jfrog / jfrog/jfrog-cli-security
jf audit fails with Gradle and org.gradle.parallel=true
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Describe the bug
When executing the following command: jf audit --gradle --fixable-only --min-severity High, the generateDepTrees Gradle task fails.
Current behavior
Here are the full log:
[INFO] JFrog CLI version: jf version 2.85.0
[INFO] Configuring Gradle properties for JFrog
[INFO] Running JFrog Audit (Fixable only, Min Severity: High)
[INFO] JFrog Audit returned non-zero exit code. Checking for build failures...
14:19:07 [Info] Calculating Gradle dependencies...
14:19:07 [Info] Running gradle deps tree command: ./gradlew clean generateDepTrees -I /tmp/jfrog.cli.temp.-1764944347-3151300615/gradledeptree.init -q -Dorg.gradle.configuration-cache=false -Dcom.jfrog.depsTreeOutputFile=/tmp/jfrog.cli.temp.-1764944347-3151300615/gradledeptree.out -Dcom.jfrog.includeAllBuildFiles=true
14:20:39 [Info] Performing scans on 1 targets:
[
{
"target": "/builds/**********/my-project",
"technology": "gradle"
}
]
14:20:39 [Info] Not entitled for JAS, skipping advance security scans...
14:20:39 [Info] Trace ID for JFrog Platform logs: f324b2c82a420cbe
14:20:39 [Error] target '/builds/**********/my-project [gradle]' errors:
failed to generate SBOM for /builds/**********/my-project: failed to build dependency tree: failed while building 'gradle' dependency tree: error running gradle-dep-tree: exit status 1
Downloading https://services.gradle.org/distributions/gradle-9.1.0-bin.zip
............10%.............20%.............30%.............40%.............50%............60%.............70%.............80%.............90%.............100%
FAILURE: Build failed with an exception.
* What went wrong:
Execution failed for task ':generateDepTrees'.
> Resolution of the configuration ':bdd:compileClasspath' was attempted without an exclusive lock. This is unsafe and not allowed.
* Try:
> For more information, please refer to https://docs.gradle.org/9.1.0/userguide/viewing_debugging_dependencies.html#sub:resolving-unsafe-configuration-resolution-errors in the Gradle documentation.
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Run with --scan to generate a Build Scan (Powered by Develocity).
> Get more help at https://help.gradle.org/.
BUILD FAILED in 1m 31s
Reproduction steps
- Init a gradle project (v9.2.1)
- Install the latest JFrog CLI (v2.85.0)
- In the
gradle.propertiesfile of the Gradle projet, add:
org.gradle.parallel=true
- Run
jf audit --gradle --fixable-only --min-severity High
Current workaround: disable parallel execution for the jf audit using an env var:audit:
export GRADLE_OPTS="-Dorg.gradle.parallel=false"
jf audit --gradle --fixable-only --min-severity High
Expected behavior
No errors when executing the Gradle task :-)
JFrog CLI version
2.85.0
Operating system type and version
eclipse-temurin:25.0.1_8-jdk-alpine Docker image
JFrog Artifactory version
No response
JFrog Xray version
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the jf audit Gradle dependency-tree path and the generateDepTrees task, reproducing the command with org.gradle.parallel=true in gradle.properties. Compare the failing run with the documented GRADLE_OPTS workaround. Done means jf audit completes without the exclusive-lock error while parallel execution remains enabled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- build-system, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100