JFrog CLI: Binary Scan On Demand

Using JFrog CLI with Xray allows users to scan artifacts prior to deploying to your JFrog Platform and allows users to test and discover what would be the Xray scan results according to different parameters on which we will elaborate below.

In order to utilize the On-Demand Binary scan we will utilize JFrog CLI’s “jf s” command.

It is important to emphasize that the “jf s” command only scans local files and will not scan files that were already deployed to your JFrog Platform.
 

--server-id

We will use the server-id option when we want to specify a specific JFrog Platform instance.

This option is commonly used when multiple instances are configured in JFrog CLI but we would like to run the scan against a specific one.

--spec

The spec option allows setting a path to a spec file, spec parameters relevant to the “On Demand Binary Scan” are “pattern” and “recursive” only.
If the pattern argument is provided, this option should not be provided.

--project

When the project option is provided by providing a project key, Xray will determine which violations would occur if the scanned files were uploaded to a specific project.
Not compatible with - “--repo-path” & “--watches”

--repo-path

When a repo path is provided, Xray will determine which violations would occur if the scanned files would be deployed to Artifactory - to this specific repository, based on the watches and policies applied to this repository.

Please note - specifying the path within the repository is a must. To use this option for the root directory of the repository please use “/” at the end of the repository name, i.e:

jf s *.zip --repo-path "<myrepo>/" --server-id <MY-INSTANCE>

Not compatible with - “--project” & “--watches”

 

--watches

When the watches option is set, Xray will determine which violations would occur if the scanned files would be uploaded under a specific watch, based on the policies applied to the watch.

Multiple watches may be set by a comma separated list, i.e: "watch1,watch2"

Please note - multiple watches should be separated by a comma only, please do not add “space” after the comma.
Not compatible with - “--repo-path” & “--project”

--licenses

The licenses option will display licenses detected for the scanned files (with no relation to license due diligence policies)

--format=json 

The format option will change the format of the scan results to JSON format in the terminal.


As a general rule: only one of the following options may be supplied in a scan request:

--watches, --project or --repo-path

Further information is available in our official documentation.