I'm currently using HP Fortify tool to scan for security vulnerabilities in a project. At the time of scanning Fortify's CLI allows build tools to integrate into its CLI commands so as to build and simultaneously scan the files present in the project. I'm using the below command:
sourceanalyzer -b mcapbookvalue -gradle -verbose ./gradlew -x test --console=verbose -debug --continue assemble
But the build is getting stuck at:
2020-01-14T12:31:39.836-0500 [DEBUG] [org.gradle.cache.internal.DefaultFileLockManager] Lock acquired on daemon addresses registry.[0K
2020-01-14T12:31:39.836-0500 [DEBUG] [org.gradle.cache.internal.DefaultFileLockManager] Releasing lock on daemon addresses registry.
2020-01-14T12:31:39.836-0500 [DEBUG] [org.gradle.cache.internal.DefaultFileLockManager] Waiting to acquire shared lock on daemon addresses registry.
2020-01-14T12:31:39.836-0500 [DEBUG] [org.gradle.cache.internal.DefaultFileLockManager] Lock acquired on daemon addresses registry.
2020-01-14T12:31:39.836-0500 [DEBUG] [org.gradle.cache.internal.DefaultFileLockManager] Releasing lock on daemon addresses registry.
The build is successful if I'm building the project without using Fortify's command integrated, only with:
./gradlew -x test --console=verbose -debug --continue assemble
I'm not able to figure out why the gradle build is getting stuck. And reading and understanding what is happening in the thread dump log is beyond me.
Thread dump(jstack log): https://drive.google.com/file/d/13b6vdDGCWoke7McM_FJROVOkvTaRGqem/view?usp=sharing
It would be great if any help is received.
Thanks in advance.