You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@struts.apache.org by Apache Jenkins Server <je...@builds.apache.org> on 2019/02/10 08:00:13 UTC
Build failed in Jenkins: Struts-master-JDK8-dependency-check #144
See <https://builds.apache.org/job/Struts-master-JDK8-dependency-check/144/display/redirect?page=changes>
Changes:
[jogep] Add maven enforce plugin with rule to avoid dependency convergence
[jogep] Solve some dependency convergence issues reported by maven enforce
[jogep] Use latest available hibernate-validator version for bean validation
[jogep] Fix compile issue of post order test example with latest http client
[jogep] Fix compile issue of jasper plugin with latest jasper version
------------------------------------------
[...truncated 1.02 MB...]
[INFO] Exclude: src/main/resources/static/js/**/*.js
[INFO] Exclude: src/main/resources/docs.cfg
[INFO] Exclude: src/main/webapp/fonts/**/*
[INFO] 5 resources included (use -debug for more details)
[INFO] Rat check: Summary over all files. Unapproved: 0, unknown: 0, generated: 0, approved: 4 licenses.
[INFO]
[INFO] --- maven-jar-plugin:3.1.0:jar (default-jar) @ struts2-portlet-tiles-plugin ---
[INFO] Building jar: <https://builds.apache.org/job/Struts-master-JDK8-dependency-check/ws/plugins/portlet-tiles/target/struts2-portlet-tiles-plugin-2.6-SNAPSHOT.jar>
[INFO]
[INFO] >>> maven-source-plugin:3.0.1:jar (attach-sources) > generate-sources @ struts2-portlet-tiles-plugin >>>
[INFO]
[INFO] --- maven-enforcer-plugin:3.0.0-M2:enforce (enforce) @ struts2-portlet-tiles-plugin ---
[INFO]
[INFO] --- maven-enforcer-plugin:3.0.0-M2:enforce (enforce-maven-version) @ struts2-portlet-tiles-plugin ---
[INFO]
[INFO] <<< maven-source-plugin:3.0.1:jar (attach-sources) < generate-sources @ struts2-portlet-tiles-plugin <<<
[INFO]
[INFO]
[INFO] --- maven-source-plugin:3.0.1:jar (attach-sources) @ struts2-portlet-tiles-plugin ---
[INFO] Building jar: <https://builds.apache.org/job/Struts-master-JDK8-dependency-check/ws/plugins/portlet-tiles/target/struts2-portlet-tiles-plugin-2.6-SNAPSHOT-sources.jar>
[INFO]
[INFO] --- maven-site-plugin:3.7.1:attach-descriptor (attach-descriptor) @ struts2-portlet-tiles-plugin ---
[INFO] Skipping because packaging 'jar' is not pom.
[INFO]
[INFO] --- dependency-check-maven:4.0.2:check (default) @ struts2-portlet-tiles-plugin ---
[INFO] Central analyzer disabled
[INFO] Checking for updates
[INFO] Skipping NVD check since last check was within 4 hours.
[INFO] Skipping RetireJS update since last update was within 24 hours.
[INFO] Check for updates complete (11 ms)
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Created CPE Index (0 seconds)
[INFO] Skipping CPE Analysis for npm
[INFO] Finished CPE Analyzer (1 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Analysis Complete (1 seconds)
[WARNING]
One or more dependencies were identified with known vulnerabilities in Struts 2 Portlet Tiles Plugin:
tiles-ognl-3.0.8.jar (cpe:/a:ognl_project:ognl:3.0.8, cpe:/a:apache:tiles:3.0.8, org.apache.tiles:tiles-ognl:3.0.8) : CVE-2016-3093
See the dependency-check report for more details.
[INFO]
[INFO] -------------< org.apache.struts:struts2-sitegraph-plugin >-------------
[INFO] Building DEPRECATED: Struts 2 Sitegraph Plugin 2.6-SNAPSHOT [31/36]
[INFO] --------------------------------[ jar ]---------------------------------
[INFO]
[INFO] --- maven-enforcer-plugin:3.0.0-M2:enforce (enforce) @ struts2-sitegraph-plugin ---
[INFO]
[INFO] --- maven-enforcer-plugin:3.0.0-M2:enforce (enforce-maven-version) @ struts2-sitegraph-plugin ---
[INFO]
[INFO] --- maven-remote-resources-plugin:1.5:process (process-resource-bundles) @ struts2-sitegraph-plugin ---
[INFO]
[INFO] --- maven-resources-plugin:3.1.0:resources (default-resources) @ struts2-sitegraph-plugin ---
[INFO] Using 'UTF-8' encoding to copy filtered resources.
[INFO] Copying 3 resources
[INFO] Copying 3 resources
[INFO]
[INFO] --- maven-compiler-plugin:3.7.0:compile (default-compile) @ struts2-sitegraph-plugin ---
[INFO] Changes detected - recompiling the module!
[INFO] Compiling 18 source files to <https://builds.apache.org/job/Struts-master-JDK8-dependency-check/ws/plugins/sitegraph/target/classes>
[INFO] <https://builds.apache.org/job/Struts-master-JDK8-dependency-check/ws/plugins/sitegraph/src/main/java/org/apache/struts2/Main.java>: <https://builds.apache.org/job/Struts-master-JDK8-dependency-check/ws/plugins/sitegraph/src/main/java/org/apache/struts2/Main.java> uses unchecked or unsafe operations.
[INFO] <https://builds.apache.org/job/Struts-master-JDK8-dependency-check/ws/plugins/sitegraph/src/main/java/org/apache/struts2/Main.java>: Recompile with -Xlint:unchecked for details.
[INFO]
[INFO] --- maven-bundle-plugin:3.5.0:manifest (bundle-manifest) @ struts2-sitegraph-plugin ---
[INFO]
[INFO] --- maven-resources-plugin:3.1.0:testResources (default-testResources) @ struts2-sitegraph-plugin ---
[INFO] Using 'UTF-8' encoding to copy filtered resources.
[INFO] Copying 6 resources
[INFO] Copying 3 resources
[INFO]
[INFO] --- maven-compiler-plugin:3.7.0:testCompile (default-testCompile) @ struts2-sitegraph-plugin ---
[INFO] Changes detected - recompiling the module!
[INFO] Compiling 1 source file to <https://builds.apache.org/job/Struts-master-JDK8-dependency-check/ws/plugins/sitegraph/target/test-classes>
[INFO]
[INFO] --- maven-surefire-plugin:2.22.1:test (default-test) @ struts2-sitegraph-plugin ---
[INFO]
[INFO] -------------------------------------------------------
[INFO] T E S T S
[INFO] -------------------------------------------------------
[INFO] Running org.apache.struts2.sitegraph.SiteGraphTest
ERROR StatusLogger Log4j2 could not find a logging implementation. Please add log4j-core to the classpath. Using SimpleLogger to log to the console...
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.957 s - in org.apache.struts2.sitegraph.SiteGraphTest
[INFO]
[INFO] Results:
[INFO]
[INFO] Tests run: 1, Failures: 0, Errors: 0, Skipped: 0
[INFO]
[INFO]
[INFO] --- apache-rat-plugin:0.12:check (default) @ struts2-sitegraph-plugin ---
[INFO] Added 1 additional default licenses.
[INFO] Added 1 custom approved licenses.
[INFO] Will parse SCM ignores for exclusions...
[INFO] Finished adding exclusions from SCM ignore files.
[INFO] 61 implicit excludes (use -debug for more details).
[INFO] Exclude: Jenkinsfile
[INFO] Exclude: src/main/groovy/Jenkinsfile.gdsl
[INFO] Exclude: src/main/resources/org/apache/struts2/static/domTT.js
[INFO] Exclude: src/site/resources/tags/**/*.html
[INFO] Exclude: src/main/resources/*LICENSE.txt
[INFO] Exclude: src/test/resources/**/*.txt
[INFO] Exclude: src/main/webapp/**/*.css
[INFO] Exclude: src/main/webapp/**/*.map
[INFO] Exclude: src/main/webapp/**/*.js
[INFO] Exclude: src/main/webapp/**/*.svg
[INFO] Exclude: src/main/webapp/**/*.txt
[INFO] Exclude: src/main/resources/**/sitegraph-usage.txt
[INFO] Exclude: src/main/resources/**/docs-urls.txt
[INFO] Exclude: src/etc/header.txt
[INFO] Exclude: src/main/resources/static/css/**/*.css
[INFO] Exclude: src/main/resources/static/js/**/*.js
[INFO] Exclude: src/main/resources/docs.cfg
[INFO] Exclude: src/main/webapp/fonts/**/*
[INFO] 27 resources included (use -debug for more details)
[INFO] Rat check: Summary over all files. Unapproved: 0, unknown: 0, generated: 0, approved: 26 licenses.
[INFO]
[INFO] --- maven-jar-plugin:3.1.0:jar (default-jar) @ struts2-sitegraph-plugin ---
[INFO] Building jar: <https://builds.apache.org/job/Struts-master-JDK8-dependency-check/ws/plugins/sitegraph/target/struts2-sitegraph-plugin-2.6-SNAPSHOT.jar>
[INFO]
[INFO] >>> maven-source-plugin:3.0.1:jar (attach-sources) > generate-sources @ struts2-sitegraph-plugin >>>
[INFO]
[INFO] --- maven-enforcer-plugin:3.0.0-M2:enforce (enforce) @ struts2-sitegraph-plugin ---
[INFO]
[INFO] --- maven-enforcer-plugin:3.0.0-M2:enforce (enforce-maven-version) @ struts2-sitegraph-plugin ---
[INFO]
[INFO] <<< maven-source-plugin:3.0.1:jar (attach-sources) < generate-sources @ struts2-sitegraph-plugin <<<
[INFO]
[INFO]
[INFO] --- maven-source-plugin:3.0.1:jar (attach-sources) @ struts2-sitegraph-plugin ---
[INFO] Building jar: <https://builds.apache.org/job/Struts-master-JDK8-dependency-check/ws/plugins/sitegraph/target/struts2-sitegraph-plugin-2.6-SNAPSHOT-sources.jar>
[INFO]
[INFO] --- maven-site-plugin:3.7.1:attach-descriptor (attach-descriptor) @ struts2-sitegraph-plugin ---
[INFO] Skipping because packaging 'jar' is not pom.
[INFO]
[INFO] --- dependency-check-maven:4.0.2:check (default) @ struts2-sitegraph-plugin ---
[INFO] Central analyzer disabled
[INFO] Checking for updates
[INFO] Skipping NVD check since last check was within 4 hours.
[INFO] Skipping RetireJS update since last update was within 24 hours.
[INFO] Check for updates complete (12 ms)
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Created CPE Index (0 seconds)
[INFO] Skipping CPE Analysis for npm
[INFO] Finished CPE Analyzer (0 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Analysis Complete (1 seconds)
[WARNING]
One or more dependencies were identified with known vulnerabilities in DEPRECATED: Struts 2 Sitegraph Plugin:
org.mortbay.jetty-5.1.4.jar (jetty:org.mortbay.jetty:5.1.4, cpe:/a:mortbay_jetty:jetty:5.1.4, cpe:/a:mortbay:jetty:5.1.4, cpe:/a:jetty:jetty:5.1.4) : CVE-2011-4461, CVE-2009-1524, CVE-2009-1523, CVE-2005-3747, CVE-2007-5615
jasper-compiler-5.5.12.jar (cpe:/a:apache:tomcat:5.5.12, cpe:/a:apache_software_foundation:tomcat:5.5.12, cpe:/a:jasper_project:jasper:5.5.12, tomcat:jasper-compiler:5.5.12) : CVE-2007-6286, CVE-2009-3548, CVE-2010-1157, CVE-2014-0096, CVE-2009-0033, CVE-2014-0099, CVE-2008-4308, CVE-2008-5519, CVE-2009-2693, CVE-2017-6056, CVE-2012-5568, CVE-2012-5887, CVE-2012-5885, CVE-2011-2526, CVE-2012-5886, CVE-2008-2370, CVE-2013-6357, CVE-2006-3835, CVE-2011-2204, CVE-2007-5342, CVE-2008-1947, CVE-2007-0450, CVE-2011-3190, CVE-2008-5515, CVE-2007-1858, CVE-2016-6325, CVE-2008-1232, CVE-2014-0119, CVE-2010-2227, CVE-2011-5063, CVE-2011-5062, CVE-2014-0075, CVE-2008-0128, CVE-2011-1184, CVE-2011-5064, CVE-2010-3718, CVE-2007-5333, CVE-2006-7195, CVE-2013-4590, CVE-2006-7196, CVE-2016-5425, CVE-2009-2901, CVE-2009-2902, CVE-2009-0783, CVE-2009-0781, CVE-2007-3385, CVE-2007-2450, CVE-2007-3382, CVE-2007-3386, CVE-2009-0580, CVE-2012-0022, CVE-2007-2449, CVE-2013-4322, CVE-2011-0013, CVE-2013-4444, CVE-2013-4286, CVE-2013-2185
jasper-runtime-5.5.12.jar (tomcat:jasper-runtime:5.5.12, cpe:/a:apache:tomcat:5.5.12, cpe:/a:apache_software_foundation:tomcat:5.5.12, cpe:/a:jasper_project:jasper:5.5.12) : CVE-2007-6286, CVE-2009-3548, CVE-2010-1157, CVE-2014-0096, CVE-2009-0033, CVE-2014-0099, CVE-2008-4308, CVE-2008-5519, CVE-2009-2693, CVE-2017-6056, CVE-2012-5568, CVE-2012-5887, CVE-2012-5885, CVE-2011-2526, CVE-2012-5886, CVE-2008-2370, CVE-2013-6357, CVE-2006-3835, CVE-2011-2204, CVE-2007-5342, CVE-2008-1947, CVE-2007-0450, CVE-2011-3190, CVE-2008-5515, CVE-2007-1858, CVE-2016-6325, CVE-2008-1232, CVE-2014-0119, CVE-2010-2227, CVE-2011-5063, CVE-2011-5062, CVE-2014-0075, CVE-2008-0128, CVE-2011-1184, CVE-2011-5064, CVE-2010-3718, CVE-2007-5333, CVE-2006-7195, CVE-2013-4590, CVE-2006-7196, CVE-2016-5425, CVE-2009-2901, CVE-2009-2902, CVE-2009-0783, CVE-2009-0781, CVE-2007-3385, CVE-2007-2450, CVE-2007-3382, CVE-2007-3386, CVE-2009-0580, CVE-2012-0022, CVE-2007-2449, CVE-2013-4322, CVE-2011-0013, CVE-2013-4444, CVE-2013-4286, CVE-2013-2185
See the dependency-check report for more details.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Struts 2 2.6-SNAPSHOT:
[INFO]
[INFO] Struts 2 Bill of Materials ......................... SUCCESS [ 2.027 s]
[INFO] Struts 2 ........................................... SUCCESS [ 16.958 s]
[INFO] Struts 2 Core ...................................... SUCCESS [01:58 min]
[INFO] Struts 2 Plugins ................................... SUCCESS [ 3.179 s]
[INFO] Struts 2 Configuration Browser Plugin .............. SUCCESS [ 3.521 s]
[INFO] Struts 2 Sitemesh Plugin ........................... SUCCESS [ 4.089 s]
[INFO] Struts 2 Tiles Plugin .............................. SUCCESS [ 5.272 s]
[INFO] Struts 2 DWR Plugin ................................ SUCCESS [ 3.611 s]
[INFO] Struts 2 Spring Plugin ............................. SUCCESS [ 5.088 s]
[INFO] Struts 2 Convention Plugin ......................... SUCCESS [ 12.147 s]
[INFO] Struts 2 JUnit Plugin .............................. SUCCESS [ 9.032 s]
[INFO] Struts 2 JSON Plugin ............................... SUCCESS [ 10.751 s]
[INFO] Struts 2 Bean Validation Plugin .................... SUCCESS [ 7.187 s]
[INFO] Struts 2 Async Plugin .............................. SUCCESS [ 4.528 s]
[INFO] Struts 2 Webapps ................................... SUCCESS [ 3.369 s]
[INFO] Struts 2 Showcase Webapp ........................... SUCCESS [01:03 min]
[INFO] Struts 2 REST Plugin ............................... SUCCESS [ 7.618 s]
[INFO] Struts 2 Rest Showcase Webapp ...................... SUCCESS [ 4.272 s]
[INFO] Struts 2 CDI Plugin ................................ SUCCESS [ 5.379 s]
[INFO] DEPRECATED: Struts 2 Embedded JSP Plugin ........... SUCCESS [ 10.988 s]
[INFO] Struts 2 GXP Plugin ................................ SUCCESS [ 3.186 s]
[INFO] Struts 2 Jasper Reports Plugin ..................... SUCCESS [ 8.997 s]
[INFO] Struts 2 Java Templates Plugin ..................... SUCCESS [ 4.478 s]
[INFO] Struts 2 JFreeChart Plugin ......................... SUCCESS [ 6.138 s]
[INFO] Struts 2 OSGi Plugin ............................... SUCCESS [ 5.253 s]
[INFO] Struts 2 OVal Plugin ............................... SUCCESS [ 7.059 s]
[INFO] Struts 2 Pell Multipart Plugin ..................... SUCCESS [ 3.127 s]
[INFO] Struts 2 Plexus Plugin ............................. SUCCESS [ 2.992 s]
[INFO] Struts 2 Portlet Plugin ............................ SUCCESS [ 9.143 s]
[INFO] Struts 2 Portlet Tiles Plugin ...................... SUCCESS [ 3.669 s]
[INFO] DEPRECATED: Struts 2 Sitegraph Plugin .............. FAILURE [ 8.011 s]
[INFO] Struts 2 TestNG Plugin ............................. SKIPPED
[INFO] Struts 2 OSGi Bundles .............................. SKIPPED
[INFO] Struts 2 OSGi Admin Bundle ......................... SKIPPED
[INFO] Struts 2 OSGi Demo Bundle .......................... SKIPPED
[INFO] Struts 2 Assembly .................................. SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 06:05 min
[INFO] Finished at: 2019-02-10T08:00:12Z
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:4.0.2:check (default) on project struts2-sitegraph-plugin:
[ERROR]
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] jasper-compiler-5.5.12.jar: CVE-2009-3548, CVE-2011-3190, CVE-2016-6325, CVE-2016-5425, CVE-2013-2185
[ERROR] jasper-runtime-5.5.12.jar: CVE-2009-3548, CVE-2011-3190, CVE-2016-6325, CVE-2016-5425, CVE-2013-2185
[ERROR]
[ERROR] See the dependency-check report for more details.
[ERROR]
[ERROR]
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoFailureException
[ERROR]
[ERROR] After correcting the problems, you can resume the build with the command
[ERROR] mvn <goals> -rf :struts2-sitegraph-plugin
Build step 'Execute shell' marked build as failure
[locks-and-latches] Releasing all the locks
[locks-and-latches] All the locks released
Setting MAVEN_3_LATEST__HOME=/home/jenkins/tools/maven/latest3/
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org
Jenkins build is back to normal :
Struts-master-JDK8-dependency-check #145
Posted by Apache Jenkins Server <je...@builds.apache.org>.
See <https://builds.apache.org/job/Struts-master-JDK8-dependency-check/145/display/redirect?page=changes>
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@struts.apache.org
For additional commands, e-mail: dev-help@struts.apache.org