XRAY: How to Automate JFrog Xray Offline Vulnerability DB Sync Using REST APIs

Offline:

In offline mode, you manually download files from the global database server and then upload them to Xray

According to the official document, when we use the Offline mode with JFrogCLI, we also need to manually copy the files for Xray server and click “Sync Now” on the UI page.

Requirements and solutions

Some customers would like to automate all the steps, and the two APIs introduced in this article can help with that.

These APIs are complex to use, please take care when writing your automation scripts.

```
api/v1/updates/generateDownloadCommand
```
```
api/v1/updates/startOfflineSync
```

Note:

The APIs have been tested in many versions as below 3.81.X;



Practice

The complete process consists of the following steps:

Get the jf command from the Rest API, then run the command to download the offline sync files

$ curl http://xx:xx/xray/api/v1/updates/generateDownloadCommand -XGET  -uadmin:'xx'
{"snippet":"jf xr offline-update --license-id=xx xxxx xxxx"}

Copy the files the "jf" client downloaded to these folders (Xray <=3.79.11) $ mv

$ mv comp_0.zip ${XRAY_HOME}/var/work/server/updates/component/
$ mv vuln_0.zip ${XRAY_HOME}/var/work/server/updates/vulnerability/

Note:

If you are using the new V3 DB Sync method, use this path instead:

{XRAY_HOME}/var/work/server/updates/v3

Invoke the "Sync Now" Xray Rest API

$ curl http://xx:xx/xray/api/v1/updates/startOfflineSync -XPOST  -uadmin:'xx'
{"info":"Local updates started"}

```
Get progress by UI
```