You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@bookkeeper.apache.org by "shoothzj (via GitHub)" <gi...@apache.org> on 2024/05/30 00:41:37 UTC
[PR] Correct Configuration Error in OWASP Dependency Check Plugin Setup [bookkeeper]
shoothzj opened a new pull request, #4406:
URL: https://github.com/apache/bookkeeper/pull/4406
### Motivation
The purpose of this update is to correct a configuration error in our OWASP Dependency Check Maven plugin setup.
I appreciate @xiezhx9 for opening the issue on [jeremylong/DependencyCheck #6697](https://github.com/jeremylong/DependencyCheck/issues/6697). Also, a special thanks to @jeremylong for his guidance and response.
From dependency-check-plugin maintainer jeremylong
> With the setup specified ODC would run too many times - once with the specified configuration and once without. You can either put the plugin into the build/plugins or in the reporting - don't do both.
> Regarding it re-running on each child module - you likely want to specify <inherited>false</inherited>.
### Changes
- **Version Update:** The `dependency-check-maven.version` in `pom.xml` has been updated from `9.1.0` to `9.2.0`. This update incorporates the latest vulnerability definitions and enhancements from OWASP.
- **Fix Configuration Inheritance:** Added `<inherited>false</inherited>` to the dependency-check plugin configuration under the build section. This correction prevents the plugin from inheriting settings unnecessarily across multi-module projects, reducing superfluous scans and speeding up builds.
- **Remove Duplicate Configuration:** Eliminated the OWASP plugin configuration from the reporting section. This change fixes a prior oversight where the plugin was configured to execute twice, once in the build and once in the reporting phase, leading to unnecessary build delays.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Correct Configuration Error in OWASP Dependency Check Plugin Setup [bookkeeper]
Posted by "lhotari (via GitHub)" <gi...@apache.org>.
lhotari commented on PR #4406:
URL: https://github.com/apache/bookkeeper/pull/4406#issuecomment-2142312484
I noticed this in the referenced issue:
> Furthermore, after adding the following pom.xml configuration, I noticed that the OWASP Dependency Check Plugin is downloading NVD (National Vulnerability Database) information for each module during the build process, which significantly slows it down.
In Apache Pulsar, this downloading problem is resolved by caching the NVD information. Here's the solution in Pulsar to restore and update the cache: https://github.com/apache/pulsar/blob/c39f9f82b425c66c899f818583714c9c98d3e213/.github/workflows/ci-owasp-dependency-check.yaml#L61-L113 . Restoring the cache: https://github.com/apache/pulsar/blob/c39f9f82b425c66c899f818583714c9c98d3e213/.github/workflows/pulsar-ci.yaml#L1462-L1477 . Please notice that the dir is excluded from maven caching: https://github.com/apache/pulsar/blob/c39f9f82b425c66c899f818583714c9c98d3e213/.github/workflows/pulsar-ci.yaml#L1439 .
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Correct Configuration Error in OWASP Dependency Check Plugin Setup [bookkeeper]
Posted by "shoothzj (via GitHub)" <gi...@apache.org>.
shoothzj merged PR #4406:
URL: https://github.com/apache/bookkeeper/pull/4406
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@bookkeeper.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org