Artifactory 7.104.2 Cloud

Evidence Service

JFrog's new Evidence service generates an audit trail that documents all the security, quality, and operational steps taken to produce a production-ready software release. It enriches artifacts, packages, builds, and Release Bundles with signed attestation metadata (based on the in-toto Attestation Framework) that can be tracked and verified easily for governance and compliance. The Evidence service enables you to seamlessly consolidate information from all the tools and platforms used in software development into a trusted single source of truth. It also integrates seamlessly with Release Lifecycle Management, providing a graphical interface for viewing the evidence generated at each stage of your SDLC.Understanding Release Bundles v2Release Lifecycle Management

Artifactory creates signed evidence automatically when Release Bundles are promoted and distributed. When used in conjunction with JFrog Xray, additional evidence is created in the form of SBOMs and vulnerability reports.Promote a Release Bundle (v2) to a Target EnvironmentDistribute Release Bundles (v2)

In addition, Enterprise+ users can attach externally-produced evidence to artifacts, packages, builds, and Release Bundles using the JFrog CLI.

For more information, see Evidence Management.Evidence Management

Artifactory Federation Service

To meet the growing needs of customers, JFrog has moved the Federated repositories feature into a standalone, multi-tenant service to ensure the timely synchronization of huge volumes of artifact metadata between customer sites. The new standalone service offers the following benefits:Federated Repositories

Using the Federation Comparison Tool on Federated Repositories

Users who have the Artifactory Federation Service installed can use the Federation Comparison Tool to compare the state of a Federated repository with one or more remote members to detect missing artifacts in those remote members. This enables you to simulate the results of a Full Sync operation before you perform it. The Federation Comparison tool is invoked using a new query parameter in the Federated Repository Full Sync REST API. For more information, see Use the Federation Comparison Tool.Artifactory Federation ServiceFederated Repository Full SyncUse the Federation Comparison Tool

Cleanup Policies: Release Bundle v2

JFrog Cleanup Policies for Release Bundle v2 enable Platform and Project Administrators to define and customize policies based on specific criteria for removing unused Release Bundles across their JFrog platform. This provides optimal system performance. Administrators can customize a repeatable cleanup process that aligns with their organization's requirements by setting specific criteria and rules. For more information, refer to Cleanup Policies.Cleanup Policies

Helm Enforce Layout

Helm Enforce Layout is designed to maintain the integrity and organization of Helm charts within your repositories. It consists of two key functionalities that promote structure and reduce errors during deployments: 

For more information on Helm Enforce Layout, click here.Helm Enforce Layout

Updating multiple repositories using a batch request

It is now possible to update the configuration of multiple repositories using a single batch request. The request can contain a mixture of package types (for example, Docker and Maven) and repository types (for example, local and remote). For more information, see Update Multiple Repositories.Update Multiple Repositories

Viewing contents of Release Bundle v2 versions by package type

The window for viewing the contents of a Release Bundle v2 version has been redesigned to organize the contents according to package type. You can drill down from a package type to individual packages and from there, click a link to see the individual artifacts. For more information, see View the Contents of a Release Bundle (v2).View the Contents of a Release Bundle (v2)

Promoting Release Bundle v2 versions to virtual repositories

You can now promote a Release Bundle v2 version to a virtual repository, provided it contains at least one local repository assigned to the same environment as the virtual repository (or no environment at all). For more information about promotion, see Promote a Release Bundle (v2) to a Target Environment.Promote a Release Bundle (v2) to a Target Environment

Virtual repositories can include repositories not assigned or shared to the same project

You can now edit a virtual repository configuration that contains local and remote repositories which are not assigned to, or shared with, the same project as the virtual repository. If such repositories are aggregated, a message appears in the UI. Click the button next to the message to display a list of these repositories. You can export this list to a CSV file. For more information, see Virtual Repositories and Projects.Assign Multiple Projects to ResourcesShare Repositories Across Multiple ProjectsProjectsSelect Repositories to Include in a Virtual Repository

Improved Performance for the Fetching Process

Performance of the fetching process has been improved, based on the count of manifests relative to the Max Unique Tags configuration.

Improvements in Obtaining AQL Results

The Search AQL API was improved such that AQL results are complete and not missing properties. A notification is now provided informing the client when the AQL limit has been reached. For information, see Artifactory Query Language (AQL) REST API.Artifactory Query Language (AQL)

Support for Ansible Packages in Cleanup and Archive

Supported Worker Features

Enabling SSO Disables Basic Authentication By Default

Enabling single sign-on authentication now disables internal password authentication by default. For more information, see Disable Basic Authentication Method.Disable Basic Authentication Method