search

logpresso / CVE-2021-44228-Scanner

Vulnerability scanner and mitigation patch for Log4j2 CVE-2021-44228
Apache License 2.0
852 stars 173 forks source link

"Optimized" way for native image configuration and maven build #172

Closed Afrouper closed 2 years ago

Afrouper commented 2 years ago

Hi,

I was struggling with the generation of the native-image. So I created a way to execute it via maven. mvn package -Pnative creates the JAR and the native image (for current OS). The command man package still creates only the JAR.

The configuration of the native image is now placed in src/main/resources/META-INF/native-image/com.logpresso/log4j2-scanner. It is the recommended way to provide build in configurations. Also the reflection mappings (prior scanner.json is now placed here). So also without maven the creation of the native image is always with the simple command native-image -jar log4j2-scanner-2.3.2.jar possible.

Please check out.

jgstew commented 2 years ago

Does this mean GraalVM is not required to make a native binary image? or is maven using GraalVM under the hood?

I just answered my own question by looking at the PR:

                        <groupId>org.graalvm.buildtools</groupId>
                        <artifactId>native-maven-plugin</artifactId>

So then I assume you still need GraalVM setup to do this through maven.

ChKemper commented 2 years ago

Hi,

yes GraalVM is still needed. But via maven you can create the binaries in one environment.

But I think the better Part is that you can put the hole configuration for the creation as part of the JAR in the META-INF/native-image folder.

jgstew commented 2 years ago

@ChKemper "But via maven you can create the binaries in one environment."

Not certain what this part means.

Does this mean you can build native binaries for other platforms from your current platform? Like could I build a native Linux binary from Windows?

Afrouper commented 2 years ago

Hi @jgstew,

with environment the build Environment was meant. So only with maven commands, etc. you can build all artifacts. The native images are created with GraalVM. This does not support cross compilation.

So you have to execute it on each architecture. The only way I know is to use a docker container for building the native image. Then you can create a linux binary on e.g. macOS.