JFrog and GitHub Expand Partnership, Deliver Single Pane of Glass for Security and Copilot Chat to Empower Developers

Rhea-AI Summary

JFrog and GitHub have expanded their partnership to enhance developer productivity and software supply chain security. Key features of this collaboration include:

1. A Copilot chat extension providing insights on open-source packages within JFrog's binary environment alongside GitHub code data.

2. A consolidated security dashboard combining scan results from GitHub Advanced Security and JFrog Advanced Security.

3. Bidirectional end-to-end release lineage for improved traceability between GitHub Actions Workflow and JFrog Artifactory.

4. Dynamic project mapping and authentication using OpenID Connect integration.

This integration aims to address the gap in binary-level security scanning, highlighted by JFrog's recent discovery of a critical vulnerability in a Docker container affecting Python package repositories.

Positive

• Partnership with GitHub enhances developer productivity and software supply chain security
• Introduction of Copilot chat extension for improved package insights and selection
• Consolidated security dashboard combining GitHub and JFrog Advanced Security scan results
• Improved traceability between GitHub Actions Workflow and JFrog Artifactory
• Streamlined authentication process using OpenID Connect integration

Negative

• None.

Insights

Tech Expert

The expanded partnership between JFrog and GitHub represents a significant step towards streamlining the software development process and enhancing security measures. The integration of JFrog's binary-level security capabilities with GitHub's source code analysis creates a more comprehensive security approach, addressing a critical gap in many organizations' security practices.

Key benefits include:

• A unified security dashboard combining insights from both platforms
• Integration of JFrog's package insights into GitHub Copilot, enhancing AI-assisted development
• Improved traceability between source code and binaries
• Streamlined authentication and project mapping

This collaboration could potentially reduce development time, improve code quality and significantly enhance software supply chain security. However, the real-world impact will depend on the seamless implementation and adoption of these features by development teams.

Security Analyst

This partnership addresses a critical vulnerability in software supply chain security. The JFrog 2024 report revealing that only 56% of companies use both source code and binary scanning is alarming. The integration of JFrog's binary-level security with GitHub's source code analysis could significantly reduce risks associated with overlooked vulnerabilities in binaries.

The recent discovery of a token in a Docker container that could have compromised millions of systems underscores the importance of this holistic approach. By providing a unified view of security scan results and enabling easier traceability, this integration could prevent similar incidents in the future. However, its effectiveness will largely depend on widespread adoption and proper implementation by development teams.

Software Development Analyst

The JFrog-GitHub partnership introduces several features that could substantially improve developer productivity and code quality:

• The Copilot chat extension for package insights could save developers significant time in package selection and validation
• The consolidated security dashboard should help catch vulnerabilities earlier in the development cycle
• Improved release lineage traceability could enhance debugging and auditing processes
• Dynamic project mapping and authentication improvements should reduce friction in the development workflow

These features address common pain points in modern software development. However, the real test will be in the seamless integration of these tools into existing workflows without adding complexity. The potential for AI-assisted development through Copilot's integration with JFrog's artifact metadata is particularly promising, but its effectiveness will depend on the quality and relevance of the insights provided.

Enhanced integration delivers Copilot chat powered by comprehensive software package insights, alongside holistic software supply chain security protection from code to binaries

SUNNYVALE, Calif. & AUSTIN, Texas--(BUSINESS WIRE)-- JFrog swampUP — JFrog Ltd (Nasdaq: FROG), the Liquid Software company and creators of the JFrog Software Supply Chain Platform, and GitHub, the world’s leading code development platform, today unveiled new integrations at JFrog’s annual user conference. This deepening collaboration provides developers with a consolidated view of project status and security posture to help quickly address potential vulnerabilities discovered by the companies’ respective Advanced Security offerings. Additionally, to help developers quickly gain insight on third-party packages, the companies announced a Copilot chat extension to quickly select software packages that are updated, approved by the organization, and safe for use.

JFrog and GitHub expand partnership to deliver unified view of project status and security posture, plus a new Copilot chat extension for validating third-party software packages. (Graphic: Business Wire)

“For developers to be productive, they need complete information about the quality and security of the code and binaries they integrate into their software. Our partnership with GitHub enables teams to do this quickly and with confidence using Copilot,” said Yoav Landman, CTO and Co-Founder, JFrog. “Our partnership also allows developers to navigate between code and the binary artifacts produced by the build process through a more intuitive workflow so they can build and release trusted software, faster. We're excited about our shared roadmap, and look forward to driving a single platform experience for our customers."

According to JFrog’s 2024 Software Supply Chain State of the Union report, only 56% of companies use both source code and binary scanning to secure their software supply chains, leaving nearly half of companies vulnerable to attacks at the binary level. This is very risky, as underscored by the JFrog Security Research team’s recent discovery of a token inadvertently left at the binary level in a Docker container that granted full access to the Python package repository. Had this token been discovered and exploited, it would have impacted tens of millions of computer systems worldwide that run most of today’s internet and cloud infrastructure, automation tasks, financial services and data analysis.

Creating Secure Developer Workflows by Uniting Best-of-Breed Source Code and Binary Platforms

JFrog’s integration with GitHub is expected to offer an easier, more secure way to trace code from its source to the resulting binaries across both platforms with the following key capabilities:

• Copilot Chat Integration for Software Package Insights: The new GitHub Copilot extension boosts developer productivity by providing insights on open-source packages within the JFrog binary environment alongside GitHub code data, eliminating the need to search through documentation or online forums. It also aligns recommendations with organizational curation policies, enabling informed software package choices that consider security and market adoption. Combining Copilot's chat features with JFrog's artifact metadata creates an invaluable AI-powered assistant for developers.
• Consolidated, Single Pane of Glass Security Dashboard: A unified view of security scan results from GitHub Advanced Security and JFrog Advanced Security (including the scanners that found the Python vulnerability mentioned above), helping developers address and remove potential software vulnerabilities earlier in the development lifecycle, saving time and reducing risk.
• Bidirectional End-to-End Release Lineage: The new job summary page on GitHub offers a quick view of the health and security status of each GitHub Actions Workflow, allowing developers to quickly see the output packages from each build, navigate to their location in JFrog Artifactory and back again. This bidirectional navigation utilizes a software bill of materials (SBOM) preserved in JFrog Artifactory, enhancing software lineage traceability.
• Dynamic Project Mapping and Authentication: Improved automatic authorization and seamless project mapping between GitHub Repositories and JFrog Projects in Artifactory utilizing current OpenID Connect (OIDC) integration, eliminating the need for developers to reauthenticate per repository.

For a deeper look at the one-platform experience provided by the JFrog and GitHub integration and partnership, visit the solutions page or read this blog.

Like this story? Post this on X (formerly Twitter): .@jfrog and @gitHub partner to deliver #security & #AI in a one platform experience for #developers. Learn more: https://jfrog.co/3MB3Ygb #DevSecOps #SDLC #softwaresupplychain

About JFrog

JFrog Ltd. (Nasdaq: FROG) is on a mission to create a world of software delivered without friction from developer to device. Driven by a “Liquid Software” vision, the JFrog Software Supply Chain Platform is a single system of record that powers organizations to build, manage, and distribute software quickly and securely, to aid in making it available, traceable, and tamper-proof. The integrated security features also help identify, protect, and remediate against threats and vulnerabilities. JFrog’s hybrid, universal, multi-cloud platform is available as both self-hosted and SaaS services across major cloud service providers. Millions of users and 7K+ customers worldwide, including a majority of the Fortune 100, depend on JFrog solutions to securely embrace digital transformation. Once you leap forward, you won’t go back! Learn more at jfrog.com and follow us on X: @jfrog.

Cautionary Note About Forward-Looking Statements

This press release contains “forward-looking” statements, as that term is defined under the U.S. federal securities laws, including, but not limited to, statements regarding our expectations with respect to the integrated product’s anticipated impact on the developer experience, and anticipated security enhancements to the software supply chain.

These forward-looking statements are based on our current assumptions, expectations and beliefs and are subject to substantial risks, uncertainties, assumptions and changes in circumstances that may cause JFrog’s actual results, performance or achievements to differ materially from those expressed or implied in any forward-looking statement. There are a significant number of factors that could cause actual results, performance or achievements to differ materially from statements made in this press release, including but not limited to risks detailed in our filings with the Securities and Exchange Commission, including in our annual report on Form 10-K for the year ended December 31, 2023, our quarterly reports on Form 10-Q, and other filings and reports that we may file from time to time with the Securities and Exchange Commission. Forward-looking statements represent our beliefs and assumptions only as of the date of this press release. We disclaim any obligation to update forward-looking statements except as required by law.

View source version on businesswire.com: https://www.businesswire.com/news/home/20240910960053/en/

Media Contact:

jfrog@bocacommunications.com

Investor Contact:

Jeff Schreiner, VP of Investor Relations, jeffS@jfrog.com

Source: JFrog Ltd.

FAQ

What new features does the JFrog (FROG) and GitHub partnership offer?

The partnership offers a Copilot chat extension for package insights, a consolidated security dashboard, bidirectional end-to-end release lineage, and dynamic project mapping and authentication.

How does the JFrog (FROG) and GitHub integration improve software supply chain security?

It provides a unified view of security scan results from both platforms, enabling developers to address vulnerabilities earlier in the development lifecycle and enhancing traceability through preserved SBOMs in JFrog Artifactory.

What is the significance of the Copilot chat extension in the JFrog (FROG) and GitHub partnership?

The Copilot chat extension boosts developer productivity by providing insights on open-source packages within JFrog's binary environment alongside GitHub code data, aligning recommendations with organizational curation policies.

How does the JFrog (FROG) and GitHub integration address binary-level security concerns?

The integration combines source code and binary scanning capabilities, addressing the gap where only 56% of companies use both methods, as highlighted in JFrog's 2024 Software Supply Chain State of the Union report.