All usage guides show how to run native-image on a single JAR file. But I believe most projects usually use multiple JARs on classpath (e.g. Gradle default way). How to tell native-image to bundle all of them into one executable?
You can specify the class path to use for building the executable:
-cp, -classpath, --class-path <class search path of directories and zip/jar files>: a separated list of directories, JAR archives, and ZIP archives to search for class files.
Here's more docs about various options to the native-image utility: https://www.graalvm.org/reference-manual/native-image/Options/
All in all it should native-image -cp this.jar:that.jar -jar myjar.jar
Related
We have a custom Skylark rule that invokes jar after using the Thrift compiler to generate .java files, modeled after genproto.bzl.
What is the recommended way to invoke an external jar command in a hermetic way? Should we use new_http_archive to pull in the JDK archive (and how would this work with the DMG Oracle provides for OSX) with something like jdk.BUILD?
You have #local_jdk//:jar that expose the jar binary coming from the jdk used by Bazel.
I have an ant project with ivy dependencies in it. Unfortunately my Intelij IDEA does not understend ivy dependencies. But ant builds project well. I want to download all dependencies to one folder and add jars explicitly to project.
How can i download all dependencies automatically?
As described here http://ant.apache.org/ivy/history/latest-milestone/ant.html
During ant build ivy dependencies downloads to "cache". If i'll found this cache path i can took jars from there.
Look at what ant is doing. If its a well written ant script you'll find (do an ant -p -v) targets specifically for retrieving the ivy dependencies. Also you may inspect the build.xml and watch out for retrieve tasks probably in the ivy namespace.
I'm able to successfully build the Maven assembly plugin in my project and generate a jar file with all the needed dependencies. But now I also want to instruct Maven after building me the jar file with dependencies, go into the target folder where the jar file with dependencies is located and run my main program.
Should I consider looking into the Maven Exec Plugin for what I want to acheive?
Yes the exec-maven-plugin is the right choice. The question is if you like to start the assembled jar archive or just a java class with it's dependencies.
In eclipse, I can tell my external ant tool to run with stuff in the classpath.
If i want to run ant from the command line, how would i do that?
For argument's sake, the classpath i want to add is c:\some\folder\here\hooray.jar
Use the -lib argument. From the Ant docs on this page:
Additional directories to be searched may be added by using the -lib option. The -lib option specifies a search path. Any jars or classes in the directories of the path will be added to Ant's classloader.
I need to check vulnerabilities (if any) in the third party libraries that are being used in my project using Fortify.
For a few third party libraries, I am not able to access their source files. I only have the shipped .jar files.
Is it possible to run Fortify on .jar files instead ? All I could find in most of the documentations was that Fortify can be run on .java files, something like this:
sourceanalyzer -b MyProject -cp "lib/.jar" "src/*/*.java"
You can do one better than LaJmOn's suggestion and actually crack open the jars automatically.
for example:
sourceanalyzer -b apple -source 1.6 -Dcom.fortify.sca.fileextensions.jar=ARCHIVE /System/Library/Frameworks/JavaVM.framework/Home/lib/ext/apple_provider.jar
You can force SCA to scan the class files using the following command:
sourceanalyzer -b MyProject -source "1.6" -cp "{source_path}/**/*.jar" -scan -f MyProject.fpr -Dcom.fortify.sca.fileextensions.class=BYTECODE -Dcom.fortify.sca.DefaultFileTypes=class "{source_path}/**/*.class"
If I remember correctly, you need to explode the JAR files containing the class files you want to scan into {source_path}.
The results will be less than spectacular compared to a Java source scan, but you should get some results.