jfrog / jfrog/jfrog-cli-security
maven audit fails for Java > 11 in Container Image
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Describe the bug
Running jfrog audit . in jfrog-cli-full-v2:2.25.3@sha256:57171f5078025f7aa1b652ff8d095abbca8d7bda33a0497ee8b5912b3900c730 on a maven project using java 17 will result in an error Fatal error compiling: error: invalid target release: 17
Current behavior
/usr/local/bin/jfrog audit . --watches java-local,java-remote --fail
09:19:43 [Debug] Usage Report: Sending info...
09:19:43 [Info] Detected: Maven.
09:19:43 [Debug] mvn command goals: [-B compile test-compile]
09:19:43 [Debug] Saving build general details at: /tmp/jfrog/builds/bc7e0860a1f036dc1975cd040e77dca88d53d77e3df58c595eb77ac9513d98c5/partials
09:19:43 [Debug] Searching for Maven home.
09:19:43 [Debug] Maven home location: /home/frogger/.sdkman/candidates/maven/current
09:19:43 [Debug] Creating temp build file at: /tmp/jfrog/builds/bc7e0860a1f036dc1975cd040e77dca88d53d77e3df58c595eb77ac9513d98c5
09:19:43 [Info] Running Mvn...
09:19:44 [Debug] Sending HTTP GET request to: https://artifactory.example.com/artifactory/api/system/version
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - Scanning for projects...
[main] INFO org.jfrog.build.extractor.maven.BuildInfoRecorder - Initializing Artifactory Build-Info Recording
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - ------------------------------------------------------------------------
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - Reactor Build Order:
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger -
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application [pom]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application-rest-api [jar]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application-rest-controller [jar]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application-pnl-backend [jar]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application-application [jar]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger -
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --< com.example:application >--
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - Building application 0.0.1-SNAPSHOT.1663147009 [1/5]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --------------------------------[ pom ]---------------------------------
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger -
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --< com.example:application-rest-api >--
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - Building application-rest-api 0.0.1-SNAPSHOT.1663147009 [2/5]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --------------------------------[ jar ]---------------------------------
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger -
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --- swagger-codegen-maven-plugin:3.0.34:generate (bundle-schaden-api) @ application-rest-api ---
09:19:48 [Debug] Artifactory response: 200
09:19:48 [Debug] JFrog Artifactory version is: 7.35.2
09:19:48 [Debug] Sending HTTP POST request to: https://artifactory.example.com/artifactory/api/system/usage
[main] WARNING io.swagger.codegen.v3.DefaultGenerator - can't open handlebars/openapi/README.md for input
[main] INFO io.swagger.codegen.v3.AbstractGenerator - writing file /workspace/source/application-rest-api/target/generated-resources/static/.swagger-codegen/VERSION
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger -
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --- swagger-codegen-maven-plugin:3.0.34:generate (generate-schaden-api) @ application-rest-api ---
[main] INFO io.swagger.codegen.v3.ignore.CodegenIgnoreProcessor - No .swagger-codegen-ignore file found.
[main] INFO io.swagger.codegen.v3.generators.java.AbstractJavaCodegen - Invoker Package Name, originally not set, is now derived from api package name: com.example
09:19:48 [Debug] Usage Report: Artifactory response: 202
09:19:48 [Debug] Usage Report: Usage info sent successfully.
[main] INFO io.swagger.codegen.v3.AbstractGenerator - writing file /workspace/source/application-rest-api/target/generated-sources/src/main/java/de/provinzial/leistungkomposit/api/model/Schaden.java
[main] INFO io.swagger.codegen.v3.AbstractGenerator - writing file /workspace/source/application-rest-api/target/generated-sources/src/main/java/de/provinzial/leistungkomposit/api/SchadenApi.java
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger -
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --- build-helper-maven-plugin:3.3.0:add-source (default) @ application-rest-api ---
[main] INFO org.codehaus.mojo.buildhelper.AddSourceMojo - Source directory: /workspace/source/application-rest-api/target/generated-sources/src/main/java added.
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger -
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --- maven-resources-plugin:3.2.0:resources (default-resources) @ application-rest-api ---
[main] INFO org.apache.maven.shared.filtering.DefaultMavenResourcesFiltering - Using 'UTF-8' encoding to copy filtered resources.
[main] INFO org.apache.maven.shared.filtering.DefaultMavenResourcesFiltering - Using 'UTF-8' encoding to copy filtered properties files.
[main] INFO org.apache.maven.shared.filtering.DefaultMavenResourcesFiltering - Copying 0 resource
[main] INFO org.apache.maven.shared.filtering.DefaultMavenResourcesFiltering - Copying 2 resources
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger -
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --- maven-compiler-plugin:3.10.1:compile (default-compile) @ application-rest-api ---
[main] INFO org.apache.maven.plugin.compiler.CompilerMojo - Changes detected - recompiling the module!
[main] INFO org.codehaus.plexus.compiler.javac.JavacCompiler - Compiling 2 source files to /workspace/source/application-rest-api/target/classes
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - ------------------------------------------------------------------------
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - Reactor Summary for application 0.0.1-SNAPSHOT.1663147009:
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger -
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application ............... SUCCESS [ 0.034 s]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application-rest-api ...... FAILURE [ 3.200 s]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application-rest-controller SKIPPED
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application-pnl-backend ... SKIPPED
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application-application ... SKIPPED
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - ------------------------------------------------------------------------
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - BUILD FAILURE
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - ------------------------------------------------------------------------
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - Total time: 3.871 s
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - Finished at: 2022-09-14T09:19:49Z
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - ------------------------------------------------------------------------
[main] ERROR org.apache.maven.cli.MavenCli - Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.10.1:compile (default-compile) on project application-rest-api: Fatal error compiling: error: invalid target release: 17 -> [Help 1]
[main] ERROR org.apache.maven.cli.MavenCli -
[main] ERROR org.apache.maven.cli.MavenCli - To see the full stack trace of the errors, re-run Maven with the -e switch.
[main] ERROR org.apache.maven.cli.MavenCli - Re-run Maven using the -X switch to enable full debug logging.
[main] ERROR org.apache.maven.cli.MavenCli -
[main] ERROR org.apache.maven.cli.MavenCli - For more information about the errors and possible solutions, please read the following articles:
[main] ERROR org.apache.maven.cli.MavenCli - [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException
[main] ERROR org.apache.maven.cli.MavenCli -
[main] ERROR org.apache.maven.cli.MavenCli - After correcting the problems, you can resume the build with the command
[main] ERROR org.apache.maven.cli.MavenCli - mvn <args> -rf :application-rest-api
09:19:49 [Error] 'Maven' audit command failed: exit status 1
Reproduction steps
No response
Expected behavior
audit with newer java versions should be possible.
JFrog CLI version
2.25.3
Operating system type and version
ubuntu:20.04
JFrog Artifactory version
7.35.2
JFrog Xray version
3.43.1
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing jfrog audit . for a Maven project targeting Java 17 in the jfrog-cli-full-v2:2.25.3 container image on Ubuntu 20.04. Inspect how the audit command locates and invokes Maven and Java, then verify that the audit completes successfully for newer Java versions without the invalid target release error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, ubuntu
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 28/100