Thursday, June 21, 2018

Gradle and Nexus

download Gradle binaries

mkdir /home/centos/gradle
unzip -d /home/centos/gradle/
export PATH=$PATH:/home/centos/gradle/gradle-4.8/bin/
gradle -version
cd gitclones/
git clone

cd allure-junit5-course/

vi build.gradle


repositories {


repositories {
maven {
url "http://localhost:8181/repository/maven-public/"

if your "group" maven-public repository points only to Maven Central, the build will fail

rm -rf .gradle/
gradle build --refresh-dependencies --debug

> Could not resolve all artifacts for configuration ':classpath'.
> Could not find io.qameta.allure:allure-gradle:2.4.
Searched in the following locations:
- http://localhost:8181/repository/maven-public/io/qameta/allure/allure-gradle/2.4/allure-gradle-2.4.pom
- http://localhost:8181/repository/maven-public/io/qameta/allure/allure-gradle/2.4/allure-gradle-2.4.jar
Required by:
project :

If you add to the group also a Proxy Repo "jcenter" pointing to, everything works

Wednesday, June 20, 2018

Zipkin and Sleuth distributed tracing

Sleuth concise presentation with example:

and code is here

This is a very nice real demo (not "helloworld") of Sleuth and ELK with Kibana

Sunday, June 10, 2018

Eclipse and Gradle

Importing an old Gradle project in Eclipse can be problematic. I get this error message when "import existing gradle build"

Spring Boot plugin requires Gradle 4.0 or later. The current version is Gradle 2.5

I the project's "gradle/wrapper/" I replace




I download and install latest gradle 4.8 in E:\apps\gradle-4.8

In Eclipse, configure the Preferences/Gradle setting the Gradle User Home to E:\apps\gradle-4.8

I have installed "Buildship Eclipse plug-ins for Gradle" version 2.2.1

It's a real pity that the plugin doesn't offer an automatic resolution of the issue (upgrading to latest Gradle, and updating the project's settings", but in case of Eclipse we are just thankful it doesn't crash as it usually does. What a pathetic piece of crap Eclipse is, it's a shame for the whole IT community, I use it only because it's the official IDE at work.

Thursday, June 7, 2018

Browsermob as a whitelisting/blacklisting Proxy

It's based on our friend Littleproxy.

Its latest release it 2.1.6. It seems not much going on recently... no commits in last 8 months...

In our case, 2 APIs are interesting:

Sets a list of URL patterns to whitelist PUT /proxy/[port]/whitelist

Request Parameters:

regex - A comma separated list of regular expressions.

status - The HTTP status code to return for URLs that do not match the whitelist.

Set a URL to blacklist
PUT /proxy/[port]/blacklist

Request Parameters:

regex - The blacklist regular expression.

status - The HTTP status code to return for URLs that are blacklisted.

method - The regular expression for matching HTTP method (GET, POST, PUT, etc). Optional, by default processing all HTTP method.

Saturday, June 2, 2018

Spring Boot and H2

Example code is here:

you must add spring.h2.console.path=/h2 in the file

in a nutshell:

in pom.xml




# Datasource

# H2
# Enabling H2 Console
#Turn Statistics on
# Show all queries


To implement a repository:


public interface QuarantineRepository extends CrudRepository<Quarantine, Long> {
List findBygav(String gav);


To use the repository in a @javax.inject.Named bean:

import javax.inject.Inject;

QuarantineRepository quarantineRepository ;

where Quarantine is like this:

import javax.persistence.Entity;
import javax.persistence.GeneratedValue;
import javax.persistence.GenerationType;
import javax.persistence.Id;

public class Quarantine {
@GeneratedValue(strategy = GenerationType.AUTO)
private Long id;
private String gav;

etc etc


Spring Boot 2 actuator ... priceless!

in, add this


and restart. hit this:


You can see the definition of all the Spring beans

Tutorial here





http://localhost:8080/actuator/flyway (fail)


http://localhost:8080/actuator/heapdump , this will save a file heapdump, rename it to heapdump.hprof, then open it with Eclipse Memory Analyzer Tool (MemoryAnalyzer.exe on Windows)


http://localhost:8080/actuator/liquibase (fail)









http://localhost:8080/actuator/prometheus (fail)

http://localhost:8080/actuator/sessions (fail)

http://localhost:8080/actuator/shutdown (fail)

http://localhost:8080/actuator/jolokia (fail)

Friday, June 1, 2018

Nexus proxy to npm registry

Install node.js

cd ~
sudo tar --strip-components 1 -xzvf node-v* -C /usr/local
node --version

In nexus 3, create a Proxy NPM repo pointing to and called npm-all

npm config set registry http://localhost:8081/repository/npm-all/
npm install --save-dev babel-loader babel-core babel-preset-env webpack

it works! I only get this error

engine p-try@1.0.0: wanted: {"node":">=4"} (current: {"node":"0.10.30","npm":"1.4.21"})
npm ERR! Error: Package 'webassemblyjs-ast' not found : repository/npm-all/webassemblyjs/ast
npm ERR!     at RegClient. (/usr/local/lib/node_modules/npm/node_modules/npm-registry-client/lib/request.js:300:14)
npm ERR!     at Request._callback (/usr/local/lib/node_modules/npm/node_modules/npm-registry-client/lib/request.js:238:65)
npm ERR!     at Request.self.callback (/usr/local/lib/node_modules/npm/node_modules/request/request.js:123:22)
npm ERR!     at Request.emit (events.js:98:17)
npm ERR!     at Request. (/usr/local/lib/node_modules/npm/node_modules/request/request.js:893:14)
npm ERR!     at Request.emit (events.js:117:20)
npm ERR!     at IncomingMessage. (/usr/local/lib/node_modules/npm/node_modules/request/request.js:844:12)
npm ERR!     at IncomingMessage.emit (events.js:117:20)
npm ERR!     at _stream_readable.js:938:16
npm ERR!     at process._tickCallback (node.js:419:13)
npm ERR! If you need help, you may report this *entire* log,
npm ERR! including the npm and node versions, at:
npm ERR!     

to clean npm local repository, use "npm cache clean"

Wednesday, May 30, 2018

Eclipse for Docker

To install: Help/Eclipse Marketplace, search for Docker Tools, install.
Otherwise, install "JBoss Tools" and you get also Docker Tools.

Show View / Docker Explorer

you get by default this one:


but you can also work with remote docker via TCP with authentication

this view shows ALL your containers (docker ps -a) and images (docker images), with a list of ports and volumes

Eclipse for Docker is a really nice tool! It makes it much easier to work with Docker. However I still believe one should be familiar with the Docker CLI.

Tuesday, May 29, 2018

Sanity check on a Nexus 2 Maven Proxy repo

The task is: verify that all the JARs in a Nexus 2 repo are still in Maven Central.

I did a
find /path/to/nexusdata/central -name "*.jar" > alljarsfiltered.txt

and then run this Java application:

package mavenchecker;

import java.nio.file.Files;
import java.nio.file.Paths;
import java.util.ArrayList;
import java.util.Arrays;

public class MavenChecker {
 public static ArrayList<String> errors = new ArrayList<String>();
 public static ArrayList<String> nonexisting = new ArrayList<String>();
 static int count  = 0;

 public static void main(String[] args) {

  String fileName = "/home/centos/Downloads/alljarsfiltered.txt";
  // read file into stream, try-with-resources
  try (Stream<String> stream = Files.lines(Paths.get(fileName)).parallel()) {

   stream.forEach((line) -> checkLine(line));

  } catch (IOException e) {

  for (String error : errors) {
   System.out.println("ERROR : " + error);

  for (String nonexistingItem : nonexisting) {
   System.out.println("nonexisting : " + nonexistingItem);


 private static void checkLine(String line) {
  if (count % 100 == 0) {
   System.out.println("COUNT " + count);
  if (!line.endsWith(".jar"))

  String gavstring = line.replace("/path/to/nexusdata/central/", "");
  String[] parts = gavstring.split("/");
  int len = parts.length;
  if (len < 4) {
   System.err.println("invalid length for gavstring " + gavstring + " len = " + len + " should be at least 4");
  } else {
   String filename = parts[len - 1];
   String version = parts[len - 2];
   String artifactid = parts[len - 3];
   String group = String.join(".", Arrays.copyOfRange(parts, 0, len - 3));
   String message = "filename=" + filename + " group=" + group + " artifactid=" + artifactid + " version=" + version;
   boolean exists = exists("" + gavstring);
   if (!exists) nonexisting.add(gavstring);

 public static boolean exists(String URLName){
     try {
       // note : you may also need
       //        HttpURLConnection.setInstanceFollowRedirects(false)
       HttpURLConnection con =
          (HttpURLConnection) new URL(URLName).openConnection();
       return (con.getResponseCode() == HttpURLConnection.HTTP_OK);
     catch (Exception e) {
        return false;


Monday, May 28, 2018

Nexus Firewall

As usual, Sonatype scatters his product documentation across the 5 Oceans, in the most disparate formats (blogs, videos, poorly formatted wiki pages etc)

Good video here
quick start

The Firewall product is really simple: given a GAV, it checks a DB (NIST Vulnerabilities) for all its vulnerabilities, and applies a bunch of rules to determine if the component is risky. If it's risky, it quarantines it, but provides a function to "unlock it" to the end user (Maven).

systemctl start service on boot with specific user


sudo vi /etc/systemd/system/ms.service


ExecStart=/bin/bash /path/to/script/ start
ExecStop=/bin/bash /path/to/script/ stop


sudo chmod 744 /etc/systemd/system/ms.service

sudo systemctl enable ms.service

(this should give you "Created symlink from /etc/systemd/system/ to /etc/systemd/system/ms.service." )

How to troubleshoot?

systemctl start ms
systemctl status ms
journalctl -u ms

Saturday, May 26, 2018

Eclipse says server workload limit exceeded, please try later

I always enable error reporting in Eclipse, although I am pretty confident that in the House of Chaos that Eclipse must be, nobody is seriously looking at them - they are too many, there is no sign of any intelligence behind the product, etc.

Lately I am curiously getting ALWAYS this message "Eclipse says server workload limit exceeded, please try later"

Personally I consider it a good sign, it might mean that Eclipse is finally reaching a point of collapse, and that we shall be soon freed from his ominous presence, in favor of more decent product like IntelliJ or Netbeans.

Curiously, Eclipse rhymes with Collapse

Spring Boot 2 and Primefaces 6..... JoinFaces and

Their started app is admin is persapiens/123)

git clone
cd joinfaces-maven-jar-example
mvn clean install
(there are some test errors.... ignore them)

java -jar target/joinfaces-example-3.2.1-SNAPSHOT.jar


Unfortunately they use a parent Maven you can use only 1 parent pom (another reason to HATE MAVEN who is BROKEN BY DESIGN).... so if your application is already based on a parent pom, you are royally screwed.

Problem is, when I generate a project from Spring Boot Starters, the parent pom is:

 <relativePath/> <!-- lookup parent from repository -->

while using joinfaces it's

        <relativePath/> <!-- lookup parent from repository -->

you can clearly see from that joinfaces includes all these dependencies which entail also a parent:

 <!-- lookup parent from repository -->

No doubt, they have sorted out for you a massive dependency tree, saving a lot of time.

When I see such massive dependency tree, the question arises, why the Java world in 2018 is so ridiculously complicated and only getting worse. Please stop proliferation, focus on consolidation.

Friday, May 25, 2018

Nginx with LUA and Java handlers

sudo yum install epel-release
sudo yum install nginx
sudo systemctl start nginx

nginx should now be running, enter http://localhost to test

documents in /usr/share/nginx/html

configuration in /etc/nginx/nginx.conf

logs in /var/log/nginx/access.log

sudo ausearch -c 'nginx' --raw | audit2allow -M my-nginx
sudo semodule -i my-nginx.pp
#disable selinux
setenforce 0

nginx with Docker
docker pull nginx
docker run --name nginx -d -p 10080:80 nginx

Setup a reverse proxy:
sudo vi /etc/nginx/conf.d/mynexus.conf

    listen 18081;
    location / {
        proxy_pass "http://localhost:8081";

systemctl stop nginx
systemctl start nginx

you can now point your maven mirror in settings.xml to point to 18081 and intercept all requests to Nexus

How to embed a Java handler in the loop ?

Handlers in Java implement this interface NginxJavaRingHandler

Ref: quick quide to configure

nginx as reverse proxy

Thursday, May 24, 2018

Testcontainers, using Docker containers in JUnit tests

Junit sucks, use at least 5.0 or better switch to TestNG (see for comparison)

To keep it really minimalistic, I have created a Maven Java project:

<project xmlns=""


and copied this example

package org.pierre.testcontainer;

import org.junit.Rule;
import org.junit.Test;
import org.openqa.selenium.WebElement;
import org.openqa.selenium.remote.DesiredCapabilities;
import org.openqa.selenium.remote.RemoteWebDriver;
import org.testcontainers.containers.BrowserWebDriverContainer;


import static org.rnorth.visibleassertions.VisibleAssertions.assertTrue;
import static org.testcontainers.containers.BrowserWebDriverContainer.VncRecordingMode.RECORD_ALL;

public class SeleniumContainerTest {

    public BrowserWebDriverContainer chrome = new BrowserWebDriverContainer()
                                                    .withRecordingMode(RECORD_ALL, new File("target"));

    public void simplePlainSeleniumTest() {
        RemoteWebDriver driver = chrome.getWebDriver();

        WebElement searchInput = driver.findElementByName("search");

        searchInput.sendKeys("Rick Astley");

        WebElement otherPage = driver.findElementByLinkText("Rickrolling");;

        boolean expectedTextFound = driver.findElementsByCssSelector("p")
                .anyMatch(element -> element.getText().contains("meme"));

        assertTrue("The word 'meme' is found on a page about rickrolling", expectedTextFound);


The first time it failed with a SocketTimeoutException.... the second time it succeeded... I guess simply the Docker container was taking too much time to start.

If I do "docker images" I see richnorth/vnc-recorder and selenium/standalone-chrome-debug. If I do "docker ps -a" I see no trace of containers, probably they are removed at the end of test.

It looks really interesting! Convenient way to prepare a test environment in a fully automated way.

Wednesday, May 23, 2018

sudo systemctl hibernate

on Centos, I was trying to hibernate my machine:

sudo systemctl hibernate

A dependency job for failed. See 'journalctl -xe' for details.

journalctl -xe

Failed to write mode to /sys/power/disk: Operation not permitted

I removed "safe boot" option in the BIOS settings, and now I am able to hibernate! Amazing!

See also this, maybe "suspend" is cheaper safer and faster than hibernate...

Scala, sbt and Nexus Repositories

first, install sbt:

curl > bintray-sbt-rpm.repo
sudo mv bintray-sbt-rpm.repo /etc/yum.repos.d/
sudo yum install sbt
sbt --version

Then in Nexus create a Maven Proxy repository "ivy-releases" proxying, plus a repository "sbt-plugin-releases" proxying . Plus a group ivy with URL http://localhost:8181/repository/ivy/ and grouping ivy-releases + sbt-plugin-releases.


vi ~/.sbt/repositories

my-ivy-proxy-releases: http://localhost:8181/repository/ivy/ , [organization]/[module]/(scala_[scalaVersion]/)(sbt_[sbtVersion]/)[revision]/[type]s/[artifact](-[classifier]).[ext]
my-maven-proxy-releases: http://localhost:8181/repository/maven-public/

git clone
cd scalania
sbt compile

rm -rf target
rm -rf /home/centos/.ivy2/cache

you should see that lot of stuff is pulled in your maven-central proxy repo and in your

Without Nexus you get this:

[centos@localhost scalania]$ sbt compile
[info] Loading project definition from /home/centos/gitclones/scalania/project
[info] Updating {file:/home/centos/gitclones/scalania/project/}scalania-build...
[info] Resolving org.fusesource.jansi#jansi;1.4 ...
[info] downloading http://localhost:8181/repository/maven-public/org/scala-lang/scala-compiler/2.10.4/scala-compiler-2.10.4.jar ...
[info]  [SUCCESSFUL ] org.scala-lang#scala-compiler;2.10.4!scala-compiler.jar (195ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scoverage#sbt-coveralls;1.0.0.BETA1!sbt-coveralls.jar (1957ms)
[info] downloading ...
[info]  [SUCCESSFUL ] de.johoop#jacoco4sbt;2.1.6!jacoco4sbt.jar (1811ms)
[info] downloading ...
[info]  [SUCCESSFUL ] com.typesafe.sbteclipse#sbteclipse-plugin;2.5.0!sbteclipse-plugin.jar (1791ms)
[info] downloading ...
[info]  [SUCCESSFUL ] com.typesafe.sbt#sbt-scalariform;1.3.0!sbt-scalariform.jar (2161ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scalastyle/scalastyle-sbt-plugin_2.10_0.13/0.6.0/scalastyle-sbt-plugin-0.6.0.jar ...
[info]  [SUCCESSFUL ] org.scalastyle#scalastyle-sbt-plugin;0.6.0!scalastyle-sbt-plugin.jar (140ms)
[info] downloading ...
[info]  [SUCCESSFUL ] com.sksamuel.scapegoat#sbt-scapegoat;0.94.6!sbt-scapegoat.jar (3186ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scoverage#sbt-scoverage;1.0.4!sbt-scoverage.jar (2122ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scala-lang/scala-library/2.10.4/scala-library-2.10.4.jar ...
[info]  [SUCCESSFUL ] org.scala-lang#scala-library;2.10.4!scala-library.jar (201ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scala-lang/scala-reflect/2.10.4/scala-reflect-2.10.4.jar ...
[info]  [SUCCESSFUL ] org.scala-lang#scala-reflect;2.10.4!scala-reflect.jar (141ms)
[info] downloading http://localhost:8181/repository/maven-public/com/fasterxml/jackson/core/jackson-core/2.4.2/jackson-core-2.4.2.jar ...
[info]  [SUCCESSFUL ] com.fasterxml.jackson.core#jackson-core;2.4.2!jackson-core.jar(bundle) (88ms)
[info] downloading http://localhost:8181/repository/maven-public/com/fasterxml/jackson/module/jackson-module-scala_2.10/2.4.2/jackson-module-scala_2.10-2.4.2.jar ...
[info]  [SUCCESSFUL ] com.fasterxml.jackson.module#jackson-module-scala_2.10;2.4.2!jackson-module-scala_2.10.jar(bundle) (235ms)
[info] downloading http://localhost:8181/repository/maven-public/org/eclipse/jgit/org.eclipse.jgit/ ...
[info]  [SUCCESSFUL ] org.eclipse.jgit#org.eclipse.jgit;!org.eclipse.jgit.jar (112ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scalaj/scalaj-http_2.10/0.3.16/scalaj-http_2.10-0.3.16.jar ...
[info]  [SUCCESSFUL ] org.scalaj#scalaj-http_2.10;0.3.16!scalaj-http_2.10.jar (126ms)
[info] downloading http://localhost:8181/repository/maven-public/com/fasterxml/jackson/core/jackson-annotations/2.4.2/jackson-annotations-2.4.2.jar ...
[info]  [SUCCESSFUL ] com.fasterxml.jackson.core#jackson-annotations;2.4.2!jackson-annotations.jar(bundle) (97ms)
[info] downloading http://localhost:8181/repository/maven-public/com/fasterxml/jackson/core/jackson-databind/2.4.2/jackson-databind-2.4.2.jar ...
[info]  [SUCCESSFUL ] com.fasterxml.jackson.core#jackson-databind;2.4.2!jackson-databind.jar(bundle) (92ms)
[info] downloading http://localhost:8181/repository/maven-public/com/thoughtworks/paranamer/paranamer/2.6/paranamer-2.6.jar ...
[info]  [SUCCESSFUL ] com.thoughtworks.paranamer#paranamer;2.6!paranamer.jar (110ms)
[info] downloading http://localhost:8181/repository/maven-public/com/google/code/findbugs/jsr305/2.0.1/jsr305-2.0.1.jar ...
[info]  [SUCCESSFUL ];2.0.1!jsr305.jar (99ms)
[info] downloading http://localhost:8181/repository/maven-public/com/google/guava/guava/15.0/guava-15.0.jar ...
[info]  [SUCCESSFUL ];15.0!guava.jar(bundle) (100ms)
[info] downloading http://localhost:8181/repository/maven-public/com/jcraft/jsch/0.1.50/jsch-0.1.50.jar ...
[info]  [SUCCESSFUL ] com.jcraft#jsch;0.1.50!jsch.jar (111ms)
[info] downloading http://localhost:8181/repository/maven-public/com/googlecode/javaewah/JavaEWAH/0.7.9/JavaEWAH-0.7.9.jar ...
[info]  [SUCCESSFUL ] com.googlecode.javaewah#JavaEWAH;0.7.9!JavaEWAH.jar(bundle) (76ms)
[info] downloading http://localhost:8181/repository/maven-public/org/apache/httpcomponents/httpclient/4.1.3/httpclient-4.1.3.jar ...
[info]  [SUCCESSFUL ] org.apache.httpcomponents#httpclient;4.1.3!httpclient.jar (144ms)
[info] downloading http://localhost:8181/repository/maven-public/org/apache/httpcomponents/httpcore/4.1.4/httpcore-4.1.4.jar ...
[info]  [SUCCESSFUL ] org.apache.httpcomponents#httpcore;4.1.4!httpcore.jar (55ms)
[info] downloading http://localhost:8181/repository/maven-public/commons-logging/commons-logging/1.1.1/commons-logging-1.1.1.jar ...
[info]  [SUCCESSFUL ] commons-logging#commons-logging;1.1.1!commons-logging.jar (97ms)
[info] downloading http://localhost:8181/repository/maven-public/commons-codec/commons-codec/1.4/commons-codec-1.4.jar ...
[info]  [SUCCESSFUL ] commons-codec#commons-codec;1.4!commons-codec.jar (121ms)
[info] downloading http://localhost:8181/repository/maven-public/org/jacoco/org.jacoco.core/ ...
[info]  [SUCCESSFUL ] org.jacoco#org.jacoco.core;!org.jacoco.core.jar (89ms)
[info] downloading http://localhost:8181/repository/maven-public/org/jacoco/ ...
[info]  [SUCCESSFUL ];! (148ms)
[info] downloading http://localhost:8181/repository/maven-public/org/ow2/asm/asm-debug-all/5.0.1/asm-debug-all-5.0.1.jar ...
[info]  [SUCCESSFUL ] org.ow2.asm#asm-debug-all;5.0.1!asm-debug-all.jar (120ms)
[info] downloading ...
[info]  [SUCCESSFUL ] com.typesafe.sbteclipse#sbteclipse-core;2.5.0!sbteclipse-core.jar (3240ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scalaz/scalaz-core_2.10/7.0.2/scalaz-core_2.10-7.0.2.jar ...
[info]  [SUCCESSFUL ] org.scalaz#scalaz-core_2.10;7.0.2!scalaz-core_2.10.jar(bundle) (167ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scalaz/scalaz-effect_2.10/7.0.2/scalaz-effect_2.10-7.0.2.jar ...
[info]  [SUCCESSFUL ] org.scalaz#scalaz-effect_2.10;7.0.2!scalaz-effect_2.10.jar(bundle) (81ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scalariform/scalariform_2.10/0.1.4/scalariform_2.10-0.1.4.jar ...
[info]  [SUCCESSFUL ] org.scalariform#scalariform_2.10;0.1.4!scalariform_2.10.jar (135ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scalastyle/scalastyle_2.10/0.6.0/scalastyle_2.10-0.6.0.jar ...
[info]  [SUCCESSFUL ] org.scalastyle#scalastyle_2.10;0.6.0!scalastyle_2.10.jar (108ms)
[info] downloading http://localhost:8181/repository/maven-public/com/danieltrinh/scalariform_2.10/0.1.5/scalariform_2.10-0.1.5.jar ...
[info]  [SUCCESSFUL ] com.danieltrinh#scalariform_2.10;0.1.5!scalariform_2.10.jar (100ms)
[info] downloading http://localhost:8181/repository/maven-public/com/typesafe/config/1.2.0/config-1.2.0.jar ...
[info]  [SUCCESSFUL ] com.typesafe#config;1.2.0!config.jar(bundle) (144ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scoverage/scalac-scoverage-plugin_2.10/1.0.4/scalac-scoverage-plugin_2.10-1.0.4.jar ...
[info]  [SUCCESSFUL ] org.scoverage#scalac-scoverage-plugin_2.10;1.0.4!scalac-scoverage-plugin_2.10.jar (110ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#sbt;0.13.8!sbt.jar (1693ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#main;0.13.8!main.jar (2573ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#compiler-interface;0.13.8!compiler-interface-bin.jar (1803ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#compiler-interface;0.13.8!compiler-interface-src.jar (2961ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#precompiled-2_8_2;0.13.8!compiler-interface-bin.jar (2133ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#precompiled-2_9_2;0.13.8!compiler-interface-bin.jar (1859ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#precompiled-2_9_3;0.13.8!compiler-interface-bin.jar (1849ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#actions;0.13.8!actions.jar (2064ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#main-settings;0.13.8!main-settings.jar (1987ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#interface;0.13.8!interface.jar (1858ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#io;0.13.8!io.jar (1987ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#ivy;0.13.8!ivy.jar (2481ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#launcher-interface;0.13.8!launcher-interface.jar (1701ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#logging;0.13.8!logging.jar (1799ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#logic;0.13.8!logic.jar (1736ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#process;0.13.8!process.jar (1919ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#run;0.13.8!run.jar (1817ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#command;0.13.8!command.jar (1886ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#classpath;0.13.8!classpath.jar (12828ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#completion;0.13.8!completion.jar (1870ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#api;0.13.8!api.jar (1822ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#compiler-integration;0.13.8!compiler-integration.jar (1900ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#compiler-ivy-integration;0.13.8!compiler-ivy-integration.jar (1688ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#relation;0.13.8!relation.jar (1826ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#task-system;0.13.8!task-system.jar (1798ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#tasks;0.13.8!tasks.jar (1844ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#tracking;0.13.8!tracking.jar (1718ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#testing;0.13.8!testing.jar (1865ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#control;0.13.8!control.jar (1842ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#collections;0.13.8!collections.jar (2043ms)
[info] downloading http://localhost:8181/repository/maven-public/jline/jline/2.11/jline-2.11.jar ...
[info]  [SUCCESSFUL ] jline#jline;2.11!jline.jar (133ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#incremental-compiler;0.13.8!incremental-compiler.jar (1877ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#compile;0.13.8!compile.jar (1773ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#persist;0.13.8!persist.jar (1813ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#classfile;0.13.8!classfile.jar (1755ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-tools.sbinary#sbinary_2.10;0.4.2!sbinary_2.10.jar (2288ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#cross;0.13.8!cross.jar (2532ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt.ivy#ivy;2.3.0-sbt-fccfbd44c9f64523b61398a0155784dcbaeae28f!ivy.jar (2079ms)
[info] downloading http://localhost:8181/repository/maven-public/com/jcraft/jsch/0.1.46/jsch-0.1.46.jar ...
[info]  [SUCCESSFUL ] com.jcraft#jsch;0.1.46!jsch.jar (134ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#serialization_2.10;0.1.1!serialization_2.10.jar (1903ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scala-lang/modules/scala-pickling_2.10/0.10.0/scala-pickling_2.10-0.10.0.jar ...
[info]  [SUCCESSFUL ] org.scala-lang.modules#scala-pickling_2.10;0.10.0!scala-pickling_2.10.jar (102ms)
[info] downloading http://localhost:8181/repository/maven-public/org/json4s/json4s-core_2.10/3.2.10/json4s-core_2.10-3.2.10.jar ...
[info]  [SUCCESSFUL ] org.json4s#json4s-core_2.10;3.2.10!json4s-core_2.10.jar (106ms)
[info] downloading http://localhost:8181/repository/maven-public/org/spire-math/jawn-parser_2.10/0.6.0/jawn-parser_2.10-0.6.0.jar ...
[info]  [SUCCESSFUL ] org.spire-math#jawn-parser_2.10;0.6.0!jawn-parser_2.10.jar (119ms)
[info] downloading http://localhost:8181/repository/maven-public/org/spire-math/json4s-support_2.10/0.6.0/json4s-support_2.10-0.6.0.jar ...
[info]  [SUCCESSFUL ] org.spire-math#json4s-support_2.10;0.6.0!json4s-support_2.10.jar (139ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scalamacros/quasiquotes_2.10/2.0.1/quasiquotes_2.10-2.0.1.jar ...
[info]  [SUCCESSFUL ] org.scalamacros#quasiquotes_2.10;2.0.1!quasiquotes_2.10.jar (131ms)
[info] downloading http://localhost:8181/repository/maven-public/org/json4s/json4s-ast_2.10/3.2.10/json4s-ast_2.10-3.2.10.jar ...
[info]  [SUCCESSFUL ] org.json4s#json4s-ast_2.10;3.2.10!json4s-ast_2.10.jar (85ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#cache;0.13.8!cache.jar (1939ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#test-agent;0.13.8!test-agent.jar (1748ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scala-sbt/test-interface/1.0/test-interface-1.0.jar ...
[info]  [SUCCESSFUL ] org.scala-sbt#test-interface;1.0!test-interface.jar (153ms)
[info] downloading ...
[info]  [SUCCESSFUL ] org.scala-sbt#apply-macro;0.13.8!apply-macro.jar (1845ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scala-lang/jline/2.10.4/jline-2.10.4.jar ...
[info]  [SUCCESSFUL ] org.scala-lang#jline;2.10.4!jline.jar (100ms)
[info] downloading http://localhost:8181/repository/maven-public/org/fusesource/jansi/jansi/1.4/jansi-1.4.jar ...
[info]  [SUCCESSFUL ] org.fusesource.jansi#jansi;1.4!jansi.jar (125ms)
[info] Done updating.
[info] Compiling 2 Scala sources to /home/centos/gitclones/scalania/project/target/scala-2.10/sbt-0.13/classes...
[info] Set current project to scalania (in build file:/home/centos/gitclones/scalania/)
[info] Updating {file:/home/centos/gitclones/scalania/}scalania...
[info] Updating {file:/home/centos/gitclones/scalania/}exercises...
[info] Resolving org.scala-lang#scala-library;2.11.6 ...
[info] Formatting 45 Scala sources {file:/home/centos/gitclones/scalania/}exercises(compile) ...
[info] Resolving org.sonatype.oss#oss-parent;7 ...
[info] downloading http://localhost:8181/repository/maven-public/org/scala-lang/scala-library/2.11.6/scala-library-2.11.6.jar ...
[info]  [SUCCESSFUL ] org.scala-lang#scala-library;2.11.6!scala-library.jar (146ms)
[info] downloading http://localhost:8181/repository/maven-public/com/sksamuel/scapegoat/scalac-scapegoat-plugin_2.11/0.94.6/scalac-scapegoat-plugin_2.11-0.94.6.jar ...
[info]  [SUCCESSFUL ] com.sksamuel.scapegoat#scalac-scapegoat-plugin_2.11;0.94.6!scalac-scapegoat-plugin_2.11.jar (217ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scala-lang/scala-library/2.11.4/scala-library-2.11.4.jar ...
[info]  [SUCCESSFUL ] org.scala-lang#scala-library;2.11.4!scala-library.jar (151ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scala-lang/scala-reflect/2.11.4/scala-reflect-2.11.4.jar ...
[info]  [SUCCESSFUL ] org.scala-lang#scala-reflect;2.11.4!scala-reflect.jar (116ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scala-lang/modules/scala-xml_2.11/1.0.2/scala-xml_2.11-1.0.2.jar ...
[info]  [SUCCESSFUL ] org.scala-lang.modules#scala-xml_2.11;1.0.2!scala-xml_2.11.jar(bundle) (127ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scaldi/scaldi_2.11/0.4/scaldi_2.11-0.4.jar ...
[info]  [SUCCESSFUL ] org.scaldi#scaldi_2.11;0.4!scaldi_2.11.jar (103ms)
[info] downloading http://localhost:8181/repository/maven-public/org/specs2/specs2-core_2.11/2.4.5/specs2-core_2.11-2.4.5.jar ...
[info]  [SUCCESSFUL ] org.specs2#specs2-core_2.11;2.4.5!specs2-core_2.11.jar (239ms)
[info] downloading http://localhost:8181/repository/maven-public/org/specs2/specs2-junit_2.11/2.4.5/specs2-junit_2.11-2.4.5.jar ...
[info]  [SUCCESSFUL ] org.specs2#specs2-junit_2.11;2.4.5!specs2-junit_2.11.jar (129ms)
[info] downloading http://localhost:8181/repository/maven-public/org/specs2/specs2-scalacheck_2.11/2.4.5/specs2-scalacheck_2.11-2.4.5.jar ...
[info]  [SUCCESSFUL ] org.specs2#specs2-scalacheck_2.11;2.4.5!specs2-scalacheck_2.11.jar (214ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scalatest/scalatest_2.11/2.2.4/scalatest_2.11-2.2.4.jar ...
[info]  [SUCCESSFUL ] org.scalatest#scalatest_2.11;2.2.4!scalatest_2.11.jar(bundle) (203ms)
[info] downloading http://localhost:8181/repository/maven-public/org/specs2/specs2-matcher_2.11/2.4.5/specs2-matcher_2.11-2.4.5.jar ...
[info]  [SUCCESSFUL ] org.specs2#specs2-matcher_2.11;2.4.5!specs2-matcher_2.11.jar (225ms)
[info] downloading http://localhost:8181/repository/maven-public/org/specs2/specs2-common_2.11/2.4.5/specs2-common_2.11-2.4.5.jar ...
[info]  [SUCCESSFUL ] org.specs2#specs2-common_2.11;2.4.5!specs2-common_2.11.jar (131ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scalaz/scalaz-core_2.11/7.1.0/scalaz-core_2.11-7.1.0.jar ...
[info]  [SUCCESSFUL ] org.scalaz#scalaz-core_2.11;7.1.0!scalaz-core_2.11.jar(bundle) (133ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scalaz/scalaz-concurrent_2.11/7.1.0/scalaz-concurrent_2.11-7.1.0.jar ...
[info]  [SUCCESSFUL ] org.scalaz#scalaz-concurrent_2.11;7.1.0!scalaz-concurrent_2.11.jar(bundle) (68ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scala-lang/modules/scala-parser-combinators_2.11/1.0.2/scala-parser-combinators_2.11-1.0.2.jar ...
[info]  [SUCCESSFUL ] org.scala-lang.modules#scala-parser-combinators_2.11;1.0.2!scala-parser-combinators_2.11.jar(bundle) (101ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scalaz/scalaz-effect_2.11/7.1.0/scalaz-effect_2.11-7.1.0.jar ...
[info]  [SUCCESSFUL ] org.scalaz#scalaz-effect_2.11;7.1.0!scalaz-effect_2.11.jar(bundle) (371ms)
[info] downloading http://localhost:8181/repository/maven-public/junit/junit/4.11/junit-4.11.jar ...
[info]  [SUCCESSFUL ] junit#junit;4.11!junit.jar (100ms)
[info] downloading http://localhost:8181/repository/maven-public/org/hamcrest/hamcrest-core/1.3/hamcrest-core-1.3.jar ...
[info]  [SUCCESSFUL ] org.hamcrest#hamcrest-core;1.3!hamcrest-core.jar (136ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scalacheck/scalacheck_2.11/1.11.3/scalacheck_2.11-1.11.3.jar ...
[info]  [SUCCESSFUL ] org.scalacheck#scalacheck_2.11;1.11.3!scalacheck_2.11.jar (100ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scoverage/scalac-scoverage-runtime_2.11/1.0.4/scalac-scoverage-runtime_2.11-1.0.4.jar ...
[info]  [SUCCESSFUL ] org.scoverage#scalac-scoverage-runtime_2.11;1.0.4!scalac-scoverage-runtime_2.11.jar (98ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scoverage/scalac-scoverage-plugin_2.11/1.0.4/scalac-scoverage-plugin_2.11-1.0.4.jar ...
[info]  [SUCCESSFUL ] org.scoverage#scalac-scoverage-plugin_2.11;1.0.4!scalac-scoverage-plugin_2.11.jar (132ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scala-lang/modules/scala-xml_2.11/1.0.1/scala-xml_2.11-1.0.1.jar ...
[info]  [SUCCESSFUL ] org.scala-lang.modules#scala-xml_2.11;1.0.1!scala-xml_2.11.jar(bundle) (102ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scala-lang/scala-compiler/2.11.6/scala-compiler-2.11.6.jar ...
[info]  [SUCCESSFUL ] org.scala-lang#scala-compiler;2.11.6!scala-compiler.jar (206ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scala-lang/scala-reflect/2.11.6/scala-reflect-2.11.6.jar ...
[info]  [SUCCESSFUL ] org.scala-lang#scala-reflect;2.11.6!scala-reflect.jar (72ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scala-lang/modules/scala-xml_2.11/1.0.3/scala-xml_2.11-1.0.3.jar ...
[info]  [SUCCESSFUL ] org.scala-lang.modules#scala-xml_2.11;1.0.3!scala-xml_2.11.jar(bundle) (102ms)
[info] downloading http://localhost:8181/repository/maven-public/org/scala-lang/modules/scala-parser-combinators_2.11/1.0.3/scala-parser-combinators_2.11-1.0.3.jar ...
[info]  [SUCCESSFUL ] org.scala-lang.modules#scala-parser-combinators_2.11;1.0.3!scala-parser-combinators_2.11.jar(bundle) (115ms)
[info] downloading http://localhost:8181/repository/maven-public/jline/jline/2.12.1/jline-2.12.1.jar ...
[info]  [SUCCESSFUL ] jline#jline;2.12.1!jline.jar (81ms)
[info] Done updating.
[info] Resolving org.scala-lang#scala-reflect;2.11.4 ...
[info] [scapegoat] setting output dir to [/home/centos/gitclones/scalania/target/scala-2.11/scapegoat-report]
[info] Resolving; ...
[info] downloading http://localhost:8181/repository/maven-public/org/jacoco/org.jacoco.agent/ ...
[info]  [SUCCESSFUL ] org.jacoco#org.jacoco.agent;!org.jacoco.agent.jar (64ms)
[info] Done updating.
[info] [scapegoat] setting output dir to [/home/centos/gitclones/scalania/exercises/target/scala-2.11/scapegoat-report]
[info] [scapegoat] disabled inspections: X
[info] [scapegoat] enabled inspections: ArraysToString
[info] [scapegoat] ignored file patterns: X
[info] Compiling 45 Scala sources to /home/centos/gitclones/scalania/exercises/target/scala-2.11/classes...
[info] 'compiler-interface' not yet compiled for Scala 2.11.6. Compiling...
[info]   Compilation completed in 9.394 s

but with Nexus proxy I still get some unresolved dependencies

[warn]  ::::::::::::::::::::::::::::::::::::::::::::::
[warn]  ::          UNRESOLVED DEPENDENCIES         ::
[warn]  ::::::::::::::::::::::::::::::::::::::::::::::
[warn]  :: org.scoverage#sbt-coveralls;1.0.0.BETA1: not found
[warn]  :: de.johoop#jacoco4sbt;2.1.6: not found
[warn]  :: com.typesafe.sbteclipse#sbteclipse-plugin;2.5.0: not found
[warn]  :: com.typesafe.sbt#sbt-scalariform;1.3.0: not found
[warn]  :: com.sksamuel.scapegoat#sbt-scapegoat;0.94.6: not found
[warn]  :: org.scoverage#sbt-scoverage;1.0.4: not found
[warn]  :: org.scala-sbt#sbt;0.13.8: not found
[warn]  ::::::::::::::::::::::::::::::::::::::::::::::

no clue what is wrong....

On the other hand, if I follow this foo-build example

mkdir foo-build
cd foo-build
touch build.sbt
sbt compile

all works fine!

Monday, May 21, 2018

Spring Cloud, getting started

generate your starter zip from :

unzip it
add import; and @EnableConfigServer to ConfigApplication

mkdir application-config
cd application-config
git init

mvn spring-boot:run

git clone

Spring Integration Sucks

Here the whole tutorials site to git clone

If you use Eclipse, better to "git clone" separately and then Import, Existing Maven Project, and give the tutorials folder. Importing from Git seems not to work (Eclipse SUCKS, it's the most pathetic IDE in centuries).

This is the one interesting us

All is explained here (BasicIntegrationConfig in the github project is FileCopyConfig)

My first impression is of an extreme complication and non elegant API design. You have to wade through a ton of annotations, abstractions, base classes, non-fluent APIs, just to copy a file from A to B. Camel seems to me much more essential - maybe because Camel was designed with Integration as primary focus, while Spring Integration just add some Integration functionality to the hyper-complex bloated Spring monster.

Look at all the import you need to just copy a file every 1 second:

import org.springframework.context.annotation.AnnotationConfigApplicationContext;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.integration.annotation.InboundChannelAdapter;
import org.springframework.integration.annotation.Poller;
import org.springframework.integration.annotation.ServiceActivator;
import org.springframework.integration.config.EnableIntegration;
import org.springframework.integration.core.MessageSource;
import org.springframework.integration.file.FileReadingMessageSource;
import org.springframework.integration.file.FileWritingMessageHandler;
import org.springframework.integration.file.filters.SimplePatternFileListFilter;
import org.springframework.messaging.MessageChannel;
import org.springframework.messaging.MessageHandler;

simply ridiculous.

Saturday, May 19, 2018

Jenkins Pipeline and OWASP dependency check

a) in Jenkins, configure a M3 instance in your "Global Tools" configuration section

b) make sure you have installed the OWASP dependency check plugin

c) create a Pipeline Jenkins project, name "owasptest", and simply paste this pipeline (it's a copy from the sample built-in "github and maven" pipeline):

node {
   def mvnHome
   stage('Preparation') { // for display purposes
      // Get some code from a GitHub repository
      git ''
      // Get the Maven tool.
      // ** NOTE: This 'M3' Maven tool must be configured
      // **       in the global configuration.           
      mvnHome = tool 'M3'
   stage('Build') {
      // Run the maven build
      if (isUnix()) {
         sh "'${mvnHome}/bin/mvn' -Dmaven.test.failure.ignore clean package"
      } else {
         bat(/"${mvnHome}\bin\mvn" -Dmaven.test.failure.ignore clean package/)
   stage('Results') {
      junit '**/target/surefire-reports/TEST-*.xml'
      archive 'target/*.jar'
     stage("Dependency Check") {
    dependencyCheckAnalyzer datadir: 'dependency-check-data', isFailOnErrorDisabled: true, hintsFile: '', includeCsvReports: false, includeHtmlReports: false, includeJsonReports: false, isAutoupdateDisabled: false, outdir: '', scanpath: '', skipOnScmChange: false, skipOnUpstreamChange: false, suppressionFile: '', zipExtensions: ''

    dependencyCheckPublisher canComputeNew: false, defaultEncoding: '', healthy: '', pattern: '', unHealthy: ''

    archiveArtifacts allowEmptyArchive: true, artifacts: '**/dependency-check-report.xml', onlyIfSuccessful: true

and leave "Use Groovy Sandbox" checked

Building jar: /home/centos/.jenkins/workspace/owasptest/target/simple-maven-project-with-tests-1.0-SNAPSHOT.jar

[DependencyCheck] Executing Dependency-Check with the following options:
[DependencyCheck] -name = owasptest
[DependencyCheck] -scanPath = /home/centos/.jenkins/workspace/owasptest
[DependencyCheck] -outputDirectory = /home/centos/.jenkins/workspace/owasptest
[DependencyCheck] -dataDirectory = /home/centos/.jenkins/workspace/owasptest/dependency-check-data
[DependencyCheck] -dataMirroringType = none
[DependencyCheck] -isQuickQueryTimestampEnabled = true
[DependencyCheck] -jarAnalyzerEnabled = true
[DependencyCheck] -nodePackageAnalyzerEnabled = true
[DependencyCheck] -nspAnalyzerEnabled = true
[DependencyCheck] -composerLockAnalyzerEnabled = true
[DependencyCheck] -pythonDistributionAnalyzerEnabled = true
[DependencyCheck] -pythonPackageAnalyzerEnabled = true
[DependencyCheck] -rubyBundlerAuditAnalyzerEnabled = false
[DependencyCheck] -rubyGemAnalyzerEnabled = true
[DependencyCheck] -cocoaPodsAnalyzerEnabled = true
[DependencyCheck] -swiftPackageManagerAnalyzerEnabled = true
[DependencyCheck] -archiveAnalyzerEnabled = true
[DependencyCheck] -assemblyAnalyzerEnabled = true
[DependencyCheck] -centralAnalyzerEnabled = true
[DependencyCheck] -nuspecAnalyzerEnabled = true
[DependencyCheck] -nexusAnalyzerEnabled = false
[DependencyCheck] -autoconfAnalyzerEnabled = true
[DependencyCheck] -cmakeAnalyzerEnabled = true
[DependencyCheck] -opensslAnalyzerEnabled = true
[DependencyCheck] -showEvidence = true
[DependencyCheck] -formats = XML
[DependencyCheck] -autoUpdate = true
[DependencyCheck] -updateOnly = false
[DependencyCheck] Data directory created
[DependencyCheck] Scanning: /home/centos/.jenkins/workspace/owasptest
[DependencyCheck] Analyzing Dependencies

[Pipeline] dependencyCheckPublisher

[DependencyCheck] Collecting Dependency-Check analysis files...
[DependencyCheck] Searching for all files in /home/centos/.jenkins/workspace/owasptest that match the pattern **/dependency-check-report.xml
[DependencyCheck] Parsing 1 file in /home/centos/.jenkins/workspace/owasptest
[DependencyCheck] Successfully parsed file /home/centos/.jenkins/workspace/owasptest/dependency-check-report.xml with 0 unique warnings and 0 duplicates.

At this point you can view the report in http://localhost:9090/job/owasptest/lastSuccessfulBuild/artifact/dependency-check-report.xml

To get interesting result you should use

At the end, a monster DB (330 MB) is built at /home/centos/.jenkins/workspace/owasptest/dependency-check-data/dc.h2.db
To learn mode about this DB, read here
and here


Friday, May 18, 2018

JSON to Java, Java to JSON

I am extremely lazy, and I want to model JSON, or Java, but not both at the same time.

In case you want to write JSON first, and then generate Java:

git clone
cd JsonToJava
mvn package
java -cp target/classes/:lib/*:import/ com.astav.jsontojava.JsonToJava sample.json out test TestOutput regex-sample.json false

  "rules": [
  {"gav":"org.codehaus.plexus:plexus-utils:3.0" , "allow":"false"},
  {"gav":"org.codehaus.plexus:plexus-utils:2.8" , "allow":"true"}

I run this:

export CLASSPATH=target/classes/:lib/*:import/
java com.astav.jsontojava.JsonToJava rules.json out test TestOutput regex-sample.json false

this is what it generates:
package test;

import org.codehaus.jackson.annotate.JsonProperty;
import java.util.*;

public class RulesEntry {
 @JsonProperty("allow") private Boolean allow;
 @JsonProperty("gav") private String gav;
package test;

import org.codehaus.jackson.annotate.JsonProperty;
import java.util.*;

public class TestOutput {
 @JsonProperty("rules") private List rules;

An alternative is , for the same input JSON I get a somehow less accurate modelling:

package com.example;

import java.util.HashMap;
import java.util.Map;
import com.fasterxml.jackson.annotation.JsonAnyGetter;
import com.fasterxml.jackson.annotation.JsonAnySetter;
import com.fasterxml.jackson.annotation.JsonIgnore;
import com.fasterxml.jackson.annotation.JsonInclude;
import com.fasterxml.jackson.annotation.JsonProperty;
import com.fasterxml.jackson.annotation.JsonPropertyOrder;

public class Rule {

private String gav;
private String allow;
private Map additionalProperties = new HashMap();

public String getGav() {
return gav;

public void setGav(String gav) {
this.gav = gav;

public String getAllow() {
return allow;

public void setAllow(String allow) {
this.allow = allow;

public Map getAdditionalProperties() {
return this.additionalProperties;

public void setAdditionalProperty(String name, Object value) {
this.additionalProperties.put(name, value);


package com.example;

import java.util.HashMap;
import java.util.List;
import java.util.Map;
import com.fasterxml.jackson.annotation.JsonAnyGetter;
import com.fasterxml.jackson.annotation.JsonAnySetter;
import com.fasterxml.jackson.annotation.JsonIgnore;
import com.fasterxml.jackson.annotation.JsonInclude;
import com.fasterxml.jackson.annotation.JsonProperty;
import com.fasterxml.jackson.annotation.JsonPropertyOrder;

public class Rules {

private List rules = null;
private Map additionalProperties = new HashMap();

public List getRules() {
return rules;

public void setRules(List rules) {
this.rules = rules;

public Map getAdditionalProperties() {
return this.additionalProperties;

public void setAdditionalProperty(String name, Object value) {
this.additionalProperties.put(name, value);


To model Java first, then JSON:

import java.util.ArrayList;
import java.util.List;

import org.junit.Test;

import com.fasterxml.jackson.databind.ObjectMapper;

public class RulesTest {

 public void listToJSON() throws Exception {
  List<Rules> list = new ArrayList<Rules>();
  list.add(new Rule("org.codehaus.plexus:plexus-utils:3.0", true));
  list.add(new Rule("org.codehaus.plexus:plexus-utils:2.6", false));
  Rules rules = new Rules(list);
  final ByteArrayOutputStream out = new ByteArrayOutputStream();
  final ObjectMapper mapper = new ObjectMapper();
  mapper.writeValue(out, rules );

  final byte[] data = out.toByteArray();
  System.out.println(new String(data));
  Rules rules2 = mapper.readValue(data, Rules.class);


public class Rule {
 String gav;
 Boolean allow;
 public String getGav() {
  return gav;
 public void setGav(String gav) {
  this.gav = gav;
 public Boolean getAllow() {
  return allow;
 public void setAllow(Boolean allow) {
  this.allow = allow;
 public String toString() {
  return "Rule [gav=" + gav + ", allow=" + allow + "]";
 public Rule(String gav, Boolean allow) {
  this.gav = gav;
  this.allow = allow;
 public Rule() {

import java.util.List;

public class Rules {
 private List<Rule> rules;

 public List<Rule> getRules() {
  return rules;

 public void setRules(List<Rule> rules) {
  this.rules = rules;

 public Rules(List<Rule> rules) {
  this.rules = rules;
 public Rules() {
 public String toString() {
  return "Rules [rules=" + rules + "]";


and I get this

Rules [rules=[Rule [gav=org.codehaus.plexus:plexus-utils:3.0, allow=true], Rule [gav=org.codehaus.plexus:plexus-utils:2.6, allow=false]]]

Thursday, May 17, 2018

Nexus OrientDB self-upgrading versions when run as root

this is VERY weird..... be VERY careful not to run Nexus 3.10 NXRM as root, unless you have set the "run_as_user="centos" in nexus.rc - The database model for component is 1.12, but the latest supported by this version of nexus is 1.11

start karaf console (vi nexus.vmoptions, set -Dkaraf.startLocalConsole=true then ./nexus run )
connect plocal:data/db/config admin admin
update upgrade_model_versions set component='1.12'

restart nexus.... you will get the error

Now you can't start again are screwed... you must use the orient console:

java -jar ./lib/support/nexus-orient-console.jar
connect plocal:/home/centos/nexus310/sonatype-work/nexus3/db/config/ admin admin
update upgrade_model_versions set component='1.11'

Issue was that we started nexus with the user "root" and we forgot to set the actual "run_as_user" in nexus.rc
Doing a chmod on all files in the directory fixed the issue, without having to touch manually the oriondb

Swagger Editor and generation of a Java API for REST Nexus API

first, let's run a docker container for swagger editor:

docker run -d --rm --name swaggereditor -p 9080:8080 swaggerapi/swagger-editor


then http://localhost:8181/service/rest/swagger.json (8181 is the Nexus port) , download the file, feed it into the swagger-editor (file , import file). Import URL will not work, apparently you must be authenticated in Nexus to be able to download it.

then generate client /java , this will produce a file with your Java client API. You extract this file, run "mvn install", then open the to understand how it works...

I create a Java project, add this maven dependency


then try this code:

package nexusclient;

import io.swagger.client.*;
import io.swagger.client.auth.*;
import io.swagger.client.model.*;
import io.swagger.client.api.AssetsApi;

public class NexucClientTest {
 public static void main(String[] args) throws Exception {
  AssetsApi apiInstance = new AssetsApi();
        String continuationToken = null;
  PageAssetXO assets = apiInstance.getAssets("maven-central", continuationToken );
  for (AssetXO asset :  assets.getItems()) {



actually you don't even need to run swagger-editor locally, you can use the online version

To test, populate your nexus repos as explained here

Saturday, May 12, 2018

JBoss and LdapDomain

check this

in standalone.xml you should have:

<security-domain name="LdapDomain" cache-type="default">
  <login-module code="LdapExtended" flag="required">
   <module-option name="java.naming.factory.initial" value="com.sun.jndi.ldap.LdapCtxFactory"/>
   <module-option name="java.naming.provider.url" value="ldap://localhost:10389"/>
   <module-option name="" value="simple"/>
   <module-option name="bindDN" value="uid=admin,ou=system"/>
   <module-option name="bindCredential" value="secret"/>
   <module-option name="baseCtxDN" value="ou=People,dc=example,dc=com"/>
   <module-option name="baseFilter" value="(uid={0})"/>
   <module-option name="rolesCtxDN" value="ou=Roles,dc=example,dc=com"/>
   <module-option name="roleFilter" value="(member={1})"/>
   <module-option name="roleAttributeID" value="cn"/>
   <module-option name="searchScope" value="ONELEVEL_SCOPE"/>
   <module-option name="allowEmptyPasswords" value="true"/>

How to secure your web.xml:

  <description>application security constraints
 <realm-name>Sample Realm</realm-name>

jboss-web.xml :


In order to use FORM login, instead of BASIC:

    <realm-name>OsbReports Application</realm-name>

with login.jsp :

<form method="POST" action="j_security_check">
<input type="text" name="j_username">
<input type="password" name="j_password">

See also

All JBoss login modules:

JBOSS LDAP Examples , shows how to use username-filter and advanced-filter to query onsAMAccountName and memberOf )

Thursday, May 10, 2018

Preparing a Centos VirtualBox with Docker.... putting it all together

sudo vi /etc/sysconfig/network-scripts/ifcfg-enp0s3
add these 3 lines:

sudo reboot now
sudo yum install gcc kernel-devel-$(uname -r)

now you can install VirtualBox Guest Additions (Devices/Insert Guest Additions CD image)

to install DOcker

sudo yum check-update
sudo yum install -y yum-utils device-mapper-persistent-data lvm2
sudo yum-config-manager --add-repo
sudo yum install docker-ce
sudo systemctl start docker
sudo usermod -aG docker $(whoami)
sudo docker run hello-world

you can now reboot

Some fine tuning on VB:
- set Host Key Combination
- disable "auto capture Keyboard"

General/Advanced/Shared Clipboard set to Bidirectional

Installing VirtualBox Guest Additions on Centos7

Apparently in latest VB releases the Guest Additions have to be built directly on the image.

This of course is a pain, because OOTB the Centos7 image doesn't contain the development tools. SO you get a message like "building the main Guest Additions module Failed"

this fixed the problem:

sudo yum install gcc kernel-devel-$(uname -r)

sudo su -
cd /run/media/centos/VBox_GAs_5.2.12/

Sunday, May 6, 2018

Apache DS in docker

docker run -d --rm --name apacheds -p 10389:10389 greggigon/apacheds

docker exec -ti apacheds bash

ps -ef

root 1 0 0 18:48 ? 00:00:00 /bin/bash /usr/local/bin/
apacheds 93 1 0 03:40 ? 00:00:01 /opt/apacheds-2.0.0_M24/bin/wrapper /var/lib/apacheds-2.0.0_M24/default/conf/wrapper-instance.conf set.INSTANCE_DIRECTORY=/var/lib/apacheds-2.0.0_M24/default set.A
apacheds 95 93 1 03:40 ? 00:00:10 java -Dlog4j.configuration=file:////var/lib/apacheds-2.0.0_M24/default/conf/ -Dapacheds.var.dir=/var/lib/apacheds-2.0.0_M24/default -Dapacheds.log.

binaries are in /opt/apacheds-2.0.0_M24/ , logs in /var/lib/apacheds-2.0.0_M24/default/log/apacheds.log

you can use this Bind DN:
with password:

this should give you ldapmodify :
sudo yum install openldap-clients

You can connect with ldapmodify

ldapmodify -p 10389 -h -D "uid=admin,ou=system" -w secret
#search all
ldapsearch -h -p 10389  -D "uid=admin,ou=system" -w secret "(objectClass=*)"
#search only one domain
ldapsearch -x -h -p 10389  -D "uid=admin,ou=system" -w secret -b 'dc=example,dc=com' '(objectclass=*)'

(see page 312 of the Wildfly Configuration Deployment Administration 2nd Edition" book)

here a sample LDIF file you can import with
ldapmodify -p 10389 -h -D "uid=admin,ou=system" -w secret -a -f example.ldif

dn: dc=example,dc=com
objectclass: top
objectclass: dcObject
objectclass: organization
dc: example
o: MCC

dn: ou=People,dc=example,dc=com
objectclass: top
objectclass: organizationalUnit
ou: People

dn: uid=admin,ou=People,dc=example,dc=com
objectclass: top
objectclass: uidObject
objectclass: person
uid: admin
cn: Manager
sn: Manager
userPassword: secret

dn: ou=Roles,dc=example,dc=com
objectclass: top
objectclass: organizationalUnit
ou: Roles

dn: cn=Manager,ou=Roles,dc=example,dc=com
objectClass: top
objectClass: groupOfNames
cn: Manager
description: the JBossAS7 group
member: uid=admin,ou=People,dc=example,dc=com

You can download jxplorer (see , login as "uid=admin,ou=system" password secret, then Tool/Import

I am using now Apache Directory Studio, it seems more advanced than jxplorer.

but it fails.... totally broken it seems...

Better start reading the ApacheDS Basic User Guide

LDAP basic tutorial

let me quickly say that LDAP SUCKS big time, this technology is Stone-Age old and pathetically complex and brittle. how to add a partition o=sevenSeas

Excellent basic intro to LDAP concepts

Complete code to connect to LDAP and run a query

package org.pierre.pvldapconnect;

import java.util.Hashtable;
import java.util.Properties;

import javax.naming.*;
import javax.naming.ldap.*;

public class LDAPConnect {
 public static void main(String[] args) throws Exception {
  //build a hashtable containing all the necessary configuration parameters
  Hashtable<String, String> environment = new Hashtable<String, String>();

  Properties conf;
  environment.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
  environment.put(Context.PROVIDER_URL, "ldap://localhost:10389");
  environment.put(Context.SECURITY_AUTHENTICATION, "simple");
  environment.put(Context.SECURITY_PRINCIPAL, "uid=admin,ou=system");
  environment.put(Context.SECURITY_CREDENTIALS, "secret");

  // connect to LDAP
  DirContext context = new InitialDirContext(environment);

  // Specify the search filter
  String FILTER = "(&(objectClass=person) ((cn=\"pierluigivernetto\")))";

  // limit returned attributes to those we care about
  String[] attrIDs = { "sn", "cn" };

  SearchControls ctls = new SearchControls();

  // Search for objects using filter and controls
  final String ldapSearchBase = "dc=example,dc=com";
  NamingEnumeration<SearchResult> answer =, FILTER, ctls);
  while (answer.hasMore()) {
   SearchResult result =;



Plastic ├╝berall

I have just watched , totally scary about the impact of plastic waste in the marine world. Please consider avoiding plastic bottles and such.

I have made a donation to Merijn Tinga , the guy seems honest, surely more than WWF, Greenpeace and such multi-billion multinationals.

(I hope Emily Stevenson agrees on my use of her photo)

Saturday, May 5, 2018

JavaEE 8 Archetype for microservice Airhacks Adam Bien

JavaEE 8 Archetype is

it uses docker, so I will try it on Linux VM.

mvn archetype:generate -Dfilter=com.airhacks:javaee8-essentials-archetype

I enter: 1,2, org.pierre, pvmicroservice, Y

cd pvmicroservice/

mvn package
copy the war from target to wildfly deployment folder


now open the Dockerfile, change glassfish into wildfly, anc change second line adding chown:
FROM airhacks/wildfly
COPY --chown=serveradmin:serveradmin ./target/pvmicroservice.war ${DEPLOYMENT_DIR}

mvn clean install && docker build -t airhacks/pvworkshops .
docker run -d --name workshops -p 8082:8080 airhacks/pvworkshops:latest
docker exec -u root -ti workshops bash
docker logs workshops


docker rm -f workshops

It talks for a while about some patterns implemented by Eclipse Microprofile

This is the Telemetry metrics project

httpproxy with littleproxy

great product

git clone
cd LittleProxy

To intercept HTTP requests, edit org.littleshoot.proxy.Launcher and insert the line with "withFiltersSource":

System.out.println("About to start...");
bootstrap.withFiltersSource(new MyHttpFiltersSourceAdapter());

package org.littleshoot.proxy.impl;

import org.littleshoot.proxy.HttpFilters;
import org.littleshoot.proxy.HttpFiltersAdapter;
import org.littleshoot.proxy.HttpFiltersSource;
import java.util.Arrays;

import io.netty.handler.codec.http.HttpObject;
import io.netty.handler.codec.http.HttpRequest;
import io.netty.handler.codec.http.HttpResponse;
import io.netty.handler.codec.http.DefaultHttpRequest;

public class MyHttpFiltersSourceAdapter implements HttpFiltersSource {
    private static final String HTTP_REPO1_MAVEN_ORG_MAVEN2 = "";
    public HttpFiltersAdapter filterRequest(HttpRequest originalRequest, ChannelHandlerContext ctx) {
        return new HttpFiltersAdapter(originalRequest) {
            public HttpResponse clientToProxyRequest(HttpObject httpObject) {
                // TODO: implement your filtering here
             System.out.println("clientToProxyRequest invoked");
             if (httpObject instanceof DefaultHttpRequest) {
              DefaultHttpRequest request = (DefaultHttpRequest)httpObject;
              System.out.println("it's a DefaultHttpRequest with uri:");
              String uri = request.getUri()
  if (uri.startsWith(HTTP_REPO1_MAVEN_ORG_MAVEN2)) {
   String gavstring = uri.substring(HTTP_REPO1_MAVEN_ORG_MAVEN2.length());
   System.out.println("gavstring=" + gavstring);
   String[] parts = gavstring.split("/");
   int len = parts.length;
   if (len < 4) {
    System.err.println("invalid length for gavstring " + gavstring + " len = " + len + " should be at least 4");
   else {
    String filename =  parts[len-1];
    String version =  parts[len-2];
    String artifactid = parts[len-3];
    String group = String.join(".", Arrays.copyOfRange(parts, 0, len - 3));
    System.out.println("filename=" + filename + " version=" + version + " artifactid=" + artifactid + " group=" + group);
        return null;

    public HttpObject serverToProxyResponse(HttpObject httpObject) {
             System.out.println("serverToProxyResponse invoked");
                return httpObject;

    public int getMaximumRequestBufferSizeInBytes() {
        // TODO Auto-generated method stub
        return 0;

    public int getMaximumResponseBufferSizeInBytes() {
        // TODO Auto-generated method stub
    return 0;

This is priceless to analyze what is going on between Nexus repository and Maven central: make sure your maven uses Nexus as a mirror: vi /home/centos/apache-maven-3.5.0/conf/settings.xml

then make sure that Nexus "maven-central" proxy repo (http://localhost:8081/repository/maven-central/) points to and not to (it's easier to trace http traffic than https) then configure Nexus 3.11 (login as admin/admin123, menu System/HTTP, set HTTP proxy to localhost and 8080) let's prepare a Maven project to compile: git clone cd maven-samples/ mvn package to make sure a give jar is missing from the m2 repository, delete it before each build: rm -rf /home/centos/.m2/repository/org/codehaus/plexus/plexus-utils/3.0/plexus-utils-3.0.jar and remove it also from Nexus (Search/Maven, search for plexus-utils 3.0, Delete component) What you see in the LittleProxy stdout is:
clientToProxyRequest invoked
DefaultHttpRequest(decodeResult: success, version: HTTP/1.1)
Proxy-Connection: Keep-Alive
User-Agent: Nexus/3.11.0-01 (OSS; Linux; 3.10.0-693.17.1.el7.x86_64; amd64; 1.8.0_141)
Accept-Encoding: gzip,deflate
As you can read in for the method clientToProxyRequest, if you return null the request will be further processed; if you return a io.netty.handler.codec.http.HttpResponse, then you effectively break the flow and you can stop the request. It's worth mentioning also as a superset of Littleproxy