search

jfrog / build-info

Artifactory's open integration layer for CI build servers
https://www.buildinfo.org
Apache License 2.0
147 stars 155 forks source link

Xray identified and blocked download Jcenter Maven package for unknown license #465

Open hchiao1 opened 3 years ago

hchiao1 commented 3 years ago

Describe the bug build-extractor-info-gradle and build-info-client are both packages supported by JFrog in JCenter. However, Xray is blocking the download due to unknown licenses.

To Reproduce Download these artifacts directly, and upload them to Artifactory for Xray to scan.

Expected behavior All packages JFrog maintain should have licenses installed in order to prevent Xray from blocking the download. May affect production workload.

Screenshots

image image

Versions

Additional context Xray has few methods to scan for licensing. pom is one of them. Please add license info on the pom file. https://jfrog.com/knowledge-base/how-does-jfrog-xray-detects-the-licenses-of-packages/

DanielJRutledge commented 3 years ago

Any possibility of updating the metadata for this quicker? Our builds currently track the latest version, and Xray blocks it for a missing license the minute it's released, breaking all our builds.