ruthst00 commented on issue #6713:
URL: https://github.com/apache/jmeter/issues/6713#issuecomment-5751156878

   ### This issue breaks down into two distinct problems:
   
   #### Problem 1: Security/verification errors (the build-blocking one)
   **Root cause:** Gradle's dependency verification requires PGP signatures to 
be checked against a local keyring. The AutoStyle 4.0.1 key was missing from 
`gradle/verification-keyring.keys`, so when Azure DevOps agents can't reach 
external key servers (common behind corporate firewalls), the build fails 
immediately at `:build-logic:build-parameters:compileJava`.
   
   **Fix:** this issue is fixed with PR #6740 which has already been merged 
upstream. The reporter should either:
   1. **Pull the latest `main` branch** from apache/jmeter — the fix is already 
there.
   2. Or cherry-pick the single commit from PR #6740 into their fork.
   
   ---
   
   #### Problem 2: Missing/stale JARs under `/lib`
   **Root cause:** This is expected behavior — JMeter's source repo does 
**not** ship pre-built JARs in `/lib`. They are produced by the Gradle build 
(`./gradlew :src:dist:assemble`). If the build fails early (due to Problem 1), 
`/lib` will be empty or stale.
   
   **Fix:** Once Problem 1 is resolved, run:
   ```
   ./gradlew --quiet :src:dist:assemble
   ```
   This produces a full distribution (including all JARs under `build/`) that 
can be used to run JMeter.
   
   ---
   
   #### Additional recommendations for Azure DevOps / corporate network 
environments:
   - **Use a Gradle dependency cache / proxy** (e.g., Artifactory or Nexus) 
pre-seeded with JMeter's dependencies, so builds don't need to reach Maven 
Central or key servers at runtime.
   - **Do not use JDK 21 with JMeter 5.6.3 source** — the codebase targets JDK 
17. Use JDK 17 for building (the Gradle toolchain will auto-provision it if 
needed), or pass `-PjdkTestVersion=0` to use the current JVM without toolchain 
resolution.
   - If maintaining a long-lived fork, periodically sync with upstream `main` 
to pick up dependency verification fixes like #6740.
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to