Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

apache-nifi/2.0.0-r1: cve remediation #34018

Merged
merged 4 commits into from
Nov 18, 2024
Merged

apache-nifi/2.0.0-r1: cve remediation #34018

merged 4 commits into from
Nov 18, 2024

Conversation

octo-sts[bot]
Copy link
Contributor

@octo-sts octo-sts bot commented Nov 13, 2024

@octo-sts Octo STS
Copy link
Contributor Author

octo-sts bot commented Nov 13, 2024

Gen AI suggestions to solve the build error:

Based on the build error, here's what's happening and how to fix it:

  1. The main error is a dependency resolution issue:
Could not find artifact io.netty:netty-common:jar:4.1.115 in central
  1. The pombump step attempted to update netty-common to version 4.1.115, but this version doesn't exist in Maven Central. This is likely because pombump is trying to update to a version that hasn't been released yet.

Here are the steps to fix this:

  1. Modify the pombump behavior by adding an explicit version constraint for netty-common. Add this to your melange YAML:
  - uses: maven/pombump
    with:
      version-constraints:
        - "io.netty:netty-common:<4.1.100"  # Use a version that exists
  1. Alternatively, you could pin the specific version that's known to work with Apache NiFi 2.0.0:
  - uses: maven/pombump
    with:
      version-constraints:
        - "io.netty:netty-common:4.1.94.Final"  # Or whatever version is compatible
  1. If you want to debug locally, you can use:
melange build --interactive apache-nifi.yaml

Then inside the debug shell:

./mvnw dependency:tree | grep netty-common  # To see what version is being used

The key problem is that pombump is trying to use a version of netty-common that doesn't exist. By constraining the version to one that does exist and is compatible with NiFi 2.0.0, the build should succeed.

@powersj
fix: Resolve GHSA-xq3w-v528-46rv
6284f1f 
Signed-off-by: Joshua Powers <joshua.powers@chainguard.dev>
@powersj powersj self-assigned this Nov 15, 2024
@github-actions GitHub Actions
Copy link
Contributor

Package apache-nifi-compat: Click to expand/collapse

Package apache-nifi-compat:
Unchanged

Package apache-nifi: Click to expand/collapse

Package apache-nifi:
Modified: /usr/share/nifi/nifi-current/docs/html/administration-guide.html
Modified: /usr/share/nifi/nifi-current/docs/html/developer-guide.html
Modified: /usr/share/nifi/nifi-current/docs/html/expression-language-guide.html
Modified: /usr/share/nifi/nifi-current/docs/html/getting-started.html
Modified: /usr/share/nifi/nifi-current/docs/html/nifi-in-depth.html
Modified: /usr/share/nifi/nifi-current/docs/html/overview.html
Modified: /usr/share/nifi/nifi-current/docs/html/python-developer-guide.html
Modified: /usr/share/nifi/nifi-current/docs/html/record-path-guide.html
Modified: /usr/share/nifi/nifi-current/docs/html/toolkit-guide.html
Modified: /usr/share/nifi/nifi-current/docs/html/user-guide.html
Modified: /usr/share/nifi/nifi-current/docs/html/walkthroughs.html
Modified: /usr/share/nifi/nifi-current/lib/nifi-aws-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-azure-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-cdc-mysql-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-dbcp-service-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-distributed-cache-services-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-framework-kubernetes-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-framework-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-jms-processors-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-jolt-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-jslt-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-lookup-services-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-opentelemetry-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-record-serialization-services-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-record-sink-service-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-server-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-splunk-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-standard-nar-2.0.0.nar

Package apache-nifi-toolkit: Click to expand/collapse

Package apache-nifi-toolkit:
Unchanged

@octo-sts Octo STS
Copy link
Contributor Author

octo-sts bot commented Nov 15, 2024

Gen AI suggestions to solve the build error:

Based on the build output, I don't see any actual errors - the build appears to have completed successfully. The output shows:

  1. All packages were built successfully:
  • apache-nifi-2.0.0-r2.apk
  • apache-nifi-toolkit-2.0.0-r2.apk
  • apache-nifi-compat-2.0.0-r2.apk

  1. There are some SLF4J warnings about "No SLF4J providers were found" but these are just informational messages, not errors.

  2. There is one ANTLR warning about multiple alternatives in the RecordPathParser.g grammar file, but this is also just a warning and doesn't affect the build.

If you're seeing failures in the CI system, it may be worth checking:

  1. The test phase results, which aren't shown in this output
  2. Any post-build validation steps in your CI pipeline
  3. Whether all required artifacts were generated correctly

Could you share what specific failure you're seeing in the CI system? That would help identify if there's an issue that's not apparent in the build output itself.

In terms of the current build configuration, everything looks correct:

  • Dependencies are properly specified
  • Build environment is set up correctly
  • Maven build completes successfully
  • Package generation works as expected

@github-actions GitHub Actions
Copy link
Contributor

Package apache-nifi: Click to expand/collapse

Package apache-nifi:
Modified: /usr/share/nifi/nifi-current/docs/html/administration-guide.html
Modified: /usr/share/nifi/nifi-current/docs/html/developer-guide.html
Modified: /usr/share/nifi/nifi-current/docs/html/expression-language-guide.html
Modified: /usr/share/nifi/nifi-current/docs/html/getting-started.html
Modified: /usr/share/nifi/nifi-current/docs/html/nifi-in-depth.html
Modified: /usr/share/nifi/nifi-current/docs/html/overview.html
Modified: /usr/share/nifi/nifi-current/docs/html/python-developer-guide.html
Modified: /usr/share/nifi/nifi-current/docs/html/record-path-guide.html
Modified: /usr/share/nifi/nifi-current/docs/html/toolkit-guide.html
Modified: /usr/share/nifi/nifi-current/docs/html/user-guide.html
Modified: /usr/share/nifi/nifi-current/docs/html/walkthroughs.html
Modified: /usr/share/nifi/nifi-current/lib/nifi-asana-processors-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-aws-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-azure-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-cdc-mysql-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-cipher-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-distributed-cache-services-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-elasticsearch-restapi-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-email-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-enrich-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-framework-kubernetes-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-framework-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-gcp-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-jms-processors-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-jolt-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-jslt-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-network-processors-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-opentelemetry-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-poi-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-record-serialization-services-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-record-sink-service-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-server-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-slack-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-snmp-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-splunk-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-standard-nar-2.0.0.nar

Package apache-nifi-toolkit: Click to expand/collapse

Package apache-nifi-toolkit:
Unchanged

Package apache-nifi-compat: Click to expand/collapse

Package apache-nifi-compat:
Unchanged

@octo-sts octo-sts bot added the bincapz/pass bincapz/pass Bincapz (aka. malcontent) scan didn't detect any CRITICALs on the scanned packages. label Nov 15, 2024
@powersj
Copy link
Contributor

powersj commented Nov 15, 2024

Got the pombump figured out using a property file, but it seems it exists deeper down still? Unassigned myself for now.

@powersj powersj removed their assignment Nov 15, 2024
@developer-guy
upgrade netty version to fix CVE
beda247 
Signed-off-by: Batuhan Apaydin <batuhan.apaydin@chainguard.dev>
@github-actions GitHub Actions
Copy link
Contributor

Package apache-nifi: Click to expand/collapse

Package apache-nifi:
Modified: /usr/share/nifi/nifi-current/docs/html/administration-guide.html
Modified: /usr/share/nifi/nifi-current/docs/html/developer-guide.html
Modified: /usr/share/nifi/nifi-current/docs/html/expression-language-guide.html
Modified: /usr/share/nifi/nifi-current/docs/html/getting-started.html
Modified: /usr/share/nifi/nifi-current/docs/html/nifi-in-depth.html
Modified: /usr/share/nifi/nifi-current/docs/html/overview.html
Modified: /usr/share/nifi/nifi-current/docs/html/python-developer-guide.html
Modified: /usr/share/nifi/nifi-current/docs/html/record-path-guide.html
Modified: /usr/share/nifi/nifi-current/docs/html/toolkit-guide.html
Modified: /usr/share/nifi/nifi-current/docs/html/user-guide.html
Modified: /usr/share/nifi/nifi-current/docs/html/walkthroughs.html
Modified: /usr/share/nifi/nifi-current/lib/nifi-asana-processors-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-aws-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-azure-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-azure-services-api-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-dbcp-service-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-distributed-cache-services-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-elasticsearch-restapi-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-email-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-enrich-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-framework-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-gcp-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-jms-processors-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-jolt-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-network-processors-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-opentelemetry-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-poi-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-record-serialization-services-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-record-sink-service-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-server-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-slack-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-snmp-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-splunk-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-standard-nar-2.0.0.nar
Modified: /usr/share/nifi/nifi-current/lib/nifi-standard-shared-nar-2.0.0.nar

Package apache-nifi-toolkit: Click to expand/collapse

Package apache-nifi-toolkit:
Unchanged

Package apache-nifi-compat: Click to expand/collapse

Package apache-nifi-compat:
Unchanged

powersj
powersj approved these changes Nov 18, 2024
View reviewed changes
Copy link
Contributor

@powersj powersj left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for picking this up!

@powersj powersj merged commit da1c4d2 into main Nov 18, 2024
18 checks passed
@powersj powersj deleted the cve-apache-nifi-8d5830ee07153e3cf30be23b1113a91d branch November 18, 2024 14:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@powersj powersj powersj approved these changes

Assignees
No one assigned
Labels
apache-nifi/2.0.0-r1 automated pr bincapz/pass bincapz/pass Bincapz (aka. malcontent) scan didn't detect any CRITICALs on the scanned packages. GHSA-xq3w-v528-46rv manual/review-needed maven/pombump request-cve-remediation
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@powersj @developer-guy