You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@bigtop.apache.org by "Evans Ye (JIRA)" <ji...@apache.org> on 2018/07/08 15:20:00 UTC
[jira] [Resolved] (BIGTOP-3052) Maven version is fixed in security
verification code
[ https://issues.apache.org/jira/browse/BIGTOP-3052?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Evans Ye resolved BIGTOP-3052.
------------------------------
Resolution: Fixed
Fix Version/s: 1.3.0
Committed.
> Maven version is fixed in security verification code
> ----------------------------------------------------
>
> Key: BIGTOP-3052
> URL: https://issues.apache.org/jira/browse/BIGTOP-3052
> Project: Bigtop
> Issue Type: Bug
> Components: toolchain
> Affects Versions: 1.3.0
> Reporter: Evans Ye
> Assignee: Evans Ye
> Priority: Major
> Fix For: 1.3.0
>
>
> In BIGTOP-2379, the maven.pp has been refactored using $mvnversion for versioning:
> [https://github.com/apache/bigtop/commit/d401eda870a2abfed2b897ed488ee2a571678e68#diff-f5c19b3a16072bc1633fd8db96c6698cR18]
> In BIGTOP-3037, secure download for maven was introduced. However, the version is fixed to 3.5.3
> [https://github.com/apache/bigtop/commit/980e1883a66256b904cdcd11419f5745880ec55a#diff-f5c19b3a16072bc1633fd8db96c6698cR30]
> When maven version automatically upgraded (BIGTOP-3031), the version of downloaded maven and the signature diverse.
>
>
> Ref: [https://ci.bigtop.apache.org/view/Docker/job/Docker-Toolchain-Trunk/OS=centos-7/96/console]
> The error log when building bigtop/slaves images:
> {code:java}
> [mNotice: /Stage[main]/Bigtop_toolchain::Maven/Exec[/usr/bin/wget
> [https://www.apache.org/dist/maven/maven-3/3.5.3/binaries/apache-maven-3.5.4-bin.tar.gz.asc]/returns]
> : Connecting to www.apache.org (www.apache.org)|95.216.24.32|:443... connected.[0m
> [mNotice: /Stage[main]/Bigtop_toolchain::Maven/Exec[/usr/bin/wget
> [https://www.apache.org/dist/maven/maven-3/3.5.3/binaries/apache-maven-3.5.4-bin.tar.gz.asc]/returns]
> : HTTP request sent, awaiting response... 404 Not Found[0m
> [mNotice: /Stage[main]/Bigtop_toolchain::Maven/Exec[/usr/bin/wget
> [https://www.apache.org/dist/maven/maven-3/3.5.3/binaries/apache-maven-3.5.4-bin.tar.gz.asc]/returns]
> : 2018-07-06 02:24:14 ERROR 404: Not Found.[0m
> [91m[1;31mError: /Stage[main]/Bigtop_toolchain::Maven/Exec[/usr/bin/wget
> [https://www.apache.org/dist/maven/maven-3/3.5.3/binaries/apache-maven-3.5.4-bin.tar.gz.asc]
> ]: Failed to call refresh: /usr/bin/wget
> [https://www.apache.org/dist/maven/maven-3/3.5.3/binaries/apache-maven-3.5.4-bin.tar.gz.asc]
> returned 8 instead of one of [0][0m
> [0m[91m[1;31mError: /Stage[main]/Bigtop_toolchain::Maven/Exec[/usr/bin/wget
> [https://www.apache.org/dist/maven/maven-3/3.5.3/binaries/apache-maven-3.5.4-bin.tar.gz.asc]
> ]: /usr/bin/wget
> [https://www.apache.org/dist/maven/maven-3/3.5.3/binaries/apache-maven-3.5.4-bin.tar.gz.asc]
> returned 8 instead of one of [0][0m
> [0m[mNotice: /Stage[main]/Bigtop_toolchain::Maven/Exec[/usr/bin/gpg2 -v --verify --auto-key-retrieve --keyserver hkp://keyserver.ubuntu.com:80 apache-maven-3.5.4-bin.tar.gz.asc]: Dependency Exec[/usr/bin/wget
> [https://www.apache.org/dist/maven/maven-3/3.5.3/binaries/apache-maven-3.5.4-bin.tar.gz.asc]
> ] has failures: true[0m
> [91m[1;31mWarning: /Stage[main]/Bigtop_toolchain::Maven/Exec[/usr/bin/gpg2 -v --verify --auto-key-retrieve --keyserver hkp://keyserver.ubuntu.com:80 apache-maven-3.5.4-bin.tar.gz.asc]: Skipping because of failed dependencies[0m
> [0m[mNotice: /Stage[main]/Bigtop_toolchain::Maven/Exec[/bin/tar xvzf /usr/src/apache-maven-3.5.4-bin.tar.gz]: Dependency Exec[/usr/bin/wget
> [https://www.apache.org/dist/maven/maven-3/3.5.3/binaries/apache-maven-3.5.4-bin.tar.gz.asc]
> ] has failures: true[0m
> {code}
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)