OWASP Dependency Checker has been updated so that it can be configured to automatically fail a build when a vulnerable dependency is detected. This option is exposed through gradle settings, so that a build can be configured in TeamCity to pass/fail. This change is backward-compatible - i.e. it does not affect a build by default unless configured to do so.
Ability to fail a build is exposed by the new owasp.failBuildOnCVSS gradle property
By default this is set to '11.0' which will always pass a build even if a vulnerability is found (so will not affect anything by default)
Reduce the CVSS level between 0-10 to indicate what level to fail a build on
Example usage to catch Medium severity (and above) issues:
Configure gradle with the option -Powasp.failBuildOnCVSS=4
* Tidy up
* Add install-shell-extensions command
* Make cli tests use same version of picocli as everything else
* Remove initLogging from NodeStartup, it is ran earlier by CordaCLIWrapper
* Use picocli snapshot for testing
* Use RunLast() parser to invoke correct subcommands
* Deprecate old clear-network-map-cache parameter
* Restructure NodeStartup for commands
* Get rid of -c option since the flag method has been deprecated and that didn't exist in last release
* Update documentation
* Update backwards compatibility test
* Get all subcommands working
* Refactor sub commands into seperate classes
* Update docs and fix some tests
* Docs changes
* Fix merge conflicts with master
* Fix renamed parameters
* Fix test failure
* Fix compatibility tests
* Add missing compatibility test for blob inspector
* Remove blob inspector compatibility test as there are import conflicts
* Assorted doc fixes
* Addressing review comments
* More review comments
* Couple more bits
* Fix broken tests
* Fix compilation error
* More merge conflicts
* Make startup logging function a bit more sensible
* Fix broken shell extensions
* Make shell extensions work with subcommands
* Make sure parameters for deprecated options are carried through
* More review comments
* Adding some s's
* One last go
* Fix compilation error on Windows
* Revert logging changes
* Revert docs back to their original imperatively moody state
* Move Raft and BFT notaries into separate modules
* Move schemas
* Fix tests & demos
* Modified logic for creating notary services:
Added a new field 'className' to the notary configuration. The node now
loads the specified implementation via reflection. The default className
value points to the simple notary implementation for backwards compatibility.
Relevant schemas are loaded in a similar fashion.
For backwards compatibility purposes the default SimpleNotaryService will
remain built-in to node, but its cordapp will be generated on startup – so
the loading of notary services is streamlined.
* Move test namedcache factory to test utils
* Provide AsyncLoggingContextSelector that inhibits use of thread local storage
* Turn on async logging via log4j properties file
* Mention async logging in the documentation and also explain how to turn it off when required.
* Formatting
* Typo
* Add shutdown hook to flush loggers.
* code review rework
* Ring buffer size to 256kB
* Set maximal log file size to 100MB - should slow down the rolling of log files and give us a bit more history on the cluster.
The old limit of max 10GB of compressed log files still stands.
* Fix to enable gradle build caching of test runs.
* Configure gradle build caching to be enabled.
* Generate dependency report and graph:
1) ./gradlew htmlDependencyReport
2) ./gradlew generateDependencyGraphCorda
* Strip out all Jacoco references to prevent Gradle Build Cache error:
"Caching disabled for task ':<module>:test': 'JaCoCo agent configured with `append = true`' satisfied"
* Revert jacoco back into jarFilter gradle build file.
Disable building deterministic modules (including jarFilter).
* Added Gradle build scan plugin.
* Set file encoding to prevent incorrect Gradle build cache keys across different machines.
https://guides.gradle.org/using-build-cache/#system_file_encoding
* Apply gradle build cache settings to buildSrc.
* Added targetted gradle build tasks to leverage cache.
* Updated URL's of several different test Gradle Cache instances.
* Updated CI batch build scripts.
* Updated script perms to be executable.
* Added CI smoke tests batch script.
* Use TestDev Labs gradle cache.
* Echo URL of Gradle Build Repository.
Echo exit status of each Gradle build command.
* Use environment variables to define Gradle Build Cache usage and URL.
* Customisation through parameters.
* Remove dependency graph generation plugin.
Align build cache settings across project and buildSrc gradle files.
* Remove buildSrc gradle build cache config.
* Revert definition of gradle build cache variables back to settings.gradle.
* Fix incorrect path.
* Aligned gradle build cache configuration across buildSrc and project.
* Minor updates to test scope.
* Minor updates to test scope.
* Update scripts to use GRADLE_HOME
* Exit on unset GRADLE_HOME
* Remove duplication following rebase from master.
* Remove fine-grained build task scripts.
* Added back Jacoco reporting.
* Revert jdk8u-deterministic module.
* Incorporating changes from PR review feedback.
* Workaround Jacoco issue associated with Gradle Build Cache test task.
* Update init script.
* Remove redundant build-scan declarations.
* Updates from PR review feedback.
* Remove GRADLE_HOME as no longer needed - everything is driven via gradle wrapper.
* Use CORDA prefix in system environment variable.
* Trivial tweaks to DJVM code.
- Use ASM Type.getInternalName()
- Use @JvmDefault annotation
- Declare test base class as abstract
- Ensure test Log4J configuration has precedence
- Replace assert() with require()
- Replace simple lambdas with function references
* Publish corda-djvm artifact.
* Migrate Utilities class into the CLI tool.
* Configure unit tests for console logging.
Change to older Liquibase 3.5.5 version to align with Enterprise repo - Liquibase 3.6.X changed schema case sensitivity behaviour and it's brakes in Corda for one database vendor.
Internal tables (the tables from node and finance modules) are now tracked /created by Liquibase script.
Tables backing MappedSchemma in Cordapps are created by Hibernate (as before).
The PR scope added Liquibase library, setup code SchemaMigration and XML scripts and from Enterprise.
For existing database installation - the node will auto-upgrade to use Liquibase.
Method migrateOlderDatabaseToUseLiquibase checks for any 3.X existing Corda database to upgrade database to use Liquibase. When the existing database without Liquibase integral tables is detected, the node (at startup) will create Liquibase tracking tables and fill them with all migration scripts (marked as done), this ensure the database will look as it would use Liquibase from the beginning.
The database changes gradually introduced by the subsequent 3.X releases (3.1, 3.2) are conditionally run by Liquibase.
* Add shell extensions to CLI utils class and move into its own module
* Fix issue with completion script generation and slight refactor
* Fix autocompletion for logging level
* Delete uneeded comment
* More tidying up
* Make run function final
* Fixed an issue with the program being run twice.
* Address review comments
* CORDA-1568: Change Java source files encoding for all the projects.
See: https://ci-master.corda.r3cev.com/viewLog.html?buildId=103073&tab=buildResultsDiv&buildTypeId=Corda_BuildWindowsTest
```
InteractiveShellJavaTest.flowStartWithComplexTypes
show details
No applicable constructor for flow. Problems were:
[party: Party]: missing parameter party
[pair: Pair]: missing parameter pair
[Amount]: Could not parse as a command: Did not recognise the currency in £10 or could not parse
```
* Shrink the Simm Valuation Demo's contract states CorDapp using ProGuard.
* Remove CordFormation from CorDapp modules, which unbundles Jolokia from the CorDapps.
* Preserve directory structure for CorDapp's own classes.
* Remove unwanted transitive dependencies from Simm Valuation CorDapps.
* Use allprojects {} to set Strata version property.
* Expand the deterministic JDK image to make it friendlier to IntelliJ.
* Fix Gradle always to use the latest deterministic rt.jar available.
* Write JDK items directly from Gradle.
The list of CorDapps jars is no longer passed in via the cmd line but is now expected to be placed in the bootstrapped directory.
Ended up being a bit of a refactor to cater for unit testing, and also tidied up the bootstrapper docs.
