Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[7.67.x-blue] upgrade wildfly elytron library #2552

Open
wants to merge 3 commits into
base: 7.67.x-blue
Choose a base branch
from
Open

[7.67.x-blue] upgrade wildfly elytron library #2552

wants to merge 3 commits into from

Conversation

ChinchuAjith
Copy link

The current version is affected by CVE-2023-6236. So upgrading to 2.2.5.Final version of wildfly-elytron and infinispan to 4.0.28.Final.

@baldimir
Copy link
Member

jenkins run fdb

@baldimir
Copy link
Member

jenkins run cdb

@baldimir
Copy link
Member

Looks like the changes don't align well with the EAP version we use. See the logs, it breaks build of product wars.

@baldimir
Copy link
Member

[2025-01-31T10:46:16.466Z] [INFO] ------------------------------------------------------------------------
[2025-01-31T10:46:16.466Z] [INFO] Reactor Summary for Business Central - Distributions 7.67.2-SNAPSHOT:
[2025-01-31T10:46:16.466Z] [INFO]
[2025-01-31T10:46:16.466Z] [INFO] Business Central - Distributions ................... SUCCESS [ 2.225 s]
[2025-01-31T10:46:16.466Z] [INFO] Business Central Parent ............................ SUCCESS [ 0.159 s]
[2025-01-31T10:46:16.466Z] [INFO] Business Central - Webapp Common ................... SUCCESS [ 2.455 s]
[2025-01-31T10:46:16.466Z] [INFO] Business Central Deployment Validation ............. SUCCESS [ 9.874 s]
[2025-01-31T10:46:16.466Z] [INFO] KIE Theme .......................................... SUCCESS [ 0.367 s]
[2025-01-31T10:46:16.466Z] [INFO] KIE Theme - Community .............................. SUCCESS [ 2.396 s]
[2025-01-31T10:46:16.467Z] [INFO] KIE Theme - Product ................................ SUCCESS [ 5.559 s]
[2025-01-31T10:46:16.467Z] [INFO] Business Central - Home Page - Community ........... SUCCESS [ 14.493 s]
[2025-01-31T10:46:16.467Z] [INFO] Business Central - Monitoring Webapp ............... FAILURE [ 43.188 s]
[2025-01-31T10:46:16.467Z] [INFO] Business Central - Webapp .......................... FAILURE [ 44.579 s]
[2025-01-31T10:46:16.467Z] [INFO] Business Central - Distribution Wars Parent ........ SUCCESS [ 2.359 s]
[2025-01-31T10:46:16.467Z] [INFO] Business Central - Monitoring Distribution Wars .... SKIPPED
[2025-01-31T10:46:16.467Z] [INFO] Business Central - Distribution Wars ............... SKIPPED
[2025-01-31T10:46:16.467Z] [INFO] jBPM server distribution ........................... SKIPPED
[2025-01-31T10:46:16.467Z] [INFO] business central add-ons distribution .............. SUCCESS [ 17.434 s]
[2025-01-31T10:46:16.467Z] [INFO] Business Central Tests :: Parent ................... SKIPPED
[2025-01-31T10:46:16.467Z] [INFO] Business Central Tests :: REST API ................. SKIPPED
[2025-01-31T10:46:16.467Z] [INFO] KIE (Drools) Workbench Tests :: GUI ................ SKIPPED
[2025-01-31T10:46:16.467Z] [INFO] ------------------------------------------------------------------------
[2025-01-31T10:46:16.467Z] [INFO] BUILD FAILURE
[2025-01-31T10:46:16.467Z] [INFO] ------------------------------------------------------------------------
[2025-01-31T10:46:16.467Z] [INFO] Total time: 01:02 min (Wall Clock)
[2025-01-31T10:46:16.467Z] [INFO] Finished at: 2025-01-31T05:46:15-05:00
[2025-01-31T10:46:16.467Z] [INFO] ------------------------------------------------------------------------
[2025-01-31T10:46:16.467Z] [ERROR] Failed to execute goal org.wildfly.plugins:wildfly-jar-maven-plugin:6.1.2.Final:package (default) on project business-monitoring-webapp: Packaging wildfly failed: InvocationTargetException: Failed to get the list of the operation properties: "WFLYCTL0030: No resource definition is registered for address [
[2025-01-31T10:46:16.467Z] [ERROR] ("subsystem" => "elytron"),
[2025-01-31T10:46:16.467Z] [ERROR] ("filesystem-realm" => "KieRealm")
[2025-01-31T10:46:16.467Z] [ERROR] ]"
[2025-01-31T10:46:16.467Z] [ERROR] -> [Help 1]
[2025-01-31T10:46:16.467Z] org.apache.maven.lifecycle.LifecycleExecutionException: Failed to execute goal org.wildfly.plugins:wildfly-jar-maven-plugin:6.1.2.Final:package (default) on project business-monitoring-webapp: Packaging wildfly failed
[2025-01-31T10:46:16.467Z] at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:215)
[2025-01-31T10:46:16.467Z] at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156)
[2025-01-31T10:46:16.467Z] at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:148)
[2025-01-31T10:46:16.467Z] at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117)
[2025-01-31T10:46:16.467Z] at org.apache.maven.lifecycle.internal.builder.multithreaded.MultiThreadedBuilder$1.call (MultiThreadedBuilder.java:190)
[2025-01-31T10:46:16.467Z] at org.apache.maven.lifecycle.internal.builder.multithreaded.MultiThreadedBuilder$1.call (MultiThreadedBuilder.java:186)
[2025-01-31T10:46:16.467Z] at java.util.concurrent.FutureTask.run (FutureTask.java:264)
[2025-01-31T10:46:16.467Z] at java.util.concurrent.Executors$RunnableAdapter.call (Executors.java:515)
[2025-01-31T10:46:16.467Z] at java.util.concurrent.FutureTask.run (FutureTask.java:264)
[2025-01-31T10:46:16.467Z] at java.util.concurrent.ThreadPoolExecutor.runWorker (ThreadPoolExecutor.java:1128)
[2025-01-31T10:46:16.467Z] at java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:628)
[2025-01-31T10:46:16.467Z] at java.lang.Thread.run (Thread.java:829)
[2025-01-31T10:46:16.467Z] Caused by: org.apache.maven.plugin.MojoExecutionException: Packaging wildfly failed
[2025-01-31T10:46:16.467Z] at org.wildfly.plugins.bootablejar.maven.goals.AbstractBuildBootableJarMojo.execute (AbstractBuildBootableJarMojo.java:540)
[2025-01-31T10:46:16.467Z] at org.wildfly.plugins.bootablejar.maven.goals.BuildBootableJarMojo.execute (BuildBootableJarMojo.java:55)
[2025-01-31T10:46:16.467Z] at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:137)
[2025-01-31T10:46:16.467Z] at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:210)
[2025-01-31T10:46:16.467Z] at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156)
[2025-01-31T10:46:16.467Z] at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:148)
[2025-01-31T10:46:16.467Z] at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117)
[2025-01-31T10:46:16.467Z] at org.apache.maven.lifecycle.internal.builder.multithreaded.MultiThreadedBuilder$1.call (MultiThreadedBuilder.java:190)
[2025-01-31T10:46:16.467Z] at org.apache.maven.lifecycle.internal.builder.multithreaded.MultiThreadedBuilder$1.call (MultiThreadedBuilder.java:186)
[2025-01-31T10:46:16.467Z] at java.util.concurrent.FutureTask.run (FutureTask.java:264)
[2025-01-31T10:46:16.467Z] at java.util.concurrent.Executors$RunnableAdapter.call (Executors.java:515)
[2025-01-31T10:46:16.467Z] at java.util.concurrent.FutureTask.run (FutureTask.java:264)

@baldimir
Copy link
Member

Maybe Elytron 2.x needs some more configuration. Not sure.

@baldimir
Copy link
Member

Do you have any idea @akumar074, please?

@akumar074
Copy link
Member

@ChinchuAjith The Bump of wildfly elytron library from 1.15.x to 2.x could be risky. I would suggest to upgrade to 1.15.24 which is the latest available version in 1.15.x series and also contains the fix for CVE-2023-6236. wdyt @baldimir ?

@ChinchuAjith
Copy link
Author

@ChinchuAjith The Bump of wildfly elytron library from 1.15.x to 2.x could be risky. I would suggest to upgrade to 1.15.24 which is the latest available version in 1.15.x series and also contains the fix for CVE-2023-6236. wdyt @baldimir ?

1.15.24 also have the same CVE(https://mvnrepository.com/artifact/org.wildfly.security/wildfly-elytron/1.15.24.Final). All series of 1.15.x have the same CVE. And it is fixed in 1.16.0 and 1.16.1. But that have other vulnerabilities. So the next Fixed version is 2.2.5. I have gone through the above PR link. Will connect with the team and work accordingly. Thanks..!!

@yesamer
Copy link
Member

yesamer commented Jan 31, 2025

jenkins run cdb

@akumar074
Copy link
Member

akumar074 commented Feb 3, 2025 •
edited
Loading

@ChinchuAjith The 1.15.24 has the dependency CVE. I guess it's fine then.
The latest FDB run looks okay to me. kie-wb-distributions, I see a IT test failure, but I think it's unrelated.

@akumar074
Copy link
Member

Jenkins run CDB

@akumar074
Copy link
Member

Jenkins run fdb

@baldimir
Copy link
Member

baldimir commented Feb 3, 2025

jenkins run cdb

@baldimir
Copy link
Member

baldimir commented Feb 3, 2025

I am afraid Abhishek is right and we need to update to 1.15.23. It would be a big risk in a maintenance release to not align with what is in EAP as elytron is one of the core components of EAP application server. I will investigate a bit more. See EAP dependencies here: https://maven.repository.redhat.com/ga/org/jboss/bom/eap-runtime-artifacts/7.4.20.GA/eap-runtime-artifacts-7.4.20.GA.pom.

@ChinchuAjith
Copy link
Author

Downgraded wildfly dependency to 1.15.24 to make it compatible with EAP version.

@ChinchuAjith
Copy link
Author

jenkins run fdb

@baldimir
Copy link
Member

baldimir commented Feb 5, 2025

jenkins run cdb

@baldimir
Copy link
Member

baldimir commented Feb 5, 2025

jenkins run fdb

@akumar074
Copy link
Member

Jenkins run fdb

@akumar074
Copy link
Member

Jenkins run cdb

@yesamer
Copy link
Member

yesamer commented Feb 5, 2025

Jenkins run cdb

@yesamer
Copy link
Member

yesamer commented Feb 5, 2025

Jenkins run fdb

@akumar074
Copy link
Member

@ChinchuAjith current CDB failure seems related to the change. Take a look here https://gist.github.com/akumar074/ba99f40b760dfa49f8e0cc7a2206e045

@baldimir
Copy link
Member

baldimir commented Feb 7, 2025

@ChinchuAjith Please check Abhishek's comment. Maybe we need to upgrade also Wildfly to 23.0.3. Or at least try.

@baldimir
Copy link
Member

baldimir commented Feb 7, 2025

It looks like we have the same failure in another PR here: https://jenkins-csb-business-automation-eng.dno.corp.redhat.com/job/KIE/job/7.67.x-blue/job/compile/job/droolsjbpm-build-bootstrap-7.67.x-blue.compile/41/consoleText. So it may not be related to the change.

@baldimir
Copy link
Member

baldimir commented Feb 7, 2025

It would be still good to find out why it is failing though.

@baldimir baldimir mentioned this pull request Feb 7, 2025
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@baldimir baldimir baldimir approved these changes

@akumar074 akumar074 Awaiting requested review from akumar074

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
4 participants
@ChinchuAjith @baldimir @akumar074 @yesamer