Curation Demo

The App

This is just a basic Node/Express application generated by IntelliJ's project generator. Nothing fancy here.

The Curation Setup

In Curation JPD

1. Create a local, remote, and virtual repository for NPM
2. In Curation Settings -> Curated Repositories, add the remote from step 1 to the list of curated repositories.
3. Create a Curation Policy for NPM:
   1. Create an arbitrary name.
   2. Set the condition to "CVE with CVSS score of 9 or above (fix version available)".
   3. Set the action to "Block".
   4. Set a notification email address.

In A Local Terminal

1. Ensure JF CLI is installed and configured to point to your JF instance with Curation Enabled

jf c add

2. Configure local NPM Client to point to your JF instance with Curation Enabled:

jf npmc
> Resolve dependencies from Artifactory? (y/n) [y]? y
> Set Artifactory server ID <some-artifactory-instance>: 
> Set repository for dependencies resolution (press Tab for options): <a curated NPM remote proxy repository>
> Deploy project artifacts to Artifactory? (y/n) [y]? y
> Set Artifactory server ID <some-artifactory-instance>: 
> Set repository for artifacts deployment (press Tab for options): <some local or virtual NPM Repo in Target JPD>
> 12:42:28 [🔵Info] npm build config successfully created.

3. Ensure node_modules and package-lock.json are removed to ensure a fresh install:

rm -rf node_modules && rm package-lock.json

4. Install the JF Curation NPM Package:

jf npm install

As long are you have added a package that will trigger a Curation policy violation, you should see the following output:

08:41:15 [🚨Error] couldn't run npm install: npm WARN deprecated [email protected]: core-js@<3.23.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Some versions have web compatibility issues. Please, upgrade your dependencies to the actual version of core-js.
npm ERR! code E403
npm ERR! 403 403 Forbidden - GET https://soleng.jfrog.io/artifactory/api/npm/tomj-curation-npm/protobufjs/-/protobufjs-6.11.2.tgz
npm ERR! 403 In most cases, you or one of your dependencies are requesting
npm ERR! 403 a package version that is forbidden by your security policy, or
npm ERR! 403 on a server you do not have access to.

npm ERR! A complete log of this run can be found in:
npm ERR!     /Users/tomj/.npm/_logs/2023-09-18T13_41_01_290Z-debug-0.log