[jira] [Updated] (ATLAS-4497) Large number of CVE's (vulnerabilities) when building 2.2.0 from source
[ https://issues.apache.org/jira/browse/ATLAS-4497?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Greg updated ATLAS-4497: Description: Atlas 2.2.0 when built from source has a large number of jar packages that suffer from known exploits / vulnerabilities. I've performed an Anchore and a Twistlock scan of the compiled application and here's the list of the High and Critical vulnerabilities found: [https://pastebin.com/raw/tQNYMZd9] I am attempting to put together a public docker image of Atlas compiled from source. You can see my build process here to see how I arrived at the compiled build that I performed the scans on: [https://github.com/589290/docker-apache-atlas-ubi8/blob/main/Dockerfile] I'm not a Java developer, but I would think that an updated pom.xml that has more current (vulnerability free) versions of packages may help remedy these findings. How to update this maven package tree is above my current skill level. was: Atlas 2.2.0 when built from source has a large number of jar packages that suffer from known exploits / vulnerabilities. I've performed an Anchore and a Twistlock scan of the compiled application and here's the list of the High and Critical vulnerabilities found: [https://pastebin.com/raw/t59rcyH8] I am attempting to put together a public docker image of Atlas compiled from source. You can see my build process here to see how I arrived at the compiled build that I performed the scans on: [https://github.com/589290/docker-apache-atlas-ubi8/blob/main/Dockerfile] I'm not a Java developer, but I would think that a different version of Maven (I'm using 3.6.3) or an updated pom.xml that has more current (vulnerability free) versions of packages may help remedy my findings. I am not sure whether or not this has to do with my downgrading the pom.xml file to use buildtools 0.8.1 since the packages for 1.0 do not seem to be available. > Large number of CVE's (vulnerabilities) when building 2.2.0 from source > --- > > Key: ATLAS-4497 > URL: https://issues.apache.org/jira/browse/ATLAS-4497 > Project: Atlas > Issue Type: Bug > Components: atlas-core >Affects Versions: 2.2.0 > Environment: Redhat UBI (Universal Base Image) 8.5 >Reporter: Greg >Priority: Critical > Labels: security > > Atlas 2.2.0 when built from source has a large number of jar packages that > suffer from known exploits / vulnerabilities. I've performed an Anchore and a > Twistlock scan of the compiled application and here's the list of the High > and Critical vulnerabilities found: > > [https://pastebin.com/raw/tQNYMZd9] > > I am attempting to put together a public docker image of Atlas compiled from > source. You can see my build process here to see how I arrived at the > compiled build that I performed the scans on: > > [https://github.com/589290/docker-apache-atlas-ubi8/blob/main/Dockerfile] > > I'm not a Java developer, but I would think that an updated pom.xml that has > more current (vulnerability free) versions of packages may help remedy these > findings. How to update this maven package tree is above my current skill > level. -- This message was sent by Atlassian Jira (v8.20.1#820001)
[jira] [Commented] (ATLAS-4159) Build failure on ARM64
[ https://issues.apache.org/jira/browse/ATLAS-4159?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17451821#comment-17451821 ] Mark Jens commented on ATLAS-4159: -- In which version of Atlas this improvement has been made ? "Fix Version" property is left to "None". > Build failure on ARM64 > -- > > Key: ATLAS-4159 > URL: https://issues.apache.org/jira/browse/ATLAS-4159 > Project: Atlas > Issue Type: Bug > Components: storm-integration >Reporter: Martin Tzvetanov Grigorov >Priority: Major > Time Spent: 6h 50m > Remaining Estimate: 0h > > Apache Atlas build fails on ARM64/AARCH64 machines with: > > {code:java} > INFO] --- maven-failsafe-plugin:2.18.1:integration-test (integration-test) @ > storm-bridge --- > [WARNING] useSystemClassloader setting has no effect when not forking > [INFO] Failsafe report directory: > /home/ubuntu/git/apache/atlas/addons/storm-bridge/target/failsafe-reports > Running org.apache.atlas.storm.hook.StormAtlasHookIT > Tests run: 3, Failures: 1, Errors: 0, Skipped: 2, Time elapsed: 2.758 sec <<< > FAILURE! - in org.apache.atlas.storm.hook.StormAtlasHookIT > setUp(org.apache.atlas.storm.hook.StormAtlasHookIT) Time elapsed: 2.686 sec > <<< FAILURE! > java.lang.UnsatisfiedLinkError: /tmp/librocksdbjni7739762391070118246.so: > /tmp/librocksdbjni7739762391070118246.so: cannot open shared object file: No > such file or directory (Possible cause: can't load AMD 64-bit .so on a > AARCH64-bit platform) > at java.lang.ClassLoader$NativeLibrary.load(Native Method) > at java.lang.ClassLoader.loadLibrary0(ClassLoader.java:1934) > at java.lang.ClassLoader.loadLibrary(ClassLoader.java:1817) > at java.lang.Runtime.load0(Runtime.java:810) > at java.lang.System.load(System.java:1088) > at > org.rocksdb.NativeLibraryLoader.loadLibraryFromJar(NativeLibraryLoader.java:78) > at > org.rocksdb.NativeLibraryLoader.loadLibrary(NativeLibraryLoader.java:56) > at org.rocksdb.RocksDB.loadLibrary(RocksDB.java:64) > at org.rocksdb.RocksDB.(RocksDB.java:35) > at > org.apache.storm.metricstore.rocksdb.RocksDbStore.prepare(RocksDbStore.java:67) > at > org.apache.storm.metricstore.MetricStoreConfig.configure(MetricStoreConfig.java:33) > at org.apache.storm.daemon.nimbus.Nimbus.(Nimbus.java:531) > at org.apache.storm.LocalCluster.(LocalCluster.java:244) > at org.apache.storm.LocalCluster.(LocalCluster.java:126) > at org.apache.storm.LocalCluster$Builder.build(LocalCluster.java:1234) > at org.apache.storm.Testing.getLocalCluster(Testing.java:231) > at > org.apache.atlas.storm.hook.StormTestUtil.createLocalStormCluster(StormTestUtil.java:45) > at > org.apache.atlas.storm.hook.StormAtlasHookIT.setUp(StormAtlasHookIT.java:53) > Results :Failed tests: > StormAtlasHookIT.setUp:53 » UnsatisfiedLink > /tmp/librocksdbjni7739762391070118... > {code} -- This message was sent by Atlassian Jira (v8.20.1#820001)
Re: Review Request 73733: ATLAS-4496 : Atlas - Upgrade elasticsearch to 7.14.0
--- This is an automatically generated e-mail. To reply, visit: https://reviews.apache.org/r/73733/ --- (Updated Dec. 1, 2021, 6:15 p.m.) Review request for atlas, Ashutosh Mestry, Jayendra Parab, Pinal Shah, and Sarath Subramanian. Bugs: ATLAS-4496 https://issues.apache.org/jira/browse/ATLAS-4496 Repository: atlas Description --- Currently Atlas is using elasticsearch version 7.6.0 upgrading it to 7.14.0. Diffs - pom.xml 4b3408acc Diff: https://reviews.apache.org/r/73733/diff/1/ Testing (updated) --- mvn clean install quick_start.py Atlas server running successfully https://ci-builds.apache.org/job/Atlas/job/PreCommit-ATLAS-Build-Test/995/console Thanks, chaitali
[jira] [Created] (ATLAS-4499) Classification deletion on entity should check for pending tasks for that entity and classification
Radhika Kundam created ATLAS-4499: - Summary: Classification deletion on entity should check for pending tasks for that entity and classification Key: ATLAS-4499 URL: https://issues.apache.org/jira/browse/ATLAS-4499 Project: Atlas Issue Type: Improvement Components: atlas-core Affects Versions: 2.3.0 Reporter: Radhika Kundam Assignee: Radhika Kundam When adding tag propagation is in progress and if user requests for deleting the tag propagation it's proceeding to delete the tag propagation which is causing erroneous scenario. To prevent this, we should check if any pending tasks exist for same entity and same classification and no pending tasks then only it should create new task. -- This message was sent by Atlassian Jira (v8.20.1#820001)