core/v2 v2.57.0 h1:3ON0J6Sjc2+4HZrzh4eSbdciXx3sJsJUIJ3TPQXh/5c= +github.com/jfrog/jfrog-cli-core/v2 v2.57.0/go.mod h1:SThaC/fniC96oN8YgCsHjvOxp5rBM7IppuIybn1oxT0= +github.com/jfrog/jfrog-client-go v1.48.1 h1:R6x6gazy0F196XXDhDdRAxmNplSJ5SrJfEmmNBgks/8= +github.com/jfrog/jfrog-client-go v1.48.1/go.mod h1:1a7bmQHkRmPEza9wva2+WVrYzrGbosrMymq57kyG5gU= github.com/k0kubun/colorstring v0.0.0-20150214042306-9440f1994b88/go.mod h1:3w7q1U84EfirKl04SVQ/s7nPm1ZPhiXd34z40TNz36k= github.com/k0kubun/pp v3.0.1+incompatible/go.mod h1:GWse8YhT0p8pT4ir3ZgBbfZild3tgzSScAn6HmfYukg= github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=