Curation Compliance Check

JFrog Curation defends your software supply chain by enabling early detection and blocking of malicious or risky open-source packages before they enter your environment. It helps identify harmful, vulnerable, or non-compliant packages seamlessly, enhancing security, compliance, and developer productivity.

The curation-audit command checks the project to identify third-party dependencies that violate Curation service restrictions. It provides detailed insights into policy violations and may suggest compliant package alternatives.

Learn more about Curation Supported Technologies here.

Command: curation-audit, ca

Configuration

• Pass-Through Curation: Required for package types except npm. Configure on remote repositories in Artifactory.

• Connect JFrog CLI to Platform:

  jf c add

  Use an access token from Artifactory when prompted. Verify the connection:

  jf c show

• Project Configuration:

  • Config command: Sets up jf ca for that package manager.
  • Set Me Up: The package manager's native configuration produced by Artifactory Set Me Up.

  The following table describes how to configure each package manager for jf ca.

  Package Manager	Config Command	Configuration Mode	Pass-Through Required	Notes
  npm	jf npmc	Config command or Set Me Up	No	The --run-native flag helps you use native configuration.
  yarn	No config command	Set Me Up	Yes	Yarn V2, V3, and V4 are supported. V1 is not supported.
  pnpm	No config command	Set Me Up	No	pnpm v10.x only.
  pip	jf pipc	Config command or Set Me Up	Yes
  Maven	jf mvnc	Config command only	Yes
  Go	jf goc	Config command only	Yes
  NuGet	jf nugetc	Config command or Set Me Up	Yes	The --solution-path flag provides a path to the .NET solution file (.sln or .slnx) when multiple solution files are present in the directory.
  Gradle	jf gradlec	Config command only	Yes	Audits .jar only, not .pom or Gradle Module Metadata.
  poetry	No config command	Set Me Up	Yes	Poetry v1.2.0 or higher is supported.
  RubyGems	jf ruby-config	Config command or Set Me Up	Yes	Ruby 2.6.0 or higher is supported.
  Docker	No config command. Run jf ca --image=<image>	Set Me Up	No	Audits a Docker image against Curation policies. Does not analyze Dockerfiles or extract packages from image layers. Supported from JFrog CLI 2.89.0.
  pipenv	No config command	Set Me Up	Yes	pipenv v2023.7.4 or higher.
  Hugging Face	No config command	Set Me Up	No	The --hugging-face-model flag audits Hugging Face models in <repo-id>[:revision] format. Multiple models can be comma-separated.
  Cargo	No config command	Set Me Up	No
  uv	No config command	Set Me Up	Yes	uv v0.6.17 or higher is supported.

Commands Parameters

Examples

Audit the current directory:

jf curation-audit

Audit specific directories:

jf curation-audit --working-dirs="/path/to/project/npm_project1,/path/to/project/npm_project2"

Audit with multiple threads:

jf curation-audit --threads=5

Exclude specific packages or versions from policy restrictions using waivers:

1. Execute the jf-curation-audit command:

jf curation-audit
Found 4 blocked packages for project sample-node-project:1.0.0
Curation
┌────┬──────────────┬────────────┬──────────────┬─────────┬─────────┬──────────────┬──────────────┬──────────────┬──────────────┐
│ ID │ DIRECT       │ DIRECT     │ BLOCKED      │ BLOCKED │ PACKAGE │ VIOLATED     │ VIOLATED CON │ EXPLANATION  │ RECOMMENDATI │
│    │ DEPENDENCY   │ DEPENDENCY │ PACKAGE      │ PACKAGE │ TYPE    │ POLICY       │ DITION       │              │ ON           │
│    │ PACKAGE      │ PACKAGE    │ NAME         │ VERSION │         │ NAME         │ NAME         │              │              │
│    │ NAME         │ VERSION    │              │         │         │              │              │              │              │
├────┼──────────────┼────────────┼──────────────┼─────────┼─────────┼──────────────┼──────────────┼──────────────┼──────────────┤
│ 1  │ ansi-regex   │ 3.0.0      │ ansi-regex   │ 3.0.0   │ npm     │ High CVE     │ CVE with CVS │ Package vers │ Upgrade to t │
│    │              │            │              │         │         │              │ S score betw │ ion contains │ he following │
│    │              │            │              │         │         │              │ een 7.0 and  │ the followin │ version(s):  │
│    │              │            │              │         │         │              │ 8.9 (with or │ g vulnerabil │ CVE-2021-380 │
│    │              │            │              │         │         │              │ without a fi │ ity(s):      │ 7: 6.0.1; 5. │
│    │              │            │              │         │         │              │ x version av │ CVE-2021-380 │ 0.1; 4.1.1;  │
│    │              │            │              │         │         │              │ ailable)     │ 7: 7.5       │ 3.0.1        │
└────┴──────────────┴────────────┴──────────────┴─────────┴─────────┴──────────────┴──────────────┴──────────────┴──────────────┘

2. Enter y as an answer to whether or not you want a waiver:

Do you want to request a waiver for any of the listed packages? (y/n) [n]? y

3. Enter table row numbers representing packages you want to exclude from policy restrictions:

Please enter the row number(s) for which you want to request a waiver (comma-separated for multiple, range, or “all”) [all]: all

4. Enter the reason for requesting a waiver:

Please enter the reason for the waiver request: Required packages