Possible to docker push while xray has block unscanned artifacts?

[cdobinsky]

Hey, currently we have a docker repo which has a policy to block download of unscanned artifacts.
If we use the jfrog-cli to get build information in our ci and push a docker image which has vulnerabilities, it fails to get the build information afterwards because it is getting blocked due to the xray policy.
Therefore when we publish the build information the pushed image is not shown in the published modules of the build and also if we scan the build with xray it won't fail the CI since there is nothing to scan.

We could disable block of unscanned artifacts then it works just fine but is there also a way to have block unscanned artifacts enabled and still get the build information?

Version
JFrog CLI version: 1.41.2
JFrog CLI operating system: Linux
Artifactory Version: CommercialX license 7.11.2 rev 71102900
Xray Version: 3.12

[eyalbe4]

@cdobinsky,
I think that Artifactory 7.5 with Xray 4.x resolve this issue, by introducing a "grace period" of 60 seconds by default, in which newly deployed articles are not blocked for download.
You can read this for more information.
I'd very much like to hear your feedback for this. Please let me know if this resolves the issue.

[cdobinsky]

@eyalbe4 thanks for the reply.
It is set to 60 seconds but as far as I understood this parameter just keeps the connection open for 60 seconds to be able to scan it during that time. So it gets scanned and then the policy is blocking it.

When a repository is configured to block downloads of unscanned artifacts, this setting will make every download request connection remain open for the time configured (in seconds), allowing Xray sufficient time to scan the artifact and then return the artifact or block it based on scan results.