search

jfrog / frogbot

🐸 Scans your Git repository with JFrog Xray for security vulnerabilities. 🤖
https://docs.jfrog-applications.jfrog.io/
Apache License 2.0
297 stars 69 forks source link

Any chance of supporting conan package manager? #355

Open jjardina opened 1 year ago

jjardina commented 1 year ago

Issue Artifactory supports the Conan package manager for building and analyzing c/c++ projects. Conan is owned by Artifactory. https://conan.io/

The Frogbot documentation says it only supports the following:

Would it be possible to add Conan 2.0 support to Frogbot?

What I would like to see I would like to use Frogbot to support Conan package manager for C/C++ projects. Frogbot would have to parse the conanfile.py file in each repository and do XRAY analysis on the package requirements found in that file.

Current solution Currently we build our job in Jenkins and then upload the build to Artifactory, using the JFrog CLI. The uploaded build is then scanned by XRAY analysis. Frogbot sounds like an excellent tool to push that analysis more left and do XRAY scanning at commit time, instead of waiting for a build to be uploaded.

eyalbe4 commented 1 year ago

Thanks for sharing this requirement @jjardina. We plan to have Frogbot support Conan in the future, but we're not yet able to share a timeline for that.

jamesrelder commented 7 months ago

Any update on this please? We'd love to see Frogbot support conan as in the meantime we are going to need to craft something in-house to grab the scan results from Xray and decorate the PR with them.