The ancient org.apache.commons.beanutils 1.8.0.v201205091237 bundles are seen as unsigned #870

merks · 2023-02-16T09:31:12Z

This test shows the failures:

https://ci.eclipse.org/oomph/job/repository-analyzer/lastCompletedBuild/testReport/

It's reported here:

https://download.eclipse.org/oomph/archive/reports/download.eclipse.org/eclipse/updates/4.27-I-builds/index.html

Specifically this:

This is a regression caused by this change:

#773

I'm not sure how removing one Orbit dependency but adding two other Orbit dependencies was an improvement.

@akurtakov

We should either revert that, force PGP sign these things here:

eclipse.platform.releng.aggregator/eclipse.platform.releng.tychoeclipsebuilder/pom.xml

Lines 45 to 66 in 7538dfb

    
           <configuration> 
        
           	<keyname>b6d3ab9bcc641282</keyname> 
        
           	<skipIfJarsigned>true</skipIfJarsigned> 
        
           	<forceSignature> 
        
           		<bundle>bcpg</bundle> 
        
           		<bundle>bcprov</bundle> 
        
           		<bundle>com.sun.el.javax.el.source</bundle> 
        
           		<bundle>com.sun.el.javax.el</bundle> 
        
           		<bundle>javax.el-api.source</bundle> 
        
           		<bundle>javax.el-api</bundle> 
        
           		<bundle>org.apache.commons.codec.source</bundle> 
        
           		<bundle>org.apache.commons.codec</bundle> 
        
           		<bundle>org.apache.commons.jxpath.source</bundle> 
        
           		<bundle>org.apache.commons.jxpath</bundle> 
        
           		<bundle>org.apache.jasper.glassfish.source</bundle> 
        
           		<bundle>org.apache.jasper.glassfish</bundle> 
        
           		<bundle>org.glassfish.web.javax.servlet.jsp.source</bundle> 
        
           		<bundle>org.glassfish.web.javax.servlet.jsp</bundle> 
        
           		<bundle>org.w3c.dom.smil.source</bundle> 
        
           		<bundle>org.w3c.dom.smil</bundle> 
        
           	</forceSignature> 
        
           </configuration>

Or use this newer version if possible:

https://download.eclipse.org/staging/2023-03/buildInfo/archive/download.eclipse.org/staging/2023-03/index/org.apache.commons.commons-beanutils_1.9.4.html

I'm mostly unavailable today and tomorrow...

akurtakov · 2023-02-16T11:54:52Z

I just see this one but can't find beanutils 1.9.4 in latest Orbit https://download.eclipse.org/tools/orbit/downloads/drops/S20230214193619/repository/plugins/ . I think we should go for 1.9.4 from Maven central as 1.8.0 has https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10086 and https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0114 . The choice between Orbit and Maven Central looks easy if beanutils 1.9.4 is not in Orbit.

Multiple CVEs are fixed compared to 1.8.0 used and it removes one more dependency from ancient Orbit that had to special treated to get signed. Tracked in eclipse-platform#870

akurtakov · 2023-02-16T12:28:24Z

@merks Now I'm really puzzled. Open https://download.eclipse.org/eclipse/downloads/drops4/I20230215-1800/buildlogs/reporeports/reports/verified8.txt look for beanutils and see:

org.apache.commons.beanutils.source_1.8.0.v201205091237.jar                                  plugin       jar verified (jarsigner)
org.apache.commons.beanutils_1.8.0.v201205091237.jar                                         plugin       jar verified (jarsigner)

I try to keep an eye on these reports from time to time and it seems fine. Is the oomph or the p2repo-analyzers broken? If it's the p2repo-analyzers I would rather remove it directly as its implementation just doesn't create files in some cases which makes looking at results quite awkward.

akurtakov · 2023-02-16T12:34:41Z

On my machine:

/usr/lib/jvm/java-17/bin/jarsigner -verify org.apache.commons.beanutils_1.8.0.v201205091237.jar 

jar verified.

Warning: 
This jar contains entries whose TSA certificate chain is invalid. Reason: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
The SHA-1 timestamp digest algorithm is considered a security risk. This algorithm will be disabled in a future update.

Re-run with the -verbose and -certs options for more details.

But it still says "jar verified".

merks · 2023-02-16T16:00:41Z

Unfortunately the results often depend on exactly which version of Java 17 (or 11) is being used. The cacerts are different in latest (very recent) LTS versions and even the algorithms and date ranges that the algorithm is "valid" varies. 😢

Multiple CVEs are fixed compared to 1.8.0 used and it removes one more dependency from ancient Orbit that had to special treated to get signed. Tracked in #870

akurtakov · 2023-02-18T13:29:39Z

@merks So what about p2repo-analyzer signing checks? Should they be kept?

merks · 2023-02-18T13:53:09Z

I did add support that it uses Equinox's SignedContentFactory so I think the test is the same being used in the report generator, but one difference here is that the report generator uses the installer which bundles the latest Termurin version and hence the test for sure uses the JRE that will be used in SimRel. I don't know exactly which version is being used by the I-Build...

Perhaps it would be better if the p2repo-analyzer built a product that include a JustJ JRE to ensure that the test runs with the same JRE that's used by SimRel? Where exactly does this test get invoked by the build?

akurtakov · 2023-02-18T13:58:41Z

It's https://github.com/eclipse-platform/eclipse.platform.releng/blob/master/bundles/org.eclipse.releng.tests/src/org/eclipse/releng/tests/BuildTests.java#L330 which simply inspects the content of the reports generated by p2repo-analyzers.

merks · 2023-02-18T14:31:46Z

Here's where it's generated and it uses some VM explicitly:

eclipse.platform.releng.aggregator/cje-production/mbscripts/mb500_createRepoReports.sh

Line 38 in 4625620

    
           $report_app_dir/p2analyze/p2analyze -data $CJE_ROOT/$TMP_DIR/workspace-report -vm $JAVA_HOME/bin -vmargs -Xmx1g \

merks · 2023-02-18T15:10:48Z

@akurtakov

Shall I include JustJ 17 latest in org.eclipse.cbi.p2repo.analyzers.product and then remove the -vm argument from this script? I'll have to remember to rebuilt it when a new Java 17 comes out to keep it up-to-date... The JVM installed on the machines often lags quite a bit...

akurtakov · 2023-02-18T15:30:10Z

I leave this to you about how to improve the situation.

This is a Temurin-derived JRE and is same JRE that is used with all the SimRel products. Using this URL avoids rate limits that often affect direct Temurin JREs. eclipse-platform#870

This is a Temurin-derived JRE and is same JRE that is used with all the SimRel products. Using this URL avoids rate limits that often affect direct Temurin JREs. #870

akurtakov · 2023-02-20T07:38:27Z

So now jdom is claimed to be unsigned https://download.eclipse.org/eclipse/downloads/drops4/I20230219-0600/buildlogs/reporeports/reports/unsigned8.txt . Is your tool reporting it too?
The releng test complains too https://download.eclipse.org/eclipse/downloads/drops4/I20230219-1800/testresults/html/org.eclipse.releng.tests_ep427I-unit-cen64-gtk3-java17_linux.gtk.x86_64_17.html

merks · 2023-02-20T08:15:35Z

No. This issue was masked by the fact that the staging repository is loaded loaded first by my testing and it PGP signs this artifact:

Since staging has it's own report generated

https://download.eclipse.org/staging/2023-03/buildInfo/archive/download.eclipse.org/staging/2023-03/

I've reduce the other job to test just the platform's I-Build which produces this same problem report now:

https://download.eclipse.org/oomph/archive/reports/download.eclipse.org/eclipse/updates/4.27-I-builds/index.html

I'll spend a few minutes to see if there is a newer jdom, but I don't think so. Otherwise I'll add these to the force PGP signing list....

akurtakov · 2023-02-20T08:23:55Z

Thanks!

merks · 2023-02-20T08:42:10Z

There is this version, also quite ancient, but it has no OSGi metadata:

https://repo1.maven.org/maven2/org/jdom/jdom/1.1.3/

eclipse-platform#870

#870

merks · 2023-02-20T09:22:10Z

We'll have to wait for the next I-Build to see that I've corrected the problem. On the plus side, it's very nice to see that the changes I made to test using the latest Temurin Java 17 helped to uncover this problem which otherwise would very likely have gone unnoticed.

eclipse-platform#870

akurtakov · 2023-02-20T12:12:29Z

@merks Latest failure https://ci.eclipse.org/releng/job/Builds/job/I-build-4.27/139/console makes me think about this one as it fails specifically about xpath which is how jdom comes into play.
@laeubi maybe you can help here too so we can get a build out faster?

merks · 2023-02-20T12:22:20Z

That seems to be the topic of this issue:

eclipse-platform/eclipse.platform.ui.tools#31

We have not changed the jdom dependency (version) at all so it can't be related to that...

laeubi · 2023-02-20T12:54:32Z

Currently the aggregator build suffers from the fact that it can't run parallel (last time i tried there where some failures in tests ant scripts), the other one is API tool checks (that's worked on at eclipse-tycho/tycho#1328) that are currently slow down a lot of things.

So if we can get the build running with -T1C this should already reduce the time a lot, the API tools mojo will hopefully improve the whole things even more. Then with enabling the smartbuilder build can also improve the build times.

akurtakov · 2023-02-20T12:56:05Z

@laeubi what about the actual build failure in https://ci.eclipse.org/releng/job/Builds/job/I-build-4.27/139/console ?

merks · 2023-02-20T13:44:23Z

Note that the actual build problem is that the missing bundle was accidentally deleted!

eclipse-platform/eclipse.platform.ui.tools#31 (comment)

merks · 2023-02-21T07:47:47Z

The latest I-build shows org.jdom is PGP signed.

https://download.eclipse.org/oomph/archive/reports-extra/4.27-I0230220-1800/download.eclipse.org/eclipse/updates/4.27-I-builds/I20230220-1800/index/org.jdom_1.1.1.v201101151400.html

akurtakov mentioned this issue Feb 16, 2023

Declare 4.27 M3 #867

Closed

13 tasks

akurtakov mentioned this issue Feb 16, 2023

Update beanutils to 1.9.4 #871

Merged

akurtakov added a commit that referenced this issue Feb 18, 2023

Update beanutils to 1.9.4

7a0061f

Multiple CVEs are fixed compared to 1.8.0 used and it removes one more dependency from ancient Orbit that had to special treated to get signed. Tracked in #870

merks mentioned this issue Feb 19, 2023

Run the p2analyze report using the latest JustJ Java 17 JRE #873

Merged

merks added a commit to merks/eclipse.platform.releng.aggregator that referenced this issue Feb 20, 2023

Force PGP sign org.jdom and org.jdom.source.

8bf0501

eclipse-platform#870

merks mentioned this issue Feb 20, 2023

Force PGP sign org.jdom and org.jdom.source. #878

Merged

merks added a commit that referenced this issue Feb 20, 2023

Force PGP sign org.jdom and org.jdom.source. (#878)

6c1ae52

#870

akurtakov pushed a commit to akurtakov/eclipse.platform.releng.aggregator that referenced this issue Feb 20, 2023

Force PGP sign org.jdom and org.jdom.source. (eclipse-platform#878)

91e4630

eclipse-platform#870

merks closed this as completed Feb 21, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

The ancient org.apache.commons.beanutils 1.8.0.v201205091237 bundles are seen as unsigned #870

The ancient org.apache.commons.beanutils 1.8.0.v201205091237 bundles are seen as unsigned #870

merks commented Feb 16, 2023

akurtakov commented Feb 16, 2023

akurtakov commented Feb 16, 2023

akurtakov commented Feb 16, 2023 •

edited

Loading

merks commented Feb 16, 2023

akurtakov commented Feb 18, 2023

merks commented Feb 18, 2023

akurtakov commented Feb 18, 2023

merks commented Feb 18, 2023

merks commented Feb 18, 2023

akurtakov commented Feb 18, 2023

akurtakov commented Feb 20, 2023

merks commented Feb 20, 2023

akurtakov commented Feb 20, 2023

merks commented Feb 20, 2023

merks commented Feb 20, 2023

akurtakov commented Feb 20, 2023

merks commented Feb 20, 2023

laeubi commented Feb 20, 2023

akurtakov commented Feb 20, 2023

merks commented Feb 20, 2023

merks commented Feb 21, 2023

The ancient org.apache.commons.beanutils 1.8.0.v201205091237 bundles are seen as unsigned #870

The ancient org.apache.commons.beanutils 1.8.0.v201205091237 bundles are seen as unsigned #870

Comments

merks commented Feb 16, 2023

akurtakov commented Feb 16, 2023

akurtakov commented Feb 16, 2023

akurtakov commented Feb 16, 2023 • edited Loading

merks commented Feb 16, 2023

akurtakov commented Feb 18, 2023

merks commented Feb 18, 2023

akurtakov commented Feb 18, 2023

merks commented Feb 18, 2023

merks commented Feb 18, 2023

akurtakov commented Feb 18, 2023

akurtakov commented Feb 20, 2023

merks commented Feb 20, 2023

akurtakov commented Feb 20, 2023

merks commented Feb 20, 2023

merks commented Feb 20, 2023

akurtakov commented Feb 20, 2023

merks commented Feb 20, 2023

laeubi commented Feb 20, 2023

akurtakov commented Feb 20, 2023

merks commented Feb 20, 2023

merks commented Feb 21, 2023

akurtakov commented Feb 16, 2023 •

edited

Loading