General

General configuration tasks required for JFrog Curation.

Step 1: Enable the Curation Service:

1. Log in to the JFrog Platform as an admin.
2. Navigate to Administration > Curation > General.
3. Toggle the Curation switch to "On."

Step 2: Configure Notifications:

Notifications set here will be triggered on any package blocked/approved event in the system and will result in an email sent to the defined email addresses or the package requester's email. Note that one package blocked event might be due to one or multiple violated policies.

1. In the Administration tab, select Curation > General:
   • Email Package Requester on Blocked Events: Sends a violation notification by email to the authenticated developer who attempted to download a package in violation of the policy. (This option does not support curated remote repositories that allow anonymous access.)
   • Email Package Requester on Dry Run Events: Sends a dry run violation notification every hour by email to the authenticated developer who attempted to download a package in violation of the policy. (Aggregated email every 60 min)
   • Notify the Email List Regarding Blocked/Dry Run Aggregated Events: Sends an email daily at 8:00 local time for dry runs and blocked packages.to additional addresses that you define, for example, your security officer.
   • Notify the email list regarding disconnected repositories: Sends an email when a repository is disconnected from Curation.

Step 3: Fallback Behavior for Blocked Packages

Define how JFrog Curation should handle package requests when a curation policy blocks the requested version.

• Compliant Version: When enabled, Curation automatically returns the highest package version that passes all policies for both direct and transitive dependencies, so developers can continue working without disruption. Note: This feature is currently in a gradual rollout. To participate or gain early access, contact JFrog Support.

For more information, see Fallback Behavior for Blocked Packages.

The per-policy controls replace the platform-wide Resolution of Pending Package Updates setting. Curation migrates existing policies automatically and applies the previous global value to both controls in every policy.

Curation migrates Dry Run policies to Skip, because a Dry Run policy never blocks a package in a pending state.

Step 4: Configure Webhooks:

Create tickets or notifications from the system if there is a blocking action in the audit using Webhooks events. Whenever a curation process encounters a blocked package, an event is triggered and sent to the designated webhook.

The event includes comprehensive details about the blocked package, such as:

• Package Information: Identifying details of the package that was requested.
• Requester Details: Information on the user or entity that requested the package.
• Policy Violation: A description of the specific policy violation that resulted in the blocking of the package.

Step 5: CLI configuration:
Instal JF CLI to receive a full curation developer experience.
JF CLI supports the Curation jf ca command, which inspects the blocked package and provides the developer with blocking reasons and suggestions. Some package types need a pass-through mechanism to enable the JF CA command.

Learn more in: Curation Compliance Check

Step 5: On-Demand Curation (Optional):

Extend Curation coverage to packages from remote repositories not covered by the JFrog Public Catalog. On-Demand Curation applies your existing policies to any package — including those from internal, private, or uncataloged repositories — evaluating vulnerabilities, licenses, immaturity, and malicious code in real time.

1. Enable Curation for Cached Packages under Advanced Coverage (required prerequisite).
2. Enable Curation On-Demand to activate visibility for on-demand repositories.
3. Enable per package type or per repository in the inner settings pages.

Learn more in On-Demand Curation.

Step 6: Curation Pass-Through:

Enables package downloads for audit purposes without persisting them in Artifactory. Packages are streamed directly to the client, ensuring that evaluation does not populate the repository cache.

Blocking Behavior

Pass-through traffic is not evaluated against standard curation policies. Only policies based on the malicious package template can block pass-through requests. All other policy types (e.g., license, CVE, operational conditions) are bypassed in this mode.

Step 7: Curation Federation (Optional):
Applicable for multiple instances.

Define Curation Federation topology