Skip to content

Commit 18da5fb

Browse files
nhumblotnhumblot
authored
Merge branch 'main' into dependabot/maven/org.apache.maven.plugins-maven-failsafe-plugin-3.5.4
2 parents 966aca1 + d7b2a01 commit 18da5fb

File tree

33 files changed

+480
-214
lines changed

33 files changed

+480
-214
lines changed

‎.github/workflows/build.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -141,6 +141,18 @@ jobs:
141141
uses: actions/download-artifact@v5
142142
with:
143143
name: archive-snapshot
144+
- name: Set up Docker
145+
uses: docker/setup-docker-action@v4
146+
with:
147+
daemon-config: |
148+
{
149+
"debug": true,
150+
"features": {
151+
"containerd-snapshotter": true
152+
}
153+
}
154+
- name: Set up Docker Buildx
155+
uses: docker/setup-buildx-action@v3
144156
- name: Build Docker Image
145157
run: ./build-docker.sh
146158
- name: build scan target

‎.github/workflows/pull_requests.yml‎

Lines changed: 55 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,19 @@ jobs:
6464
with:
6565
sarif_file: core/target/spotbugsSarif.json
6666
category: spotbugs-core
67-
67+
- name: Archive Snapshot
68+
id: archive-snapshot
69+
uses: actions/upload-artifact@v4
70+
with:
71+
name: archive-snapshot
72+
retention-days: 1
73+
path: |
74+
**/target/*.asc
75+
**/target/*.jar
76+
**/target/*.pom
77+
ant/target/*.zip
78+
cli/target/*.zip
79+
6880
maven:
6981
name: Regression Test Maven Plugin
7082
permissions:
@@ -143,4 +155,45 @@ jobs:
143155
uses: github/codeql-action/upload-sarif@v3
144156
with:
145157
sarif_file: target/checkstyle-result.sarif
146-
category: checkstyle
158+
category: checkstyle
159+
160+
docker:
161+
permissions:
162+
contents: read # to fetch code (actions/checkout)
163+
164+
name: Build and Test Docker
165+
runs-on: ubuntu-latest
166+
needs: test
167+
steps:
168+
- name: Checkout code
169+
uses: actions/checkout@v5
170+
- name: Check Maven Cache
171+
id: maven-cache
172+
uses: actions/cache@v4
173+
with:
174+
path: ~/.m2/repository
175+
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
176+
restore-keys: |
177+
${{ runner.os }}-maven-
178+
- name: Download release build
179+
uses: actions/download-artifact@v5
180+
with:
181+
name: archive-snapshot
182+
- name: Set up Docker
183+
uses: docker/setup-docker-action@v4
184+
with:
185+
daemon-config: |
186+
{
187+
"debug": true,
188+
"features": {
189+
"containerd-snapshotter": true
190+
}
191+
}
192+
- name: Set up Docker Buildx
193+
uses: docker/setup-buildx-action@v3
194+
- name: Build Docker Image
195+
run: ./build-docker.sh
196+
- name: build scan target
197+
run: mvn -V -s settings.xml package -DskipTests=true --no-transfer-progress --batch-mode
198+
- name: Test Docker Image
199+
run: ./test-docker.sh

‎.github/workflows/release.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -149,6 +149,18 @@ jobs:
149149
uses: actions/download-artifact@v5
150150
with:
151151
name: archive-release
152+
- name: Set up Docker
153+
uses: docker/setup-docker-action@v4
154+
with:
155+
daemon-config: |
156+
{
157+
"debug": true,
158+
"features": {
159+
"containerd-snapshotter": true
160+
}
161+
}
162+
- name: Set up Docker Buildx
163+
uses: docker/setup-buildx-action@v3
152164
- name: Build Docker Image
153165
run: ./build-docker.sh
154166
- name: build scan target

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ RUN apk update
4747
apk del .build-deps
4848

4949
### remove any suid sgid - we don't need them
50-
RUN find / -perm +6000 -type f -exec chmod a-s {} \;
50+
RUN find / -path /proc -prune -perm +6000 -type f -exec chmod a-s {} \;
5151
USER ${UID}
5252

5353
VOLUME ["/src", "/report"]

‎ant/src/site/markdown/configuration.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -89,7 +89,7 @@ be needed.
8989
| ossindexAnalyzerUsername | Sets the username for OSS Index - note an account with OSS Index is not required. |   |
9090
| ossindexAnalyzerPassword | Sets the password for OSS Index. |   |
9191
| ossIndexAnalyzerWarnOnlyOnRemoteErrors | Whether we should only warn about Sonatype OSS Index remote errors instead of failing completely. |   |
92-
| nexusAnalyzerEnabled | Sets whether Nexus Analyzer will be used (requires Nexus Pro). This analyzer is superceded by the Central Analyzer; however, you can configure this to run against a Nexus Pro installation. | true |
92+
| nexusAnalyzerEnabled | Sets whether Nexus Analyzer will be used. This analyzer is an alternative to the Central or Artifactory Analyzers, allowing retrieval from Sonatype Nexus installations. | true |
9393
| nexusUrl | Defines the Nexus web service endpoint (example http://domain.enterprise/nexus/service/local/). If not set the Nexus Analyzer will be disabled. |   |
9494
| nexusUser | The username to authenticate to the Nexus Server's web service end point. If not set the Nexus Analyzer will use an unauthenticated connection. |   |
9595
| nexusPassword | The password to authenticate to the Nexus Server's web service end point. If not set the Nexus Analyzer will use an unauthenticated connection. |   |

‎build-docker.sh‎

Lines changed: 17 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,27 @@
1-
#!/bin/bash -e
1+
#!/bin/bash
2+
set -euo pipefail
23

34
VERSION=$(mvn -q \
45
-Dexec.executable="echo" \
56
-Dexec.args='${project.version}' \
67
--non-recursive \
7-
org.codehaus.mojo:exec-maven-plugin:1.3.1:exec)
8+
org.codehaus.mojo:exec-maven-plugin:3.5.1:exec)
89

910
FILE=./cli/target/dependency-check-$VERSION-release.zip
10-
if [ -f "$FILE" ]; then
11-
docker build . --build-arg VERSION=$VERSION -t owasp/dependency-check:$VERSION
12-
if [[ ! $VERSION = *"SNAPSHOT"* ]]; then
13-
docker tag owasp/dependency-check:$VERSION owasp/dependency-check:latest
14-
fi
15-
else
11+
if [ ! -f "$FILE" ]; then
1612
echo "$FILE does not exist - run 'mvn package' first"
1713
exit 1
1814
fi
15+
16+
if ! docker info -f '{{ .DriverStatus }}' | grep "driver-type io.containerd.snapshotter" >/dev/null; then
17+
echo "Docker Engine is not running with the containerd snapshotter - this is currently needed to build and test ODC multi-platform images using docker buildx."
18+
echo "If using Docker Desktop, enable \"Use containerd for pulling and storing images\" per https://docs.docker.com/desktop/settings-and-maintenance/settings/#general"
19+
echo "For more technical information on Docker Engine, see https://docs.docker.com/engine/storage/containerd/"
20+
exit 1
21+
fi
22+
23+
extra_tag_args="$([[ ! $VERSION = *"SNAPSHOT"* ]] && echo "--tag owasp/dependency-check:latest" || echo "")"
24+
25+
docker buildx build --pull --load --platform linux/amd64,linux/arm64 . \
26+
--build-arg VERSION=$VERSION \
27+
--tag owasp/dependency-check:$VERSION ${extra_tag_args}

‎cli/pom.xml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,14 @@ Copyright (c) 2012 - Jeremy Long. All Rights Reserved.
9292
<configurationDirectory>plugins/*</configurationDirectory>
9393
<includeConfigurationDirectoryInClasspath>true</includeConfigurationDirectoryInClasspath>
9494
<unixScriptTemplate>${project.basedir}/src/main/conf/unixBinTemplate</unixScriptTemplate>
95+
<!--
96+
enable-native-access=ALL-UNNAMED
97+
Java 21+: Needed by Lucene indexes unless we do -Dorg.apache.lucene.store.MMapDirectory.enableMemorySegments=false
98+
to go back to regular ByteBuffer (non-native) usage.
99+
-XX:+IgnoreUnrecognizedVMOptions
100+
Java <21: Allow use of enable-native-access on Java 11 JVMs without errors
101+
-->
102+
<extraJvmArguments>--enable-native-access=ALL-UNNAMED -XX:+IgnoreUnrecognizedVMOptions</extraJvmArguments>
95103
</configuration>
96104
<executions>
97105
<execution>

‎cli/src/main/resources/logback.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
</encoder>
1111
</appender>
1212

13+
<logger name="org.apache.lucene" level="ERROR" />
1314
<logger name="org.apache.commons.jcs" level="ERROR" />
1415
<logger name="org.apache.hc" level="ERROR" />
1516

0 commit comments

Comments
 (0)