maven audit fails for Java > 11 in Container Image

[nekator]

Describe the bug

Running jfrog audit . in jfrog-cli-full-v2:2.25.3@sha256:57171f5078025f7aa1b652ff8d095abbca8d7bda33a0497ee8b5912b3900c730 on a maven project using java 17 will result in an error Fatal error compiling: error: invalid target release: 17

Current behavior

/usr/local/bin/jfrog audit . --watches java-local,java-remote --fail
09:19:43 [Debug] Usage Report: Sending info...
09:19:43 [Info] Detected: Maven.
09:19:43 [Debug] mvn command goals: [-B compile test-compile]
09:19:43 [Debug] Saving build general details at: /tmp/jfrog/builds/bc7e0860a1f036dc1975cd040e77dca88d53d77e3df58c595eb77ac9513d98c5/partials
09:19:43 [Debug] Searching for Maven home.
09:19:43 [Debug] Maven home location:  /home/frogger/.sdkman/candidates/maven/current
09:19:43 [Debug] Creating temp build file at: /tmp/jfrog/builds/bc7e0860a1f036dc1975cd040e77dca88d53d77e3df58c595eb77ac9513d98c5
09:19:43 [Info] Running Mvn...
09:19:44 [Debug] Sending HTTP GET request to: https://artifactory.example.com/artifactory/api/system/version
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - Scanning for projects...
[main] INFO org.jfrog.build.extractor.maven.BuildInfoRecorder - Initializing Artifactory Build-Info Recording
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - ------------------------------------------------------------------------
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - Reactor Build Order:
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - 
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application                               [pom]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application-rest-api                      [jar]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application-rest-controller               [jar]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application-pnl-backend                   [jar]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application-application                   [jar]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - 
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --< com.example:application >--
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - Building application 0.0.1-SNAPSHOT.1663147009 [1/5]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --------------------------------[ pom ]---------------------------------
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - 
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --< com.example:application-rest-api >--
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - Building application-rest-api 0.0.1-SNAPSHOT.1663147009 [2/5]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --------------------------------[ jar ]---------------------------------
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - 
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --- swagger-codegen-maven-plugin:3.0.34:generate (bundle-schaden-api) @ application-rest-api ---
09:19:48 [Debug] Artifactory response: 200 
09:19:48 [Debug] JFrog Artifactory version is: 7.35.2
09:19:48 [Debug] Sending HTTP POST request to: https://artifactory.example.com/artifactory/api/system/usage
[main] WARNING io.swagger.codegen.v3.DefaultGenerator - can't open handlebars/openapi/README.md for input
[main] INFO io.swagger.codegen.v3.AbstractGenerator - writing file /workspace/source/application-rest-api/target/generated-resources/static/.swagger-codegen/VERSION
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - 
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --- swagger-codegen-maven-plugin:3.0.34:generate (generate-schaden-api) @ application-rest-api ---
[main] INFO io.swagger.codegen.v3.ignore.CodegenIgnoreProcessor - No .swagger-codegen-ignore file found.
[main] INFO io.swagger.codegen.v3.generators.java.AbstractJavaCodegen - Invoker Package Name, originally not set, is now derived from api package name: com.example
09:19:48 [Debug] Usage Report: Artifactory response: 202 
09:19:48 [Debug] Usage Report: Usage info sent successfully.
[main] INFO io.swagger.codegen.v3.AbstractGenerator - writing file /workspace/source/application-rest-api/target/generated-sources/src/main/java/de/provinzial/leistungkomposit/api/model/Schaden.java
[main] INFO io.swagger.codegen.v3.AbstractGenerator - writing file /workspace/source/application-rest-api/target/generated-sources/src/main/java/de/provinzial/leistungkomposit/api/SchadenApi.java
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - 
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --- build-helper-maven-plugin:3.3.0:add-source (default) @ application-rest-api ---
[main] INFO org.codehaus.mojo.buildhelper.AddSourceMojo - Source directory: /workspace/source/application-rest-api/target/generated-sources/src/main/java added.
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - 
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --- maven-resources-plugin:3.2.0:resources (default-resources) @ application-rest-api ---
[main] INFO org.apache.maven.shared.filtering.DefaultMavenResourcesFiltering - Using 'UTF-8' encoding to copy filtered resources.
[main] INFO org.apache.maven.shared.filtering.DefaultMavenResourcesFiltering - Using 'UTF-8' encoding to copy filtered properties files.
[main] INFO org.apache.maven.shared.filtering.DefaultMavenResourcesFiltering - Copying 0 resource
[main] INFO org.apache.maven.shared.filtering.DefaultMavenResourcesFiltering - Copying 2 resources
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - 
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - --- maven-compiler-plugin:3.10.1:compile (default-compile) @ application-rest-api ---
[main] INFO org.apache.maven.plugin.compiler.CompilerMojo - Changes detected - recompiling the module!
[main] INFO org.codehaus.plexus.compiler.javac.JavacCompiler - Compiling 2 source files to /workspace/source/application-rest-api/target/classes
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - ------------------------------------------------------------------------
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - Reactor Summary for application 0.0.1-SNAPSHOT.1663147009:
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - 
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application ............... SUCCESS [  0.034 s]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application-rest-api ...... FAILURE [  3.200 s]
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application-rest-controller SKIPPED
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application-pnl-backend ... SKIPPED
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - application-application ... SKIPPED
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - ------------------------------------------------------------------------
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - BUILD FAILURE
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - ------------------------------------------------------------------------
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - Total time:  3.871 s
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - Finished at: 2022-09-14T09:19:49Z
[main] INFO org.apache.maven.cli.event.ExecutionEventLogger - ------------------------------------------------------------------------
[main] ERROR org.apache.maven.cli.MavenCli - Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.10.1:compile (default-compile) on project application-rest-api: Fatal error compiling: error: invalid target release: 17 -> [Help 1]
[main] ERROR org.apache.maven.cli.MavenCli - 
[main] ERROR org.apache.maven.cli.MavenCli - To see the full stack trace of the errors, re-run Maven with the -e switch.
[main] ERROR org.apache.maven.cli.MavenCli - Re-run Maven using the -X switch to enable full debug logging.
[main] ERROR org.apache.maven.cli.MavenCli - 
[main] ERROR org.apache.maven.cli.MavenCli - For more information about the errors and possible solutions, please read the following articles:
[main] ERROR org.apache.maven.cli.MavenCli - [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException
[main] ERROR org.apache.maven.cli.MavenCli - 
[main] ERROR org.apache.maven.cli.MavenCli - After correcting the problems, you can resume the build with the command
[main] ERROR org.apache.maven.cli.MavenCli -   mvn <args> -rf :application-rest-api
09:19:49 [Error] 'Maven' audit command failed: exit status 1

Reproduction steps

No response

Expected behavior

audit with newer java versions should be possible.

JFrog CLI version

2.25.3

Operating system type and version

ubuntu:20.04

JFrog Artifactory version

7.35.2

JFrog Xray version

3.43.1

[sverdlov93]

Hi @nekator,
The audit command's syntax is 'jf audit' without the dot.
Also, it looks like it fails when trying to compile the project. Can you try compiling it and see if it works?

[nekator]

Hi @sverdlov93,
i ran the jf audit after the project was build from another container.

Running without . produces the same result.

the maven audit will always invoke compile and test-compile https://github.com/jfrog/jfrog-cli-core/blob/master/xray/audit/java/mvn.go#L40 which will fail inside the container when targeting java > 11

[nekator]

Is a compile and test-compile necessary to analyse the dependencies would org.apache.maven.plugins:maven-dependency-plugin:3.3.0:collect be enough?

[sverdlov93]

Can you try setting your JAVA_HOME to java 17 path?
Something like this - JAVA_HOME=$(/usr/libexec/java_home -v 17)

[nekator]

This image releases-docker.jfrog.io/jfrog/jfrog-cli-full-v2-jf does not contain Java 17. It only has java 11. That is the root cause of the problem.

[yahavi]

@nekator,
Thanks for reporting this issue.
Currently, the Java version installed in the jfrog-cli-full-v2-jf is 11.
You don't have to use the jfrog-cli-full-v2-jf image for the audit command. Instead, you can use a Docker image with JDK 17 and install the JFrog CLI with one command. For example, you can use the openjdk:17 image.
Install the JFrog CLI in the image using the following command:

curl -fL https://install-cli.jfrog.io | sh

Please let us know if that helped.

[nekator]

@yahavi sorry for the late response. I know that this will fix my issue but i use the image in an air-gapped environment and i´m forced to use vendor provided images.

So providing the CLI Image with a newer (LTS) Java version would solve my issue. Or even better don´t let the maven audit compile and test-compile the project.

I don´t know if it is possible to audit without compile and test-compile but in my understanding the audit command hooks into the maven proccess and spys the depencendy resolution process to collect all used dependencies. So using the dependency plugin should lead to the same result. (collet or resolve goal)

[sdibernardo]

I'm bumping the issue, due to inactivity.
Has there been any progress on the issue?

Could you provide an image for the CLI with Java 17, similar to the existing image with Java 11?

[mohrm]

@yahavi @sverdlov93 Is there anything that can be done to mitigate this problem within the constraints described here?
I made a proposal in jfrog/jrog-ecosystem-integration-env#40, maybe this could be a solution?