28

I'm currently using HP Fortify tool to scan for security vulnerabilities in a project. At the time of scanning Fortify's CLI allows build tools to integrate into its CLI commands so as to build and simultaneously scan the files present in the project. I'm using the below command:

sourceanalyzer -b mcapbookvalue -gradle -verbose ./gradlew -x test --console=verbose -debug --continue assemble

But the build is getting stuck at:

2020-01-14T12:31:39.836-0500 [DEBUG] [org.gradle.cache.internal.DefaultFileLockManager] Lock acquired on daemon addresses registry.[0K
2020-01-14T12:31:39.836-0500 [DEBUG] [org.gradle.cache.internal.DefaultFileLockManager] Releasing lock on daemon addresses registry.
2020-01-14T12:31:39.836-0500 [DEBUG] [org.gradle.cache.internal.DefaultFileLockManager] Waiting to acquire shared lock on daemon addresses registry.
2020-01-14T12:31:39.836-0500 [DEBUG] [org.gradle.cache.internal.DefaultFileLockManager] Lock acquired on daemon addresses registry.
2020-01-14T12:31:39.836-0500 [DEBUG] [org.gradle.cache.internal.DefaultFileLockManager] Releasing lock on daemon addresses registry.

The build is successful if I'm building the project without using Fortify's command integrated, only with:

./gradlew -x test --console=verbose -debug --continue assemble

I'm not able to figure out why the gradle build is getting stuck. And reading and understanding what is happening in the thread dump log is beyond me.

Thread dump(jstack log): https://drive.google.com/file/d/13b6vdDGCWoke7McM_FJROVOkvTaRGqem/view?usp=sharing

It would be great if any help is received.

Thanks in advance.

Sekhar Routray
  • 393
  • 3
  • 7

1 Answers1

-3

The issue you're facing seems to be related to the Gradle daemon and its lock on the daemon addresses registry. The Gradle daemon is a background process that runs Gradle builds, and it uses a lock to manage access to certain resources.

Here are a few possible solutions you can try:

  1. Stop and restart the Gradle daemon: In your project directory, run the following command to stop the Gradle daemon:

./gradlew --stop

Then, try running your build command again and see if it resolves the issue.

  1. Disable the Gradle daemon: You can disable the Gradle daemon by adding the --no-daemon option to your build command. For example:

./gradlew --no-daemon -x test --console=verbose -debug --continue assemble

Disabling the daemon may slow down the build startup time slightly, but it can help if there are issues with the daemon itself.

  1. Upgrade Gradle: Ensure that you are using the latest version of Gradle. You can check the latest version available on the Gradle website or by running ./gradlew --version in your project directory. If you're using an older version, consider upgrading to see if it resolves the issue.

  2. Check for conflicting processes: There might be another Gradle build or process running that is holding the lock on the daemon addresses registry. Check for any other running Gradle processes and terminate them before starting your build.

  3. Analyze the thread dump: If the issue persists and you want to further investigate the problem, you can analyze the thread dump log to identify any potential bottlenecks or conflicts. You can share the thread dump log with the Gradle community or Fortify support for assistance in understanding the issue.

It's worth mentioning that the issue might be specific to the integration between Fortify and Gradle. In that case, reaching out to Fortify support or checking their documentation or community forums for known issues and solutions related to Gradle integration can be helpful.

I hope one of these suggestions helps you resolve the issue and successfully integrate Fortify into your Gradle build.

Arijit
  • 69
  • 1
  • 10
  • 1
    Just a heads-up that all five of your answers this month appear likely to have been entirely or partially written by AI (e.g., ChatGPT). Please be aware that [posting of AI-generated content is banned here](//meta.stackoverflow.com/q/421831). If you used an AI tool to assist with any answer, I would encourage you to delete it. – NotTheDr01ds Jun 11 '23 at 15:22
  • 1
    **Readers should review this answer carefully and critically, as AI-generated information often contains fundamental errors and misinformation.** If you observe quality issues and/or have reason to believe that this answer was generated by AI, please leave feedback accordingly. The moderation team can use your help to identify quality issues. – NotTheDr01ds Jun 11 '23 at 15:22
  • 1
    This answer looks like it was generated by an AI (like ChatGPT), not by an actual human being. You should be aware that [posting AI-generated output is officially **BANNED** on Stack Overflow](https://meta.stackoverflow.com/q/421831). If this answer was indeed generated by an AI, then I strongly suggest you delete it before you get yourself into even bigger trouble: **WE TAKE PLAGIARISM SERIOUSLY HERE.** Please read: [Why posting GPT and ChatGPT generated answers is not currently acceptable](https://stackoverflow.com/help/gpt-policy). – tchrist Jul 06 '23 at 21:44