Xray on Software Factory

JFrog Generate SBOMs

Mon, 01 Jan 0001 00:00:00 +0000

A Software Bill of Materials is a machine-readable inventory of all components, libraries and dependencies shipped inside software.

This page shows how to generate SBOMs during the development lifecycle.

Important

This page focuses on SBOM generation and visibility. For policy enforcement, violation management, and license compliance, see Xray License Scanning .

SCA with JFrog Xray and Release Bundles for Maven Projects

Mon, 01 Jan 0001 00:00:00 +0000

This page walks through building a Maven project using jf mvn instead of plain mvn generating SBOM with your packages, publishing a BuildInfo to Artifactory, scanning for vulnerabillities with Xray and Policy enforcement, and finally packaging everything into a Release Bundle .

How to read this page

The pipeline is built incrementally — each section adds one capability on top of the previous one.

JFrog Xray Vulnerability Scan

Mon, 01 Jan 0001 00:00:00 +0000

Overview

Xray detects known vulnerabilities (CVEs) in the components of your repositories, builds and release bundles.

It identifies each component, maps it to known vulnerabilities from public and proprietary sources and lets you enforce security policies using policies and watches mechanism.

For background on how Xray works, see Xray Page .
For license compliance, see Xray License Scanning .

Prerequisites

Before you start, make sure you have:

Access to a JFrog Platform instance with Xray enabled
A dedicated Project.
A role with Manage Xray Data, Manage Watches & Policies and Manage Reports permission within that project.
JFrog CLI installed and configured

Create a vulnerability policy

A policy defines what counts as a violation and what action Xray takes when one is found.

JFrog Xray

Mon, 01 Jan 0001 00:00:00 +0000

JFrog Xray is part of the Software Factory’s Software Composition Analysis (SCA ) offering, available with the DevSecOps package. It can be used standalone via the JFrog CLI, or coupled with JFrog Artifactory for end-to-end security and compliance management across your software supply chain.

Info

This page describes the tool independently of any platform-specific details. For the service URL and other platform-specific configuration, please refer to your platform’s dedicated page .