build: Add Dependency Check Gradle plugin #9491
Conversation
Signed-off-by: Usman Saleem <[email protected]>
Signed-off-by: Usman Saleem <[email protected]>
Signed-off-by: Usman Saleem <[email protected]>
Signed-off-by: Usman Saleem <[email protected]>
Signed-off-by: Usman Saleem <[email protected]>
Signed-off-by: Usman Saleem <[email protected]>
Signed-off-by: Usman Saleem <[email protected]>
Signed-off-by: Usman Saleem <[email protected]>
Signed-off-by: Usman Saleem <[email protected]>
Signed-off-by: Usman Saleem <[email protected]>
Signed-off-by: Usman Saleem <[email protected]>
Signed-off-by: Usman Saleem <[email protected]>
…directory Signed-off-by: Usman Saleem <[email protected]>
| nvd.apiKey = System.getenv('NVD_API_KEY') | ||
| failBuildOnCVSS = 7 // Fail on high CVSS severity | ||
| suppressionFile = "${rootDir}/gradle/owasp-suppression.xml" | ||
| formats = ['HTML', 'SARIF'] |
There was a problem hiding this comment.
What's the sarif format needed for?
There was a problem hiding this comment.
SARIF format can be uploaded via GitHub action so that it appears in the "Security" tab.
Signed-off-by: Usman Saleem <[email protected]>
Signed-off-by: Usman Saleem <[email protected]>
| id 'org.web3j.solidity' version '0.6.0' | ||
| } | ||
|
|
||
| // Force all web3j dependencies to use version 4.14.0 as it incorrectly pulls in 7.3.2 |
There was a problem hiding this comment.
which dependency is pulling in 7.3.2?
There was a problem hiding this comment.
@fab-10 After introducing owasp dependency check plugin, it attempts to perform configuration analysis to determine all the jars which will be used by a module, this somehow results in web3j plugin to request a non-existent web3j core libraries version, such as 7.3.2. This is probably a bug in web3j plugin or in owasp plugin, however,the debug logs simply shows that shanghai module is requesting web3j core 7.3.2 and it doesn't exist in maven, hence the build errors out. Overriding like above solves the issue.
gradle/owasp-suppression.xml
Outdated
| <notes><![CDATA[ | ||
| file name: dataflow-errorprone-3.42.0-eisop4.jar (shaded: com.google.guava:guava:30.1.1-jre) | ||
| This file is part of errorprone which is used at build time. This is not part of the runtime dependencies. | ||
| ]]></notes> |
There was a problem hiding this comment.
not sure if it safe to suppress a check only because that code run only during the build time, it should depends on the specific vulnerability, because for example it could be that a vulnerability changes some source file and thus leak into runtime
There was a problem hiding this comment.
Fair point, We can try to override the fixed version of this library. I believe this library is resolved by the errorprone plugin during the build time.
platform/build.gradle
Outdated
| // when updating web3j versions, also update plugin and config resolution in: | ||
| // - acceptance-tests/tests/shanghai/build.gradle | ||
| // - acceptance-tests/tests/build.gradle | ||
| api 'org.web3j:abi:4.14.0' |
There was a problem hiding this comment.
is this Web3J update required to be part of this PR?
There was a problem hiding this comment.
No it doesn't. I am going to revert it to previous version.
Signed-off-by: Usman Saleem <[email protected]>
Signed-off-by: Usman Saleem <[email protected]>
Signed-off-by: Usman Saleem <[email protected]>
Signed-off-by: Usman Saleem <[email protected]>
Signed-off-by: Usman Saleem <[email protected]>
Signed-off-by: Usman Saleem <[email protected]>
Signed-off-by: Usman Saleem <[email protected]>
Signed-off-by: Usman Saleem <[email protected]>
fab-10
left a comment
fab-10
left a comment
There was a problem hiding this comment.
Before going on we should understand why adding the dependency check plugin should not interfere with web3j resolution
I asked in web3j discord, they had no clues https://discord.com/channels/905194001349627914/1195062053682032700/1435244486358990919 |
4 participants
PR description
Add Dependency Check Gradle plugin. See https://dependency-check.github.io/DependencyCheck/dependency-check-gradle/index.html for configuration details.
This PR supersedes #9155
Run dependency checks on all modules:
The reports should be available in
build/dependency-checkdirectory of each module.NVD API Key Highly Recommended
This task uses NVD API. It is highly encouraged to obtain an NVD API Key; see https://nvd.nist.gov/developers/request-an-api-key Without an NVD API Key dependency-check's updates will be extremely slow. Export
NVD_API_KEYenvironment variable with appropriate key before running this task.TODO via separate PR: Integrate in Github workflow, possibly as a nightly job and as a pre-req of release job. Upload SARIF file via https://github.com/github/codeql-action/tree/v4/upload-sarif so that the changes are visible in Security tab.
TODO via separate PR: Fix reported vulnerabilities - if any.