jfrog / jfrog/jfrog-cli-security

jf audit fails with Gradle and org.gradle.parallel=true

Open
#727 1 comment 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
13
Forks
50
Avg merge
3d 48m
Merged PRs (30d)
26

Description

Describe the bug

When executing the following command: jf audit --gradle --fixable-only --min-severity High, the generateDepTrees Gradle task fails.

Current behavior

Here are the full log:

[INFO] JFrog CLI version: jf version 2.85.0
[INFO] Configuring Gradle properties for JFrog
[INFO] Running JFrog Audit (Fixable only, Min Severity: High)
[INFO] JFrog Audit returned non-zero exit code. Checking for build failures...
14:19:07 [Info] Calculating Gradle dependencies...
14:19:07 [Info] Running gradle deps tree command: ./gradlew clean generateDepTrees -I /tmp/jfrog.cli.temp.-1764944347-3151300615/gradledeptree.init -q -Dorg.gradle.configuration-cache=false -Dcom.jfrog.depsTreeOutputFile=/tmp/jfrog.cli.temp.-1764944347-3151300615/gradledeptree.out -Dcom.jfrog.includeAllBuildFiles=true
14:20:39 [Info] Performing scans on 1 targets:
[
  {
    "target": "/builds/**********/my-project",
    "technology": "gradle"
  }
]
14:20:39 [Info] Not entitled for JAS, skipping advance security scans...
14:20:39 [Info] Trace ID for JFrog Platform logs: f324b2c82a420cbe
14:20:39 [Error] target '/builds/**********/my-project [gradle]' errors:
failed to generate SBOM for /builds/**********/my-project: failed to build dependency tree: failed while building 'gradle' dependency tree: error running gradle-dep-tree: exit status 1
Downloading https://services.gradle.org/distributions/gradle-9.1.0-bin.zip
............10%.............20%.............30%.............40%.............50%............60%.............70%.............80%.............90%.............100%
FAILURE: Build failed with an exception.
* What went wrong:
Execution failed for task ':generateDepTrees'.
> Resolution of the configuration ':bdd:compileClasspath' was attempted without an exclusive lock. This is unsafe and not allowed.
* Try:
> For more information, please refer to https://docs.gradle.org/9.1.0/userguide/viewing_debugging_dependencies.html#sub:resolving-unsafe-configuration-resolution-errors in the Gradle documentation.
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Run with --scan to generate a Build Scan (Powered by Develocity).
> Get more help at https://help.gradle.org/.
BUILD FAILED in 1m 31s
Reproduction steps
  1. Init a gradle project (v9.2.1)
  2. Install the latest JFrog CLI (v2.85.0)
  3. In the gradle.properties file of the Gradle projet, add:
org.gradle.parallel=true
  1. Run jf audit --gradle --fixable-only --min-severity High

Current workaround: disable parallel execution for the jf audit using an env var:audit:

export GRADLE_OPTS="-Dorg.gradle.parallel=false"
jf audit --gradle --fixable-only --min-severity High
Expected behavior

No errors when executing the Gradle task :-)

JFrog CLI version

2.85.0

Operating system type and version

eclipse-temurin:25.0.1_8-jdk-alpine Docker image

JFrog Artifactory version

No response

JFrog Xray version

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the jf audit Gradle dependency-tree path and the generateDepTrees task, reproducing the command with org.gradle.parallel=true in gradle.properties. Compare the failing run with the documented GRADLE_OPTS workaround. Done means jf audit completes without the exclusive-lock error while parallel execution remains enabled.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
build-system, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.