JDruley177883 (Community Member) asked a question.
For Java Gradle projects, the CLI agent seems to be reaching out to “https://repo.maven.apache.org/maven2/com/srcclr/srcclr-sdk-core/0.3.49/srcclr-sdk-core-0.3.49.pom” to get packages it needs to run. This domain (repo.maven.apache.org) is not permitted through our CI server firewalls since we have a private Artifactory repository for all of our Java packages.
Is there a way to configure the Maven/Gradle repository URL used by the Veracode SCA CLI agent?
This is a snippet of the build failure:
2021-04-28/16:34:48.809 com.sourceclear.engine.component.collectors.GradleNativeCollector INFO Running Gradle Graph Building with: /var/lib/github/work/xxxx-veracode-sca/xxxx-veracode-sca/gradlew -Psrcclr.graph.location=/tmp/graph-8248181241319498205.json -Psrcclr.scope=runtimeClasspath -Psrcclr.useJGraphT=false --init-script /tmp/init-17489548552009907476.gradle clean build -x test -x integTest -x javadoc --stacktrace
2021-04-28/16:36:23.519 com.sourceclear.engine.component.collectors.JsonComponentGraphNativeCollector INFO
2021-04-28/16:36:23.520 com.sourceclear.engine.component.collectors.JsonComponentGraphNativeCollector INFO FAILURE: Build failed with an exception.
2021-04-28/16:36:23.520 com.sourceclear.engine.component.collectors.JsonComponentGraphNativeCollector INFO
2021-04-28/16:36:23.520 com.sourceclear.engine.component.collectors.JsonComponentGraphNativeCollector INFO * What went wrong:
2021-04-28/16:36:23.520 com.sourceclear.engine.component.collectors.JsonComponentGraphNativeCollector INFO Could not resolve all artifacts for configuration 'classpath'.
2021-04-28/16:36:23.520 com.sourceclear.engine.component.collectors.JsonComponentGraphNativeCollector INFO > Could not resolve com.srcclr:srcclr-sdk-core:0.3.49.
2021-04-28/16:36:23.520 com.sourceclear.engine.component.collectors.JsonComponentGraphNativeCollector INFO Required by:
2021-04-28/16:36:23.520 com.sourceclear.engine.component.collectors.JsonComponentGraphNativeCollector INFO unspecified:unspecified:unspecified
2021-04-28/16:36:23.520 com.sourceclear.engine.component.collectors.JsonComponentGraphNativeCollector INFO > Could not resolve com.srcclr:srcclr-sdk-core:0.3.49.
2021-04-28/16:36:23.520 com.sourceclear.engine.component.collectors.JsonComponentGraphNativeCollector INFO > Could not get resource 'https://repo.maven.apache.org/maven2/com/srcclr/srcclr-sdk-core/0.3.49/srcclr-sdk-core-0.3.49.pom'.
2021-04-28/16:36:23.522 com.sourceclear.engine.component.collectors.JsonComponentGraphNativeCollector INFO > Could not GET 'https://repo.maven.apache.org/maven2/com/srcclr/srcclr-sdk-core/0.3.49/srcclr-sdk-core-0.3.49.pom'.
2021-04-28/16:36:23.522 com.sourceclear.engine.component.collectors.JsonComponentGraphNativeCollector INFO > Connect to repo.maven.apache.org:443 [repo.maven.apache.org/151.101.248.215] failed: Read timed out
2021-04-28/16:36:23.522 com.sourceclear.engine.component.collectors.JsonComponentGraphNativeCollector INFO
2021-04-28/16:36:23.522 com.sourceclear.engine.component.collectors.JsonComponentGraphNativeCollector INFO * Try:
2021-04-28/16:36:23.522 com.sourceclear.engine.component.collectors.JsonComponentGraphNativeCollector INFO Run with --info or --debug option to get more log output. Run with --scan to get full insights.
2021-04-28/16:36:23.522 com.sourceclear.engine.component.collectors.JsonComponentGraphNativeCollector INFO
2021-04-28/16:36:23.522 com.sourceclear.engine.component.collectors.JsonComponentGraphNativeCollector INFO * Exception is:
2021-04-28/16:36:23.522 com.sourceclear.engine.component.collectors.JsonComponentGraphNativeCollector INFO org.gradle.api.internal.artifacts.ivyservice.DefaultLenientConfiguration$ArtifactResolveException: Could not resolve all artifacts for configuration 'classpath'.
Thanks for your help!
.png){kind=logo}
Hello @JDruley177883 (Community Member) ,
I would advise to have the SCA packages and dependencies in your artifactory and then it should pull from there if that is what is listed in the gradle file. If you still have more concerns, it be better to open a support ticket for our technical support team to assist you. Here's how you can log a case:
Jason
Veracode Support Engineer
Thank you Jason, I opened a ticket with support.
I did a little more digging, and found that there is a “Gradle Init Script” that is generated by the SCA CLI Agent. In the error log above, it is called “--init-script /tmp/init-17489548552009907476.gradle”. I cannot edit this init script, since it is created by the agent in real-time during the scan.
Inside the init script generated by the CLI Agent, there is this section that is causing the problem:
initscript {
repositories {
mavenLocal()
mavenCentral()
}
dependencies {
classpath group: 'com.srcclr', name: 'srcclr-sdk-core', version: '0.3.49'
}
}
Specifically, the “mavenCentral()” command is what is causing the failure since Maven Central is not accessible from our build servers (we have our own private enterprise Maven repository that all our builds must use).
I'm working with Support to find out if there is a workaround that can be configured to use a different repository for the CLI Agent’s Gradle Init script.
Any update on this or resolution that can be shared? Having a similar issue.
Veracode support was able to resolve our issue. I believe this required a new release of the SCA agent.
The key points are to:
1) Produce the Gradle dependencies list (./gradlew dependencies)
2) Tell the SCA agent where the dependencies list output file is (SRCCLR_DEPENDENCY_TREE_FILE)
3) Tell the SCA agent to use the dependencies list output file (--stdin=gradle)
Linux example:
-----
./gradlew dependencies > gradlew_dependencies.txt
curl -sSL https://download.sourceclear.com/ci.sh | SRCCLR_DEPENDENCY_TREE_FILE=gradlew_dependencies.txt sh -s -- scan --stdin=gradle --debug --allow-dirty
-----