jfrog / jfrog/jfrog-cli-security

maven audit fails for Java > 11 in Container Image

Open
#349 9 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
13
Forks
50
Avg merge
3d 48m
Merged PRs (30d)
26

Description

Describe the bug

Running jfrog audit . in jfrog-cli-full-v2:2.25.3@sha256:57171f5078025f7aa1b652ff8d095abbca8d7bda33a0497ee8b5912b3900c730 on a maven project using java 17 will result in an error Fatal error compiling: error: invalid target release: 17

Current behavior
/usr/local/bin/jfrog audit . --watches java-local,java-remote --fail
09:19:43 [Debug] Usage Report: Sending info...
09:19:43 [Info] Detected: Maven.
09:19:43 [Debug] mvn command goals: [-B compile test-compile]
09:19:43 [Debug] Saving build general details at: /tmp/jfrog/builds/bc7e0860a1f036dc1975cd040e77dca88d53d77e3df58c595eb77ac9513d98c5/partials
09:19:43 [Debug] Searching for Maven home.
09:19:43 [Debug] Maven home location:  /home/frogger/.sdkman/candidates/maven/current
09:19:43 [Debug] Creating temp build file at: /tmp/jfrog/builds/bc7e0860a1f036dc1975cd040e77dca88d53d77e3df58c595eb77ac9513d98c5
09:19:43 [Info] Running Mvn...
09:19:44 [Debug] Sending HTTP GET request to: https://artifactory.example.com/artifactory/api/system/version
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - Scanning for projects...
[main] INFO org.jfrog.build.extractor.maven.BuildInfoRecorder - Initializing Artifactory Build-Info Recording
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - ------------------------------------------------------------------------
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - Reactor Build Order:
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - 
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application                               [pom]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application-rest-api                      [jar]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application-rest-controller               [jar]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application-pnl-backend                   [jar]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application-application                   [jar]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - 
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --< com.example:application >--
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - Building application 0.0.1-SNAPSHOT.1663147009 [1/5]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --------------------------------[ pom ]---------------------------------
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - 
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --< com.example:application-rest-api >--
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - Building application-rest-api 0.0.1-SNAPSHOT.1663147009 [2/5]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --------------------------------[ jar ]---------------------------------
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - 
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --- swagger-codegen-maven-plugin:3.0.34:generate (bundle-schaden-api) @ application-rest-api ---
09:19:48 [Debug] Artifactory response: 200 
09:19:48 [Debug] JFrog Artifactory version is: 7.35.2
09:19:48 [Debug] Sending HTTP POST request to: https://artifactory.example.com/artifactory/api/system/usage
[main] WARNING io.swagger.codegen.v3.DefaultGenerator - can't open handlebars/openapi/README.md for input
[main] INFO io.swagger.codegen.v3.AbstractGenerator - writing file /workspace/source/application-rest-api/target/generated-resources/static/.swagger-codegen/VERSION
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - 
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --- swagger-codegen-maven-plugin:3.0.34:generate (generate-schaden-api) @ application-rest-api ---
[main] INFO io.swagger.codegen.v3.ignore.CodegenIgnoreProcessor - No .swagger-codegen-ignore file found.
[main] INFO io.swagger.codegen.v3.generators.java.AbstractJavaCodegen - Invoker Package Name, originally not set, is now derived from api package name: com.example
09:19:48 [Debug] Usage Report: Artifactory response: 202 
09:19:48 [Debug] Usage Report: Usage info sent successfully.
[main] INFO io.swagger.codegen.v3.AbstractGenerator - writing file /workspace/source/application-rest-api/target/generated-sources/src/main/java/de/provinzial/leistungkomposit/api/model/Schaden.java
[main] INFO io.swagger.codegen.v3.AbstractGenerator - writing file /workspace/source/application-rest-api/target/generated-sources/src/main/java/de/provinzial/leistungkomposit/api/SchadenApi.java
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - 
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --- build-helper-maven-plugin:3.3.0:add-source (default) @ application-rest-api ---
[main] INFO org.codehaus.mojo.buildhelper.AddSourceMojo - Source directory: /workspace/source/application-rest-api/target/generated-sources/src/main/java added.
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - 
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --- maven-resources-plugin:3.2.0:resources (default-resources) @ application-rest-api ---
[main] INFO org.apache.maven.shared.filtering.DefaultMavenResourcesFiltering - Using 'UTF-8' encoding to copy filtered resources.
[main] INFO org.apache.maven.shared.filtering.DefaultMavenResourcesFiltering - Using 'UTF-8' encoding to copy filtered properties files.
[main] INFO org.apache.maven.shared.filtering.DefaultMavenResourcesFiltering - Copying 0 resource
[main] INFO org.apache.maven.shared.filtering.DefaultMavenResourcesFiltering - Copying 2 resources
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - 
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --- maven-compiler-plugin:3.10.1:compile (default-compile) @ application-rest-api ---
[main] INFO org.apache.maven.plugin.compiler.CompilerMojo - Changes detected - recompiling the module!
[main] INFO org.codehaus.plexus.compiler.javac.JavacCompiler - Compiling 2 source files to /workspace/source/application-rest-api/target/classes
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - ------------------------------------------------------------------------
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - Reactor Summary for application 0.0.1-SNAPSHOT.1663147009:
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - 
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application ............... SUCCESS [  0.034 s]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application-rest-api ...... FAILURE [  3.200 s]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application-rest-controller SKIPPED
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application-pnl-backend ... SKIPPED
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application-application ... SKIPPED
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - ------------------------------------------------------------------------
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - BUILD FAILURE
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - ------------------------------------------------------------------------
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - Total time:  3.871 s
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - Finished at: 2022-09-14T09:19:49Z
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - ------------------------------------------------------------------------
[main] ERROR org.apache.maven.cli.MavenCli - Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.10.1:compile (default-compile) on project application-rest-api: Fatal error compiling: error: invalid target release: 17 -> [Help 1]
[main] ERROR org.apache.maven.cli.MavenCli - 
[main] ERROR org.apache.maven.cli.MavenCli - To see the full stack trace of the errors, re-run Maven with the -e switch.
[main] ERROR org.apache.maven.cli.MavenCli - Re-run Maven using the -X switch to enable full debug logging.
[main] ERROR org.apache.maven.cli.MavenCli - 
[main] ERROR org.apache.maven.cli.MavenCli - For more information about the errors and possible solutions, please read the following articles:
[main] ERROR org.apache.maven.cli.MavenCli - [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException
[main] ERROR org.apache.maven.cli.MavenCli - 
[main] ERROR org.apache.maven.cli.MavenCli - After correcting the problems, you can resume the build with the command
[main] ERROR org.apache.maven.cli.MavenCli -   mvn <args> -rf :application-rest-api
09:19:49 [Error] 'Maven' audit command failed: exit status 1
Reproduction steps

No response

Expected behavior

audit with newer java versions should be possible.

JFrog CLI version

2.25.3

Operating system type and version

ubuntu:20.04

JFrog Artifactory version

7.35.2

JFrog Xray version

3.43.1

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing jfrog audit . for a Maven project targeting Java 17 in the jfrog-cli-full-v2:2.25.3 container image on Ubuntu 20.04. Inspect how the audit command locates and invokes Maven and Java, then verify that the audit completes successfully for newer Java versions without the invalid target release error.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, ubuntu
Domain
devops, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.