Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ To learn how to compute dynamic feature calls in code, see [Reachability Metadat
* [Tracing Agent](#tracing-agent)
* [Conditional Metadata Collection](#conditional-metadata-collection)
* [Agent Advanced Usage](#agent-advanced-usage)
* [Native Image Configure Tool](#native-image-configure-tool)
* [Native Image Utils Tool](#native-image-utils-tool)

## Tracing Agent

Expand Down Expand Up @@ -160,10 +160,10 @@ However, for a better understanding of the execution, the agent can also write a
$JAVA_HOME/bin/java -agentlib:native-image-agent=trace-output=/path/to/trace-file.json ...
```

The `native-image-configure` tool can transform trace files to configuration files.
The `native-image-utils` tool can transform trace files to configuration files.
The following command reads and processes `trace-file.json` and generates a set of configuration files in the directory `/path/to/config-dir/`:
```shell
native-image-configure generate --trace-input=/path/to/trace-file.json --output-dir=/path/to/config-dir/
native-image-utils generate --trace-input=/path/to/trace-file.json --output-dir=/path/to/config-dir/
```

### Interoperability
Expand All @@ -179,16 +179,16 @@ In this case, it is necessary to provide the absolute path of the agent:
The agent has options which are currently experimental and might be enabled in future releases, but can also be changed or removed entirely.
See the [ExperimentalAgentOptions.md](ExperimentalAgentOptions.md) guide.

## Native Image Configure Tool
## Native Image Utils Tool

When using the agent in multiple processes at the same time as described in the previous section, `config-output-dir` is a safe option, but it results in multiple sets of configuration files.
The `native-image-configure` tool can be used to merge these configuration files:
The `native-image-utils` tool can be used to merge these configuration files:
```shell
native-image-configure generate --input-dir=/path/to/config-dir-0/ --input-dir=/path/to/config-dir-1/ --output-dir=/path/to/merged-config-dir/
native-image-utils generate --input-dir=/path/to/config-dir-0/ --input-dir=/path/to/config-dir-1/ --output-dir=/path/to/merged-config-dir/
```

This command reads one set of configuration files from `/path/to/config-dir-0/` and another from `/path/to/config-dir-1/` and then writes a set of configuration files that contains both of their information to `/path/to/merged-config-dir/`.
An arbitrary number of `--input-dir` arguments with sets of configuration files can be specified. See `native-image-configure help` for all options.
An arbitrary number of `--input-dir` arguments with sets of configuration files can be specified. See `native-image-utils help` for all options.

### Further Reading

Expand Down
2 changes: 1 addition & 1 deletion docs/reference-manual/native-image/BuildOutput.md
Original file line number Diff line number Diff line change
Expand Up @@ -343,7 +343,7 @@ Advanced obfuscation is applied to your application code and third-party depende
* Names of annotations, lambdas, and proxies

To export a mapping from original to obfuscated names, use `-H:AdvancedObfuscation=export-mapping`.
Use the mapping file and the `native-image-configure deobfuscate` command to deobfuscate stack traces.
Use the mapping file and the `native-image-utils deobfuscate` command to deobfuscate stack traces.
See the [build report](BuildReport.md) for summary statistics, such as the percentage of class and method names that were obfuscated.

For more information, see [Advanced Obfuscation in Native Image](../../security/Obfuscation.md).
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -63,11 +63,10 @@ To further filter the generated configuration, you can use `conditional-config-c
### Generating Conditional Configuration From Multiple Agent Runs

Conditional configuration can be generated from multiple agent runs that reach different code paths in the application.
Each agent run produces configuration with metadata. `native-image-configure` is then used to merge the collected data and produce a conditional configuration.
To run the agent in this mode, add `experimental-conditional-config-part` to the agent's command line.
Once all the agent runs have finished, you can generate a conditional configuration by invoking:
Each agent run produces configuration with metadata. After all agent runs have finished, you can use `native-image-utils` is then used to merge the collected data and produce a conditional configuration.
To generate a conditional configuration, invoke:
```shell
native-image-configure generate-conditional --user-code-filter=<path-to-filter-file> --class-name-filter=<path-to-filter-file> --input-dir=<path-to-agent-run-output-1> --input-dir=<path-to-agent-run-ouput-2> ... --output-dir=<path-to-resulting-conditional-config>
native-image-utils generate-conditional --user-code-filter=<path-to-filter-file> --class-name-filter=<path-to-filter-file> --input-dir=<path-to-agent-run-output-1> --input-dir=<path-to-agent-run-output-2> ... --output-dir=<path-to-resulting-conditional-config>
```
where:
- `--user-code-filter=<path-to-filter-file>`: path to an agent filter file that specifies user classes
Expand Down
2 changes: 1 addition & 1 deletion docs/reference-manual/native-image/InspectTool.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ redirect_from: /reference-manual/native-image/inspect/

> **The Native Image Inspect Tool is deprecated and will be removed in a future release**. To extract embedded SBOMs, use:
> ```bash
> $JAVA_HOME/bin/native-image-configure extract-sbom --image-path=<path_to_binary>
> $JAVA_HOME/bin/native-image-utils extract-sbom --image-path=<path_to_binary>
> ```

The Native Image Inspect Tool extracts embedded Software Bill of Materials (SBOM) from native executables. The functionality for extracting class-level metadata is no longer supported.
Expand Down
8 changes: 4 additions & 4 deletions docs/reference-manual/native-image/PGO-Merging-Profiles.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,23 +7,23 @@ permalink: /reference-manual/native-image/optimizations-and-performance/PGO/merg

# Merging Profiles from Multiple Sources

The PGO infrastructure enables you to combine multiple profiles into a single one using the [Native Image Configure Tool](AutomaticMetadataCollection.md#native-image-configure-tool).
The PGO infrastructure enables you to combine multiple profiles into a single one using the [Native Image Utils Tool](AutomaticMetadataCollection.md#native-image-utils-tool).
Merging profiles implies that the resulting profile will contain the union of all types, methods, and profile entries from the provided profiles.

## Usage

To merge two profiles, _profile_1.iprof_ and _profile_2.iprof_, into a single file named _output_profile.iprof_, use the following command:
```bash
native-image-configure merge-pgo-profiles --input-file=profile_1.iprof --input-file=profile_2.iprof --output-file=output_profile.iprof
native-image-utils merge-pgo-profiles --input-file=profile_1.iprof --input-file=profile_2.iprof --output-file=output_profile.iprof
```

There is also a way to specify a directory as a source of profiles using the `--input-dir=<path>` option.
Then it only searches for profiles in the given directory, excluding subdirectories.
```bash
native-image-configure merge-pgo-profiles --input-dir=my_profiles/ --output-file=output_profile.iprof
native-image-utils merge-pgo-profiles --input-dir=my_profiles/ --output-file=output_profile.iprof
```

### Further Reading

* [Basic Usage of Profile-Guided Optimization](PGO-Basic-Usage.md)
* [Native Image Configure Tool](AutomaticMetadataCollection.md#native-image-configure-tool)
* [Native Image Utils Tool](AutomaticMetadataCollection.md#native-image-utils-tool)
12 changes: 6 additions & 6 deletions docs/reference-manual/native-image/guides/use-sbom-support.md
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ For the demo application, you will use the `jwebserver` tool, and package it as

There are two possible ways to extract the compressed SBOM contents into a human-readable format:
- using [Syft](https://github.com/anchore/syft)
- using the [Native Image Configure Tool](#native-image-configure-tool)
- using the [Native Image Utils Tool](#native-image-utils-tool)

### Syft

Expand All @@ -68,14 +68,14 @@ syft jwebserver
```
It lists all of the Java libraries included in it.

### Native Image Configure Tool
### Native Image Utils Tool

GraalVM Native Image provides the `native-image-configure` tool to retrieve an SBOM embedded in a native executable.
The Configure Tool is a viable alternative if you prefer not to install `syft`.
GraalVM Native Image provides the `native-image-utils` tool to retrieve an SBOM embedded in a native executable.
The Utils Tool is a viable alternative if you prefer not to install `syft`.

Run the following command to read the SBOM contents using the Configure Tool:
Run the following command to read the SBOM contents using the Utils Tool:
```bash
$JAVA_HOME/bin/native-image-configure extract-sbom --image-path=<path_to_binary>
$JAVA_HOME/bin/native-image-utils extract-sbom --image-path=<path_to_binary>
```

To take it further, you can submit the SBOM to any available vulnerability scanner, and check if the recorded libraries have known security vulnerabilities.
Expand Down
8 changes: 4 additions & 4 deletions docs/security/Obfuscation.md
Original file line number Diff line number Diff line change
Expand Up @@ -108,10 +108,10 @@ Obfuscated names are non-deterministic and may vary between builds.

### Deobfuscating Stack Traces

To debug an obfuscated stack trace, save the stack trace to a file (for example, `obfuscated-stacktrace.log`) and use `native-image-configure` with the mapping file:
To debug an obfuscated stack trace, save the stack trace to a file (for example, `obfuscated-stacktrace.log`) and use `native-image-utils` with the mapping file:

```bash
native-image-configure deobfuscate --map-file=app.obfuscation-mapping.json --input-file=obfuscated-stacktrace.log
native-image-utils deobfuscate --map-file=app.obfuscation-mapping.json --input-file=obfuscated-stacktrace.log

Exception in thread "main" java.lang.RuntimeException: Something bad happened!
at com.obfuscation.SecretClass.secretAlgorithm(SecretClass.java:14)
Expand All @@ -121,7 +121,7 @@ Exception in thread "main" java.lang.RuntimeException: Something bad happened!
This restores the original names for debugging the issue, while keeping your distributed binary obfuscated.
Log file lines not part of the stack trace remain unchanged.

You can locate the `native-image-configure` tool in the same `bin` directory as `native-image`.
You can locate the `native-image-utils` tool in the same `bin` directory as `native-image`.

## What Gets Obfuscated

Expand Down Expand Up @@ -149,7 +149,7 @@ JUnit-related code is automatically preserved for testing compatibility.
## Understanding the Mapping File

When you use `export-mapping`, Native Image generates a JSON file named _\<image-name\>.obfuscation-mapping.json_ in your build artifacts.
This file maps original symbol names to their obfuscated versions, allowing `native-image-configure deobfuscate` to reverse the process.
This file maps original symbol names to their obfuscated versions, allowing `native-image-utils deobfuscate` to reverse the process.
Mappings can change per build, so associate mapping files with specific build versions or IDs for reliable deobfuscation.

The mapping file lists the `[original, obfuscated]` name pairs of modules, packages, source files, types (classes, records, interfaces, enums), and methods.
Expand Down
12 changes: 6 additions & 6 deletions docs/security/SBOM.md
Original file line number Diff line number Diff line change
Expand Up @@ -24,14 +24,14 @@ The SBOM feature can be disabled with `--enable-sbom=false`.
## Extracting SBOM Contents

After embedding the compressed SBOM into the image, there are two possible ways to extract the SBOM contents:
- using the [Native Image Configure Tool](#native-image-configure-tool)
- using the [Native Image Utils Tool](#native-image-utils-tool)
- using [Syft](https://github.com/anchore/syft){:target="_blank"}

### Native Image Configure Tool
### Native Image Utils Tool

The Native Image Configure Tool can extract the compressed SBOM using the `extract-sbom` command from executables and shared libraries.
The Native Image Utils Tool can extract the compressed SBOM using the `extract-sbom` command from executables and shared libraries.
```bash
$JAVA_HOME/bin/native-image-configure extract-sbom --image-path=<path_to_binary>
$JAVA_HOME/bin/native-image-utils extract-sbom --image-path=<path_to_binary>
```

It outputs the contents in the JSON format:
Expand Down Expand Up @@ -137,9 +137,9 @@ It also integrates with GitHub Actions, GitLab, and Jenkins Pipelines.

Another popular command-line scanner is `grype`, part of the [Anchore software supply chain management platform](https://anchore.com/){:target="_blank"}.
With `grype`, you can check whether the libraries listed in your SBOMs have known vulnerabilities documented in Anchore's database.
The output of the `native-image-configure` tool can be fed directly into `grype` to scan for vulnerable libraries using the following command:
The output of the `native-image-utils` tool can be fed directly into `grype` to scan for vulnerable libraries using the following command:
```bash
native-image-configure extract-sbom --image-path=<path_to_binary> | grype
native-image-utils extract-sbom --image-path=<path_to_binary> | grype
```
It produces the following output:
```shell
Expand Down
2 changes: 1 addition & 1 deletion espresso/mx.espresso/mx_espresso.py
Original file line number Diff line number Diff line change
Expand Up @@ -1020,6 +1020,6 @@ def gen_gc_option_check(args):
})

# CE with some skipped native images
ce_unchained_components = ['bnative-image', 'bnative-image-configure', 'cmp', 'gvm', 'lg', 'ni', 'nic', 'nil', 'nr_lib_jvmcicompiler', 'sdkc', 'sdkni', 'snative-image-agent', 'snative-image-diagnostics-agent', 'ssvmjdwp', 'svm', 'svmjdwp', 'svmsl', 'svmt', 'tflc', 'tflsm']
ce_unchained_components = ['bnative-image', 'bnative-image-utils', 'cmp', 'gvm', 'lg', 'ni', 'nic', 'nil', 'nr_lib_jvmcicompiler', 'sdkc', 'sdkni', 'snative-image-agent', 'snative-image-diagnostics-agent', 'ssvmjdwp', 'svm', 'svmjdwp', 'svmsl', 'svmt', 'tflc', 'tflsm']
mx_sdk_vm.register_vm_config('ce', ce_unchained_components, _suite, env_file='jvm-ce')
mx_sdk_vm.register_vm_config('ce', ce_unchained_components, _suite, env_file='jvm-ce-llvm')
20 changes: 10 additions & 10 deletions sdk/mx.sdk/mx_sdk_benchmark.py
Original file line number Diff line number Diff line change
Expand Up @@ -1108,28 +1108,28 @@ def _configure_from_name(self, config_name):
self.pgo_instrumentation = True

def generate_profiling_package_prefixes():
# run the native-image-configure tool to gather the jdk package prefixes
# run the native-image-utils tool to gather the jdk package prefixes
graalvm_home_bin = os.path.join(mx_sdk_vm.graalvm_home(), 'bin')
native_image_configure_command = mx.cmd_suffix(
os.path.join(graalvm_home_bin, 'native-image-configure'))
if not exists(native_image_configure_command):
mx.abort('Failed to find the native-image-configure command at {}. \nContent {}: \n\t{}'.format(
native_image_configure_command, graalvm_home_bin,
native_image_utils_command = mx.cmd_suffix(
os.path.join(graalvm_home_bin, 'native-image-utils'))
if not exists(native_image_utils_command):
mx.abort('Failed to find the native-image-utils command at {}. \nContent {}: \n\t{}'.format(
native_image_utils_command, graalvm_home_bin,
'\n\t'.join(os.listdir(graalvm_home_bin))))
tmp = tempfile.NamedTemporaryFile()
ret = mx.run([native_image_configure_command, 'generate-filters',
ret = mx.run([native_image_utils_command, 'generate-filters',
'--include-packages-from-modules=java.base',
'--exclude-classes=org.graalvm.**', '--exclude-classes=com.oracle.**',
# remove internal packages
f'--output-file={tmp.name}'], nonZeroIsFatal=True)
if ret != 0:
mx.abort('Native image configure command failed.')
mx.abort('Native image utils command failed.')

# format the profiling package prefixes
with open(tmp.name, 'r') as f:
prefixes = json.loads(f.read())
if 'rules' not in prefixes:
mx.abort('Native image configure command failed. Can not generate rules.')
mx.abort('Native image utils command failed. Can not generate rules.')
rules = prefixes['rules']
rules = map(lambda r: r['includeClasses'][:-2], filter(lambda r: 'includeClasses' in r, rules))
return ','.join(rules)
Expand Down Expand Up @@ -1695,7 +1695,7 @@ def _collect_perf_results_into_iprof(self):
else:
mx.abort(f"Perf script failed with exit code: {exit_code}")
mx.log(f"Started generating iprof at {self.get_stage_runner().get_timestamp()}")
nic_command = [os.path.join(self.home(), 'bin', 'native-image-configure'), 'generate-iprof-from-perf', f'--perf={self.config.perf_script_path}', f'--source-mappings={self.config.source_mappings_path}', f'--output-file={self.config.profile_path}']
nic_command = [os.path.join(self.home(), 'bin', 'native-image-utils'), 'generate-iprof-from-perf', f'--perf={self.config.perf_script_path}', f'--source-mappings={self.config.source_mappings_path}', f'--output-file={self.config.profile_path}']
if self.pgo_perf_invoke_profile_collection_strategy == PerfInvokeProfileCollectionStrategy.ALL:
nic_command += ["--enable-experimental-option=SampledVirtualInvokeProfilesAll"]
elif self.pgo_perf_invoke_profile_collection_strategy == PerfInvokeProfileCollectionStrategy.MULTIPLE_CALLEES:
Expand Down
3 changes: 2 additions & 1 deletion substratevm/CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,8 @@ This changelog summarizes major changes to GraalVM Native Image.
* (GR-43070) Add a new API flag `-Werror` to treat warnings as errors.
* (GR-69280) Allow use of the `graal.` prefix for options without issuing a warning.
* (GR-2092) Add jitdump support for recording run-time compilation metadata for perf (see PerfProfiling.md). Can be enabled with `-g -H:+RuntimeDebugInfo -H:RuntimeDebugInfoFormat=jitdump`.
* (GR-69572) Deprecates the `native-image-inspect` tool. To extract embedded SBOMs, use `native-image-configure extract-sbom --image-path=<path_to_binary>`.
* (GR-69116) Rename `native-image-configure` tool to `native-image-utils`.
* (GR-69572) Deprecates the `native-image-inspect` tool. To extract embedded SBOMs, use `native-image-utils extract-sbom --image-path=<path_to_binary>`.
* (GR-70136) Add a new tool `--tool:llvm` for the LLVM backend of Native Image.
* (GR-68984) Ship the `reachability-metadata-schema.json` together with GraalVM at `<graalvm-home>/lib/svm/schemas/reachability-metadata-schema.json`.
* (GR-68984) Improve the schema to capture detailed constraints about each element in the `reachability-metadata-schema.json`.
Expand Down
Loading