[orto17]

• The pull request is targeting the dev branch.
• The code has been validated to compile successfully by running go vet ./....
• The code has been formatted properly using go fmt ./....
• All static analysis checks passed.
• All tests have passed. If this feature is not already covered by the tests, new tests have been added.
• Updated the Contributing page / ReadMe page / CI Workflow files if needed.
• All changes are detailed at the description. if not already covered at JFrog Documentation, new documentation have been added.

---

jf xr status only worked when the given repo was a local repo. Xray indexes concrete repos only (local repos and the -cache repo behind a remote one), so remote and virtual keys returned a misleading UNKNOWN or a 404. The command now resolves the repo type itself, so the same command and arguments work for every repo type.

Changes

• Add resolve.go. The given repo is resolved to the concrete repo Xray tracks before any Xray call.
• Add index.go. A multi-arch docker image (manifest list) is expanded into its platform manifests.
• Report the resolved repo next to the requested one (requested_repo in JSON, Resolved From in the table).
• Update the help text.

Resolution

Repo type	Resolved to
Local	The repo itself
Remote	Its -cache repo, taken from the storage API response
Virtual	The first member (in configured order) that holds the artifact. Nested virtual repos are followed, with a cycle guard
<remote>-cache key	Treated as a concrete repo

If the repo configuration can't be read, the key is probed as a concrete repo. A member that returns 403 or 404 is skipped, any other error is returned.

Multi-Arch Docker Images

Xray scans each platform manifest (<image>/sha256__<digest>/manifest.json) and the manifest list carries no violations of its own. Before this change a multi-arch image was reported as ALLOWED even when a platform manifest was blocked.

When the resolved path is a list.manifest.json, each platform manifest present in the repo is evaluated and the worst status wins (BLOCKED, then UNKNOWN, then ALLOWED). Attestation manifests are skipped. The output gains a platforms array and a platform field on each violation. Only platforms present in the repo are checked.

Verification

Verified on a live platform with new Maven and docker local, remote and virtual repos and a blocking policy.

Reference	Resolved to	Status
Local repo	Itself	BLOCKED
Remote repo	<remote>-cache	BLOCKED (was UNKNOWN)
Virtual repo with local member	The local member	BLOCKED (was 404)
Virtual repo with remote member	<remote>-cache	BLOCKED (was 404)
Docker image in a local repo	Itself	BLOCKED
Multi-arch docker image through remote or virtual	<remote>-cache, platform manifest	BLOCKED (was ALLOWED)

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Enterprise
• Run ID: e6beea24-beac-4fc5-ba68-22720c0549f6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}