List of Available Conditions
This table lists the available conditions in Curation:
| Category | Condition | Description | Custom condition available | Relaxation Parameters | Supported Package Types |
|---|---|---|---|---|---|
| Security | Malicious package | Blocks 3rd party packages that the JFrog Security Research team has identified as malicious. | No | N/A | All |
| Security | CVE with CVSS (all score combinations) | Blocks 3rd party package versions with a known CVE with NVD CVSS score (all combinations) | Yes |
| All (except Docker) |
| Security | OpenSSF | Block packages based on one or more scorecard checks. | Yes | Disregard if the score does not exist. | All (except Docker) |
| Security | Package Vulnerable to CVE | Detects if the 3rd party package is vulnerable to the configured CVE ID | Yes | N/A | All (except Docker) |
| Security | Block packages listed by Catalog labels | Blocks 3rd party packages that are on a blocked list | Yes | N/A | All (except Docker) |
| Security | Allow only packages listed by Catalog labels | Blocks 3rd party any packages that are not on the allowed list | Yes | N/A | All (except Docker) |
| Security | Package integrity violation | Blocks a cached third-party package when the checksum calculated at download doesn't match the JFrog Catalog checksum for that version. | Yes | Skip if data is missing. | npm, PyPI, Maven, Go, NuGet, Conan, RubyGems, Gradle, SBT, Cargo, Conda, AI editor extensions, Alpine Linux, Dart Pub, PHP Composer, R CRAN |
| Legal | Block list by License | Blocks 3rd party packages with any version that you define. Also evaluates custom assigned licenses from JFrog Catalog. | Yes | Allow if one or more package licenses are not on the list. | All (except Docker) |
| Legal | Allow list by License | Blocks 3rd party packages with any version that is not on the defined list. Also evaluates custom assigned licenses from JFrog Catalog. | Yes | Allow if at least one package license is on the list. | All (except Docker) |
| Legal | Package has no identified license | Blocks 3rd party package versions that have no identified license, either because it is missing or because it could not be identified as the package license. | No | N/A | All (except Docker) |
| Operational | Image is not Docker Hub official | Detects Docker Images from the Docker Hub registry that do not have “Docker Official Image" | No | N/A | Docker |
| Operational | Package version is aged (no newer version identified) | Blocks 3rd party package versions whose release date is more than 2 years old, and no newer version of the package exists. | No | N/A | All (except Docker) |
| Operational | Package version is aged (newer version available) | Blocks 3rd party package versions whose release date is more than 180 days older than the package’s latest version release date. | No | N/A | All (except Docker) |
| Operational | Package version is immature | Blocks 3rd party packages whose version release date is less than the defined number of dates old | Yes | Allow if fixes CVE in your repositories | All (except Docker) |
| Operational | Package has only a single version | Blocks 3rd party packages that have only one version available, which are often immature or unmaintained. | No | N/A | All (except Docker) |
| Operational | Package version is End of Life | Blocks 3rd party package versions that JFrog Catalog marks as End of Life (EOL). EOL versions no longer receive security patches or maintenance updates. Available from Xray 3.150.17. | No | N/A | npm, PyPI, NuGet, RubyGems, Composer, Cargo |
Package Integrity Violation
Package integrity violation compares the SHA256 checksum calculated for a cached package with the SHA256 checksum JFrog Catalog holds for that version. You can use this condition to block a package that changed during download.
Curation runs the check when the package is already in the remote repository cache and JFrog Artifactory provides a SHA256 checksum.
The built-in condition enables Skip if data is missing. If JFrog Catalog has no checksum for that version, Curation skips the check. You can create a custom condition from the Package integrity violation template and clear Skip if data is missing. Curation then blocks the package, because the checksum can't be verified.
When the checksums don't match, the download client receives a message that the package integrity check failed. The audit event explanation includes the JFrog Artifactory checksum and the JFrog Catalog checksum. Check with your security manager about the connection or the download.
This condition doesn't run during Compliant Version Selection. That flow has no cached checksum to compare.
For more information, see Create Policies.
Updated 12 days ago