Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Warning message on download of feature *.esa.ac file when installing features yet feature verification seems to succeed #1784

Open
scottkurz opened this issue Jan 8, 2024 · 4 comments
Open

Warning message on download of feature *.esa.ac file when installing features yet feature verification seems to succeed #1784

scottkurz opened this issue Jan 8, 2024 · 4 comments
Assignees
@jjiwooLim @jacobwdv @bensonlatibm

Comments

@scottkurz
Copy link
Member

scottkurz commented Jan 8, 2024 •
edited
Loading

Using:

  • liberty-maven-plugin v3.10
  • Open Liberty 23.0.0.12
  • Eclipse OpenJ9 VM, version 17.0.3+7 (en_US)
  • Maven v3.8.8
  • Windows 11

I get the first time (the feature is downloaded) following running dev mode

[INFO] Configuration features have been added: [cloudant-1.0]
[INFO] Running liberty:install-feature
[INFO] Feature signature verify option: enforce
[INFO] Parsing the server file for features and includes: tempConfig10310779532609883731\server.xml
[INFO] Parsing the server file for features and includes: tempConfig10310779532609883731\configDropins/overrides/liberty-plugin-variable-config.xml
[INFO] plugin listed esa: []

[INFO] Resolving features... 
Downloading from central: https://repo.maven.apache.org/maven2/io/openliberty/features/cloudant-1.0/23.0.0.12/cloudant-1.0-23.0.0.12.esa
Downloaded from central: https://repo.maven.apache.org/maven2/io/openliberty/features/cloudant-1.0/23.0.0.12/cloudant-1.0-23.0.0.12.esa (124 kB at 269 kB/s)
Downloading from central: https://repo.maven.apache.org/maven2/io/openliberty/features/cloudant-1.0/23.0.0.12/cloudant-1.0-23.0.0.12.esa.asc
[WARNING] Could not validate integrity of download from https://repo.maven.apache.org/maven2/io/openliberty/features/cloudant-1.0/23.0.0.12/cloudant-1.0-23.0.0.12.esa.asc
org.eclipse.aether.transfer.ChecksumFailureException: Checksum validation failed, no checksums available
    at org.eclipse.aether.internal.impl.AbstractChecksumPolicy.onNoMoreChecksums (AbstractChecksumPolicy.java:64)
    at org.eclipse.aether.connector.basic.ChecksumValidator.validate (ChecksumValidator.java:107)
    at org.eclipse.aether.connector.basic.BasicRepositoryConnector$GetTaskRunner.runTask (BasicRepositoryConnector.java:460)
    at org.eclipse.aether.connector.basic.BasicRepositoryConnector$TaskRunner.run (BasicRepositoryConnector.java:364)
    at org.eclipse.aether.util.concurrency.RunnableErrorForwarder$1.run (RunnableErrorForwarder.java:75)
    at org.eclipse.aether.connector.basic.BasicRepositoryConnector$DirectExecutor.execute (BasicRepositoryConnector.java:628)
    at org.eclipse.aether.connector.basic.BasicRepositoryConnector.get (BasicRepositoryConnector.java:262)
    at org.eclipse.aether.internal.impl.DefaultArtifactResolver.performDownloads (DefaultArtifactResolver.java:514)
    at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolve (DefaultArtifactResolver.java:402)
    at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifacts (DefaultArtifactResolver.java:229)
    at org.eclipse.aether.internal.impl.DefaultArtifactResolver.resolveArtifact (DefaultArtifactResolver.java:207)
    at org.eclipse.aether.internal.impl.DefaultRepositorySystem.resolveArtifact (DefaultRepositorySystem.java:262)
    at io.openliberty.tools.maven.AbstractLibertySupport.resolveArtifactFile (AbstractLibertySupport.java:602)
    at io.openliberty.tools.maven.AbstractLibertySupport.resolveArtifactItem (AbstractLibertySupport.java:570)
    at io.openliberty.tools.maven.AbstractLibertySupport.createArtifact (AbstractLibertySupport.java:522)
    at io.openliberty.tools.maven.AbstractLibertySupport.getResolvedArtifact (AbstractLibertySupport.java:202)
    at io.openliberty.tools.maven.AbstractLibertySupport.getArtifact (AbstractLibertySupport.java:174)
    at io.openliberty.tools.maven.AbstractLibertySupport.getArtifact (AbstractLibertySupport.java:277)
    at io.openliberty.tools.maven.AbstractLibertySupport.getArtifact (AbstractLibertySupport.java:247)
    at io.openliberty.tools.maven.InstallFeatureSupport$InstallFeatureMojoUtil.downloadArtifact (InstallFeatureSupport.java:116)
    at io.openliberty.tools.maven.InstallFeatureSupport$InstallFeatureMojoUtil.downloadSignature (InstallFeatureSupport.java:124)
    at io.openliberty.tools.common.plugins.util.InstallFeatureUtil.downloadEsaArtifact (InstallFeatureUtil.java:508)
    at io.openliberty.tools.common.plugins.util.InstallFeatureUtil.downloadEsas (InstallFeatureUtil.java:529)
    at io.openliberty.tools.common.plugins.util.InstallFeatureUtil.installFeatures (InstallFeatureUtil.java:735)
    at io.openliberty.tools.maven.server.InstallFeatureMojo.installFeatures (InstallFeatureMojo.java:115)
    at io.openliberty.tools.maven.server.InstallFeatureMojo.doInstallFeatures (InstallFeatureMojo.java:77)
    at io.openliberty.tools.maven.server.InstallFeatureMojo.execute (InstallFeatureMojo.java:68)
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:137)
    at org.twdata.maven.mojoexecutor.MojoExecutor.executeMojo (MojoExecutor.java:120)
    at io.openliberty.tools.maven.server.StartDebugMojoSupport.runLibertyMojo (StartDebugMojoSupport.java:380)
    at io.openliberty.tools.maven.server.StartDebugMojoSupport.runLibertyMojoInstallFeature (StartDebugMojoSupport.java:362)
    at io.openliberty.tools.maven.server.DevMojo.runLibertyMojoInstallFeature (DevMojo.java:1971)
    at io.openliberty.tools.maven.server.DevMojo$DevMojoUtil.installFeatures (DevMojo.java:1136)
    at io.openliberty.tools.common.plugins.util.DevUtil.installFeaturesToTempDir (DevUtil.java:4622)
    at io.openliberty.tools.common.plugins.util.DevUtil.processConfigFileChange (DevUtil.java:4372)
    at io.openliberty.tools.common.plugins.util.DevUtil.processFileChanges (DevUtil.java:4230)
    at io.openliberty.tools.common.plugins.util.DevUtil.watchFiles (DevUtil.java:3158)
    at io.openliberty.tools.maven.server.DevMojo.doDevMode (DevMojo.java:1543)
    at io.openliberty.tools.maven.server.DevMojo.execute (DevMojo.java:1564)
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:137)
    at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:370)
    at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:351)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:215)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:171)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:163)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81)
    at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56)
    at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:299)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:193)
    at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:106)
    at org.apache.maven.cli.MavenCli.execute (MavenCli.java:963)
    at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:296)
    at org.apache.maven.cli.MavenCli.main (MavenCli.java:199)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
    at jdk.internal.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:77)
    at jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke (Method.java:568)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:282)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:225)
    at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:406)
    at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:347)
[WARNING] Checksum validation failed, no checksums available from central for https://repo.maven.apache.org/maven2/io/openliberty/features/cloudant-1.0/23.0.0.12/cloudant-1.0-23.0.0.12.esa.asc
Downloaded from central: https://repo.maven.apache.org/maven2/io/openliberty/features/cloudant-1.0/23.0.0.12/cloudant-1.0-23.0.0.12.esa.asc (853 B at 17 kB/s)
[INFO] Downloading public key(s) for signature verification
[INFO] Verifying features
<---------------------> 0.00%
All features were successfully verified.

As far as I can tell, everything works fine, however.

If I run dev mode a 2nd time with the same features, things proceed smoothly, without error messages.

If I upgrade Maven to v3.9.5 (a version I just happened to try), the message disappears, even for a newly-downloaded feature.

QUESTIONS

  1. Why the warning message (though this seems to have been addressed by the Maven distro).
  2. Is this really the right behavior for the default 'enforce' option? The 'verify' parm doc mentions:

Specifies how features must be verified during a process or an installation. Supported values are enforce, skip, all, and warn. If this option is not specified, the default value is enforce.

  • enforce: Verifies the signatures of all Liberty features except for user features. It checks the integrity and authenticity of the features that are provided by the Liberty framework.

The behavior I saw aligns with more how I'd expect warn to work, however.
@cherylking cherylking moved this to Target fix release in Liberty Tools Release Plan Jan 9, 2024
@jjiwooLim
Copy link
Contributor

Hi, the warning message on download is irrelevant to feature signature verification. The checksum of the artifact is validated when resolving (downloading) the feature using the Maven api. Then the tool downloads the Liberty public key and starts verifying the feature signature.

I couldn't find the good reason why this checksum validation failed, but in this post they were able to resolve the issue by upgrading the maven version like you already mentioned.

@scottkurz
Copy link
Member Author

Thanks for the update. It sounds like the only thing left is to decide if we formally raise the minimum supported Maven version. (Not sure what version this would be exactly. ) It doesn't seem worth it to me since this is just a warning message anyway, and things basically work.

@jjiwooLim
Copy link
Contributor

I agree, when I tried the warning messages went away with Maven v3.9.0.

@yeekangc
Copy link
Member

Issue for starter to update Maven version: OpenLiberty/start.openliberty.io#241

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@jjiwooLim jjiwooLim

@jacobwdv jacobwdv

@bensonlatibm bensonlatibm

Labels
None yet
Projects
Liberty Tools Release Plan
Status: Target fix release
Milestone
No milestone
Development

No branches or pull requests
5 participants
@scottkurz @yeekangc @jjiwooLim @jacobwdv @bensonlatibm