Re: [jira] [Commented] (OFBIZ-12961) Upgrade Apache Shiro from 1.13.0 to 2.0.0

Jacques Le Roux Sat, 23 Mar 2024 04:14:34 -0700

Thanks Daniel for the quick answer :)

Maybe in the meantime we could simply "comment out" the ldap plugin, not sure 
how yet...


Jacques

Le 23/03/2024 à 11:56, Daniel Watford a écrit :

Hi Jacques,

Here's the cause of the failure for the docker-image github workflow:

#31 31.81 > Task :buildSrc:build
#31 60.80
#31 60.80 > Task :compileJava
#31 60.80
/builder/framework/entity/src/main/java/org/apache/ofbiz/entity/util/EntityCrypto.java:43:
error: package org.apache.shiro.crypto does not exist
#31 60.80 import org.apache.shiro.crypto.AesCipherService;
#31 60.80                               ^
#31 60.80
/builder/framework/entity/src/main/java/org/apache/ofbiz/entity/util/EntityCrypto.java:44:
error: package org.apache.shiro.crypto does not exist
#31 60.80 import org.apache.shiro.crypto.OperationMode;
#31 60.80                               ^
#31 60.80
/builder/framework/entity/src/main/java/org/apache/ofbiz/entity/util/EntityCrypto.java:45:
error: package org.apache.shiro.crypto does not exist
#31 60.80 import org.apache.shiro.crypto.PaddingScheme;

Whichever module provides org.apache.shiro.crypto is missing. But it's odd
that the gradle github workflow doesn't have a problem...

The difference between the two is that the gradle github workflow includes
the plugins, whereas the failing part of the docker-image workflow does not.

I confirmed the behaviour with some local builds:
- without plugins: Build fails
- with plugins: Build succeeds.

We can use './gradlew dependencies' to review the dependency tree.
Searching the tree for shiro we find:
- org.apache.shiro:shiro-core:1.3.2
- - > org.apereo.cas:cas-server-core-api-authentication:5.0.10
- - - > org.apereo.cas:cas-server-core-util:5.0.10
- - - - > org.apereo.cas:cas-server-support-ldap-core:5.0.10
- - - - - > project :plugins:ldap

So the missing dependency is getting brought in through the ldap plugin.

The above suggests we should consider removing the plugins from the gradle
github workflow, or at least consider creating two workflows, one with and
one without plugins.

Thanks,

Dan.





On Sat, 23 Mar 2024 at 10:28, Jacques Le Roux <jacques.le.r...@les7arts.com>
wrote:

Hi,

I'd appreciate confirmations about local build.
And, before reverting, if you have an idea don't hesitate :)

TIA

Jacques

Le 23/03/2024 à 11:23, Jacques Le Roux (Jira) a écrit :

https://issues.apache.org/jira/browse/OFBIZ-12961?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17830052#comment-17830052
]

Jacques Le Roux commented on OFBIZ-12961:
-----------------------------------------

There are currently some, for now, incomprehensible issues while

building.

It works locally on both Win7 and Ubuntu 20.04:


{noformat}
C:\projectsASF\Git\ofbiz-framework>gradlew --no-daemon clean build

--no-build-cache

To honour the JVM settings for this build a single-use Daemon process

will be forked. See
https://docs.gradle.org/7.6/userguide/gradle_daemon.html#sec:disabling_the_daemon
.

Daemon will be stopped at the end of the build

Task :buildSrc:extractPluginRequests UP-TO-DATE
Task :buildSrc:generatePluginAdapters UP-TO-DATE
Task :buildSrc:compileJava UP-TO-DATE
Task :buildSrc:compileGroovy NO-SOURCE
Task :buildSrc:compileGroovyPlugins UP-TO-DATE
Task :buildSrc:pluginDescriptors UP-TO-DATE
Task :buildSrc:processResources UP-TO-DATE
Task :buildSrc:classes UP-TO-DATE
Task :buildSrc:jar UP-TO-DATE
Task :buildSrc:assemble UP-TO-DATE
Task :buildSrc:compileTestJava NO-SOURCE
Task :buildSrc:compileTestGroovy NO-SOURCE
Task :buildSrc:pluginUnderTestMetadata UP-TO-DATE
Task :buildSrc:processTestResources NO-SOURCE
Task :buildSrc:testClasses UP-TO-DATE
Task :buildSrc:test NO-SOURCE
Task :buildSrc:validatePlugins UP-TO-DATE
Task :buildSrc:check UP-TO-DATE
Task :buildSrc:build UP-TO-DATE
Task :themes:common-theme:clean UP-TO-DATE
Task :plugins:projectmgr:clean UP-TO-DATE
Task :clean UP-TO-DATE
Task :plugins:example:clean UP-TO-DATE
Task :themes:common-theme:nodeSetup UP-TO-DATE
Task :themes:common-theme:npmSetup SKIPPED
Task :plugins:projectmgr:nodeSetup UP-TO-DATE
Task :plugins:projectmgr:npmSetup SKIPPED
Task :plugins:example:nodeSetup UP-TO-DATE
Task :plugins:example:npmSetup SKIPPED
Task :plugins:example:npmInstall NO-SOURCE
Task :plugins:example:assemble UP-TO-DATE
Task :plugins:example:check UP-TO-DATE
Task :plugins:example:build UP-TO-DATE
Task :themes:common-theme:npmInstall UP-TO-DATE
Task :themes:common-theme:assemble UP-TO-DATE
Task :themes:common-theme:check UP-TO-DATE
Task :themes:common-theme:build UP-TO-DATE
Task :plugins:projectmgr:npmInstall UP-TO-DATE
Task :plugins:projectmgr:assemble UP-TO-DATE
Task :plugins:projectmgr:check UP-TO-DATE
Task :plugins:projectmgr:build UP-TO-DATE
Task :compileJava

C:\projectsASF\Git\ofbiz-framework\framework\common\src\main\java\org\apache\ofbiz\common\authentication\AuthHelper.java:132:
warning: [removal] AccessController in java.security has been deprecated
and marked for removal

          return AccessController.doPrivileged(
                 ^

C:\projectsASF\Git\ofbiz-framework\framework\testtools\src\main\java\org\apache\ofbiz\testtools\GroovyScriptTestCase.java:29:
warning: [deprecation] GroovyTestCase in groovy.util has been deprecated

public class GroovyScriptTestCase extends GroovyTestCase {
                                            ^
2 warnings

Task :compileGroovy
Task :processResources
Task :classes
Task :jar
Task :startScripts
Task :distTar
Task :distZip
Task :assemble
Task :compileTestJava
Task :compileTestGroovy
Task :processTestResources
Task :testClasses

The Cobertura XML file [null] is not accessible; skipping this rule

Task :checkstyleMain
Task :checkstyleTest
Task :codenarcMain

The Cobertura XML file [null] is not accessible; skipping this rule

Task :codenarcTest
Task :test

OpenJDK 64-Bit Server VM warning: Sharing is only supported for boot

loader classes because bootstrap classpath has been appended

Task :check
Task :build

BUILD SUCCESSFUL in 4m 56s
33 actionable tasks: 15 executed, 18 up-to-date
C:\projectsASF\Git\ofbiz-framework>
{noformat}

{noformat}
jacques@jacques-VirtualBox:~/ofbiz-framework$ ./gradlew clean build

--no-build-cache

Task :buildSrc:extractPluginRequests UP-TO-DATE
Task :buildSrc:generatePluginAdapters UP-TO-DATE
Task :buildSrc:compileJava UP-TO-DATE
Task :buildSrc:compileGroovy NO-SOURCE
Task :buildSrc:compileGroovyPlugins UP-TO-DATE
Task :buildSrc:pluginDescriptors UP-TO-DATE
Task :buildSrc:processResources UP-TO-DATE
Task :buildSrc:classes UP-TO-DATE
Task :buildSrc:jar UP-TO-DATE
Task :buildSrc:assemble UP-TO-DATE
Task :buildSrc:compileTestJava NO-SOURCE
Task :buildSrc:compileTestGroovy NO-SOURCE
Task :buildSrc:pluginUnderTestMetadata UP-TO-DATE
Task :buildSrc:processTestResources NO-SOURCE
Task :buildSrc:testClasses UP-TO-DATE
Task :buildSrc:test NO-SOURCE
Task :buildSrc:validatePlugins UP-TO-DATE
Task :buildSrc:check UP-TO-DATE
Task :buildSrc:build UP-TO-DATE
Task :plugins:example:cleanBuildReactApp UP-TO-DATE
Task :clean
Task :plugins:example:clean UP-TO-DATE
Task :plugins:projectmgr:clean UP-TO-DATE
Task :themes:common-theme:clean UP-TO-DATE
Task :compileJava

/home/jacques/ofbiz-framework/framework/common/src/main/java/org/apache/ofbiz/common/authentication/AuthHelper.java:132:
warning: [removal] AccessController in java.security has been deprecated
and marked for removal

          return AccessController.doPrivileged(
                 ^

/home/jacques/ofbiz-framework/framework/testtools/src/main/java/org/apache/ofbiz/testtools/GroovyScriptTestCase.java:29:
warning: [deprecation] GroovyTestCase in groovy.util has been deprecated

public class GroovyScriptTestCase extends GroovyTestCase {
                                            ^
2 warnings

Task :compileGroovy
Task :processResources
Task :plugins:example:nodeSetup UP-TO-DATE
Task :plugins:example:npmSetup SKIPPED
Task :plugins:example:npmInstall UP-TO-DATE
Task :plugins:example:buildReactApp
vite-react-app@0.0.0 build
tsc && vite build --minify false --emptyOutDir

vite v4.5.2 building for production...
transforming...
? 110 modules transformed.
rendering chunks...
computing gzip size...
../webapp/example/vite-react-app/manifest.json                0.42 kB ¦

gzip:  0.19 kB

../webapp/example/vite-react-app/index.html                   1.29 kB ¦

gzip:  0.74 kB

../webapp/example/vite-react-app/assets/react-35ef61ed.svg    4.13 kB ¦

gzip:  2.05 kB

../webapp/example/vite-react-app/assets/index-c98b5613.css    2.22 kB ¦

gzip:  0.79 kB

../webapp/example/vite-react-app/assets/index-ebf59e67.js   362.20 kB ¦

gzip: 76.94 kB

? built in 5.33s

Task :plugins:projectmgr:nodeSetup UP-TO-DATE
Task :plugins:projectmgr:npmSetup SKIPPED
Task :plugins:projectmgr:npmInstall UP-TO-DATE
Task :themes:common-theme:nodeSetup UP-TO-DATE
Task :themes:common-theme:npmSetup SKIPPED
Task :themes:common-theme:npmInstall UP-TO-DATE
Task :classes
Task :jar
Task :startScripts
Task :distTar
Task :distZip
Task :assemble
Task :checkstyleMain
Task :compileTestJava
Task :compileTestGroovy
Task :processTestResources
Task :testClasses
Task :checkstyleTest

The Cobertura XML file [null] is not accessible; skipping this rule

Task :codenarcMain

The Cobertura XML file [null] is not accessible; skipping this rule

Task :codenarcTest
Task :test

OpenJDK 64-Bit Server VM warning: Sharing is only supported for boot

loader classes because bootstrap classpath has been appended

Task :check
Task :build
Task :plugins:example:assemble UP-TO-DATE
Task :plugins:example:check UP-TO-DATE
Task :plugins:example:build UP-TO-DATE
Task :plugins:projectmgr:assemble UP-TO-DATE
Task :plugins:projectmgr:check UP-TO-DATE
Task :plugins:projectmgr:build UP-TO-DATE
Task :themes:common-theme:assemble UP-TO-DATE
Task :themes:common-theme:check UP-TO-DATE
Task :themes:common-theme:build UP-TO-DATE

BUILD SUCCESSFUL in 14m 40s
36 actionable tasks: 17 executed, 19 up-to-date
jacques@jacques-VirtualBox:~/ofbiz-framework$

{noformat}

It also works at

https://github.com/apache/ofbiz-framework/actions/runs/8399944524/job/23006661250

bq. Java CI with Gradle #2887: Commit aa459fd pushed by asfgit

But not at

https://github.com/apache/ofbiz-framework/actions/runs/8399944523

bq. Analyze (java)
bq. We were unable to automatically build your code. Please replace the

call to the autobuild action with your custom build steps. Encountered a
fatal error while running
"/opt/hostedtoolcache/CodeQL/2.16.5/x64/codeql/java/tools/autobuild.sh".
Exit code was 1 and last log line was: Picked up JAVA_TOOL_OPTIONS:
-Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false. See the logs for more
details.

nor https://github.com/apache/ofbiz-framework/actions/runs/8399944544
bq. Build and push OFBiz docker container images
bq. buildx failed with: ERROR: failed to solve: process "./gradlew

--console plain distTar" did not complete successfully: exit code: 1

And last bu not least in BB:
https://ci2.apache.org/#/builders/49/builds/824

Very weird ans sad situation :/

Upgrade Apache Shiro from 1.13.0 to 2.0.0
-----------------------------------------

                  Key: OFBIZ-12961
                  URL: https://issues.apache.org/jira/browse/OFBIZ-12961
              Project: OFBiz
           Issue Type: Improvement
           Components: framework
     Affects Versions: Upcoming Branch
             Reporter: Jacques Le Roux
             Assignee: Jacques Le Roux
             Priority: Minor
              Fix For: Upcoming Branch


At first glance there is no security vulnerability implied.


--
This message was sent by Atlassian Jira
(v8.20.10#820010)

Re: [jira] [Commented] (OFBIZ-12961) Upgrade Apache Shiro from 1.13.0 to 2.0.0

Reply via email to