An issue occurred while starting sonarqube with custom java maven plugin

Question

I am creating a custom sonarqube java plugin. After adding the plugin jar file inside ../extensions/plugins folder, I tried to start sonarqube in my device. But it is showing the following issues:

Background initialization failed. Stopping SonarQube
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'jdk.internal.loader.ClassLoaders$AppClassLoader@5ffd2b27-org.sonar.server.rule.RegisterRules': Initialization of bean failed; nested exception is java.lang.NoClassDefFoundError: org/sonarsource/analyzer/commons/RuleMetadataLoader
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:628)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:542)
    at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:335)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:234)
    at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:333)
    at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:208)
    at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:955)
    at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:918)
    at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:583)
    at org.sonar.core.platform.SpringComponentContainer.startComponents(SpringComponentContainer.java:187)
    at org.sonar.server.platform.platformlevel.PlatformLevel.start(PlatformLevel.java:80)
    at org.sonar.server.platform.platformlevel.PlatformLevelStartup.access$001(PlatformLevelStartup.java:55)
    at org.sonar.server.platform.platformlevel.PlatformLevelStartup$1.doPrivileged(PlatformLevelStartup.java:127)
    at org.sonar.server.user.DoPrivileged.execute(DoPrivileged.java:45)
    at org.sonar.server.platform.platformlevel.PlatformLevelStartup.start(PlatformLevelStartup.java:124)
    at org.sonar.server.platform.PlatformImpl.executeStartupTasks(PlatformImpl.java:183)
    at org.sonar.server.platform.PlatformImpl$AutoStarterRunnable.runIfNotAborted(PlatformImpl.java:344)
    at org.sonar.server.platform.PlatformImpl$1.doRun(PlatformImpl.java:107)
    at org.sonar.server.platform.PlatformImpl$AutoStarterRunnable.run(PlatformImpl.java:328)
    at java.base/java.lang.Thread.run(Thread.java:833)
Caused by: java.lang.NoClassDefFoundError: org/sonarsource/analyzer/commons/RuleMetadataLoader
    at com.plugins.sonar.java.SonarqubeJavaRulesDefinition.define(SonarqubeJavaRulesDefinition.java:44)
    at org.sonar.server.rule.RuleDefinitionsLoader.load(RuleDefinitionsLoader.java:56)
    at org.sonar.server.rule.RegisterRules.start(RegisterRules.java:125)
    at org.sonar.core.platform.StartableBeanPostProcessor.postProcessBeforeInitialization(StartableBeanPostProcessor.java:33)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.applyBeanPostProcessorsBeforeInitialization(AbstractAutowireCapableBeanFactory.java:440)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1796)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:620)
    ... 19 common frames omitted
Caused by: java.lang.ClassNotFoundException: org.sonarsource.analyzer.commons.RuleMetadataLoader
    at org.sonar.classloader.ParentFirstStrategy.loadClass(ParentFirstStrategy.java:39)
    at org.sonar.classloader.ClassRealm.loadClass(ClassRealm.java:87)
    at org.sonar.classloader.ClassRealm.loadClass(ClassRealm.java:76)

The line of code as mentioned in logs, (SonarqubeJavaRulesDefinition.java:44), is the following: RuleMetadataLoader ruleMetadataLoader = new RuleMetadataLoader(RULES_BASE_PATH, runtime);

The following is the pom.xml:

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <groupId>com.sonar.project</groupId>
  <artifactId>static-java-code-analysis</artifactId>
  <version>0.0.1-SNAPSHOT</version>
  <name>StaticJavaCodeAnalysis</name>
  
  <description>It defines the rules that detect energy smells in different loop types in java</description>
  <packaging>sonar-plugin</packaging>
  <properties>
    <java.version>11</java.version>
    
    <!-- <maven.compiler.source>${java.version}</maven.compiler.source>
    <maven.compiler.target>${java.version}</maven.compiler.target> -->
    <sonarqube.version>9.4.0.54424</sonarqube.version>
    <sonar.organization>ramgrg</sonar.organization>
    <sonar.host.url>https://sonarcloud.io</sonar.host.url>
    <sonarjava.version>7.15.0.30507</sonarjava.version> 
    <sonar.skipDependenciesPackaging>true</sonar.skipDependenciesPackaging>
   </properties>
   <dependencies>
      <dependency>
        <groupId>org.junit.jupiter</groupId>
        <artifactId>junit-jupiter-api</artifactId>
        <version>5.9.1</version>
        <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.assertj</groupId>
       <artifactId>assertj-core</artifactId>
       <version>3.23.1</version>
     </dependency>
      <dependency>
         <groupId>org.sonarsource.sonarqube</groupId>
         <artifactId>sonar-plugin-api</artifactId>
         <version>${sonarqube.version}</version>
         <scope>provided</scope>
      </dependency>
     <dependency>
       <groupId>org.sonarsource.analyzer-commons</groupId>
       <artifactId>sonar-analyzer-commons</artifactId>
       <version>2.1.0.1111</version>
     </dependency>
     <dependency>
       <groupId>org.sonarsource.sonarqube</groupId>
       <artifactId>sonar-plugin-api-impl</artifactId>
       <version>9.7.1.62043</version>
     </dependency>
     <dependency>
       <groupId>org.sonarsource.java</groupId>
       <artifactId>sonar-java-plugin</artifactId>
       <version>${sonarjava.version}</version>
       <type>sonar-plugin</type>
       <scope>provided</scope>
     </dependency>
     <dependency>
       <groupId>org.sonarsource.java</groupId>
       <artifactId>java-checks-testkit</artifactId>
       <version>${sonarjava.version}</version>
       <scope>test</scope>
     </dependency>
  </dependencies>
   <build>
      <plugins>
          <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.11.0</version>
                <configuration>
                    <source>${java.version}</source>
                    <target>${java.version}</target>
                </configuration>
          </plugin>
          <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-surefire-plugin</artifactId>
             <version>3.0.0</version>
          </plugin>
          <plugin>
             <groupId>org.sonarsource.sonar-packaging-maven-plugin</groupId>
             <artifactId>sonar-packaging-maven-plugin</artifactId>
             <version>1.21.0.505</version>
             <extensions>true</extensions>
             <configuration>
                <pluginKey>staticjavacode</pluginKey>
                <pluginName>${project.name}</pluginName>
                <pluginClass>com.sonar.java.SonarqubeJavaplugin</pluginClass>
                <sonarLintSupported>true</sonarLintSupported>
             <!--   <skipDependenciesPackaging>true</skipDependenciesPackaging> -->
                <sonarQubeMinVersion>${sonarqube.version}</sonarQubeMinVersion>
                <requirePlugins>java:${sonarjava.version}</requirePlugins>   
             </configuration>
          </plugin>
      </plugins>
  </build>
</project>

Any help is appreciated.

Answer 1

java.lang.NoClassDefFoundError: org/sonarsource/analyzer/commons/RuleMetadataLoader

That means the required class is not found in the classpath during runtime.

In your case, your custom SonarQube plugin is missing a dependency on the sonar-analyzer-commons library.
Try and add the dependency (org.sonarsource.analyzer-commons » sonar-analyzer-commons) to your custom plugin's pom.xml file.

<dependencies>
    ...
    <dependency>
        <groupId>org.sonarsource.analyzer.commons</groupId>
        <artifactId>sonar-analyzer-commons</artifactId>
        <version>2.5.0.1358</version> <!-- Use the appropriate version that matches your SonarQube version -->
    </dependency>
    ...
</dependencies>

That library does include RuleMetadataLoader.java.

---

The OP RamGrg confirms in the comments:

I have these inside <dependencyManagement> <dependencies>....</dependencies></dependencyManagement>.

And that the root cause of your issue.
Let's clarify the differences between <dependencies> and <dependencyManagement>:

1. <dependencies>: This section is used to declare the dependencies that your project needs. The libraries specified here will be included in the classpath during the build process.

2. <dependencyManagement>: This section is used to manage the versions of dependencies in a multimodule project. When you declare dependencies inside the <dependencyManagement> tag, you are not actually including them in your project. Instead, you're specifying the versions that should be used if the project or its submodules were to include those dependencies.
   It's a way to ensure that all submodules use the same version of a dependency, thereby avoiding potential conflicts.

The issue in your case is likely due to the fact that the sonar-analyzer-commons dependency is declared inside <dependencyManagement>, but not in <dependencies>. This means that the dependency isn't actually being included in your build, leading to the NoClassDefFoundError you're seeing.

To resolve this, you should move the sonar-analyzer-commons dependency from <dependencyManagement> to <dependencies>.
Here's how you can do this:

<project>
    ...
    <dependencyManagement>
        <dependencies>
            <!-- other dependencies can be managed here, for instance: -->
            <dependency>
                <groupId>org.sonarsource.sonarqube</groupId>
                <artifactId>sonar-plugin-api</artifactId>
                <version>9.4.0.54424</version>
                <scope>provided</scope>
            </dependency>
            <!-- declare other managed dependencies here... -->
        </dependencies>
    </dependencyManagement>

    <dependencies>
        <!-- Here is where you should declare sonar-analyzer-commons dependency -->
        <dependency>
            <groupId>org.sonarsource.analyzer.commons</groupId>
            <artifactId>sonar-analyzer-commons</artifactId>
            <version>2.1.0.1111</version>
        </dependency>
        <!-- declare other direct dependencies here... -->
    </dependencies>
    ...
</project>

In this pom.xml, the sonar-analyzer-commons dependency is declared outside the <dependencyManagement> section, meaning it will be included in the classpath during the build.

In the <dependencyManagement> section, you're managing the version of sonar-plugin-api (and possibly other dependencies) to ensure that all submodules (if any) use the same version. But these dependencies won't be included in the classpath unless they're also declared in the <dependencies> section.

---

Your pom.xml seems OK with respect to the sonar-analyzer-commons dependency. It is declared in the <dependencies> section, so it should be included in the classpath during the build. You might want to double-check your dependency versions to ensure compatibility, however.

Here's an updated version of your pom.xml, with a potentially compatible sonar-analyzer-commons version. However, this is just a guess, since compatibility often involves more than one dependency. You might need to check the compatibility with other dependencies as well.

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  <!-- ... rest of your pom.xml ... -->
  <dependencies>
    <!-- ... rest of your dependencies ... -->
    <dependency>
      <groupId>org.sonarsource.analyzer.commons</groupId>
      <artifactId>sonar-analyzer-commons</artifactId>
      <version>2.1.0.1111</version> <!-- Ensure this version is compatible with your SonarQube version -->
    </dependency>
    <!-- ... rest of your dependencies ... -->
  </dependencies>
  <!-- ... rest of your pom.xml ... -->
</project>

In the updated version, I only changed the comment for the sonar-analyzer-commons dependency to highlight the need for compatibility with your SonarQube version.

If you're still encountering the same issue, the problem might not be with the pom.xml. It could be related to the way your custom plugin is interacting with the SonarQube API, or it might be a problem with the SonarQube setup itself.

Answer 2

check $sonarqube_home/logs to get more info on this! I am sure you have tried common scenarios. Sometime I also delete contents of sonarqube/data in order to make sure any cached configuration is deleted (please take a backup before)--requires stopping of sq server. Hope this helps!

Answer 3

following both dependencies are not compatible:

<dependency>
    <groupId>org.sonarsource.analyzer-commons</groupId>
    <artifactId>sonar-analyzer-commons</artifactId>
    <version>2.1.0.1111</version>
</dependency>
<dependency>
    <groupId>org.sonarsource.sonarqube</groupId>
    <artifactId>sonar-plugin-api-impl</artifactId>
    <version>9.7.1.62043</version>
</dependency>

I see when I import your pom that the class you are getting the NoClassDefFoundError: org/sonarsource/analyzer/commons/RuleMetadataLoader that this version of the artifact (2.1.0.1111) is not compatible with the org.sonarsource.sonarqube.sonar-plugin-api:sonar-plugin-api-9.4.0.54424.jar (version 9.4.0.54424) for example one of the methods in RuleMetadataLoader (org.sonarsource.analyzer.commons.RuleMetadataLoader#addOwaspAsvs) use org.sonar.api.server.rule.RulesDefinition.NewRule (org.sonar.api.server.rule.RulesDefinition.NewRule is present in sonar-plugin-api-9.4.0.54424.jar but the method org.sonar.api.server.rule.RulesDefinition.NewRule.addOwaspAsvs is only present from version 9.9...).

As RuleMetadataLoader use non-existing method of already loaded classes, the initialization of the class RuleMetadataLoader failed and you get this error.

You must upgrade your sonar-plugin-api to at least 9.9 or downgrade your sonar-analyzer-commons to a lower version.