Pentaho

Hi,

I have pulled and built pentaho-kettle from master branch GitHub - pentaho/pentaho-kettle: Pentaho Data Integration ( ETL ) a.k.a Kettle 

But it throws the error as below

It's critical for us so, does anyone know how to fix it?

Hi,

IMHO it's not possible. In Maven repository is available only GA versions of platform, 9.4.0.0-343, 9.3.0.0-428, 9.2.0.0-290 and 8.3.0.0-371.

Hi,

I have pulled and built pentaho-kettle from master branch GitHub - pentaho/pentaho-kettle: Pentaho Data Integration ( ETL ) a.k.a Kettle 

But it throws the error as below

It's critical for us so, does anyone know how to fix it?

Hi Petr, we're currently using Pentaho Kettle version 9.4.0.0-343, and it's been functioning well from an operational standpoint. However, recent security scans have identified vulnerabilities in this version, which pose a potential risk to our data and systems.

While we'd prefer to maintain stability, addressing these vulnerabilities is a priority. Unfortunately, we're unsure of the best approach to fixing them all.

Hi,

IMHO it's not possible. In Maven repository is available only GA versions of platform, 9.4.0.0-343, 9.3.0.0-428, 9.2.0.0-290 and 8.3.0.0-371.

Hi,

I have pulled and built pentaho-kettle from master branch GitHub - pentaho/pentaho-kettle: Pentaho Data Integration ( ETL ) a.k.a Kettle 

But it throws the error as below

It's critical for us so, does anyone know how to fix it?

Hello Oia Le, over the last 12 months the focus on the industry in relation to vulnerabilities has increased and the scan processes have also evolved. This translates having new reports and listings coming very frequent. 

Since 9.4, we have released a big number of Service Packs to address most of those vulnerabilities.

Our pentaho engineering have been putting a lot of extra effort over the last 6 months to close the vulnerabilities before the release of our next Long Term Support (LTS) Version, which is coming in few months.

Hi Petr, we're currently using Pentaho Kettle version 9.4.0.0-343, and it's been functioning well from an operational standpoint. However, recent security scans have identified vulnerabilities in this version, which pose a potential risk to our data and systems.

While we'd prefer to maintain stability, addressing these vulnerabilities is a priority. Unfortunately, we're unsure of the best approach to fixing them all.

Hi,

IMHO it's not possible. In Maven repository is available only GA versions of platform, 9.4.0.0-343, 9.3.0.0-428, 9.2.0.0-290 and 8.3.0.0-371.

Hi,

I have pulled and built pentaho-kettle from master branch GitHub - pentaho/pentaho-kettle: Pentaho Data Integration ( ETL ) a.k.a Kettle 

But it throws the error as below

It's critical for us so, does anyone know how to fix it?

Thank @Alexander Schurman to reply me.

I appreciate you confirming that upgrading to a newer version of Pentaho Kettle should significantly reduce the security vulnerabilities in version 9.4.0.0-343.

However, I'm encountering some challenges during the upgrade process.  Whenever I attempt to build the newer version, I consistently experience build failures. During the build process, I'm facing errors related to missing dependencies in the Maven Artifactory.

Could you please advise on how to troubleshoot these missing dependencies?  Are there specific steps I need to take to ensure the required artifacts are available in the Artifactory repository?

Thanks,

Oai Le

Hello Oia Le, over the last 12 months the focus on the industry in relation to vulnerabilities has increased and the scan processes have also evolved. This translates having new reports and listings coming very frequent. 

Since 9.4, we have released a big number of Service Packs to address most of those vulnerabilities.

Our pentaho engineering have been putting a lot of extra effort over the last 6 months to close the vulnerabilities before the release of our next Long Term Support (LTS) Version, which is coming in few months.

Hi Petr, we're currently using Pentaho Kettle version 9.4.0.0-343, and it's been functioning well from an operational standpoint. However, recent security scans have identified vulnerabilities in this version, which pose a potential risk to our data and systems.

While we'd prefer to maintain stability, addressing these vulnerabilities is a priority. Unfortunately, we're unsure of the best approach to fixing them all.

Hi,

IMHO it's not possible. In Maven repository is available only GA versions of platform, 9.4.0.0-343, 9.3.0.0-428, 9.2.0.0-290 and 8.3.0.0-371.

Hi,

I have pulled and built pentaho-kettle from master branch GitHub - pentaho/pentaho-kettle: Pentaho Data Integration ( ETL ) a.k.a Kettle 

But it throws the error as below

It's critical for us so, does anyone know how to fix it?

Hi,

I have pulled and built pentaho-kettle from master branch GitHub - pentaho/pentaho-kettle: Pentaho Data Integration ( ETL ) a.k.a Kettle 

But it throws the error as below

It's critical for us so, does anyone know how to fix it?

------------------------------
Oai Le
Others
Halliburton
------------------------------

Have you done:

mvn -X clean install

in 

maven-parent-poms cloned repository and its subdirectories that include pom files? 

Please additionaly clone and build  with mvn clean install

https://github.com/pentaho/metastore

https://github.com/pentaho/maven-project-archetypes

https://github.com/pentaho/pentaho-maven-plugins

https://github.com/pentaho/pentaho-connections

https://github.com/pentaho/pentaho-actionsequence-dom

https://github.com/pentaho/pentaho-commons-xul (this one failed as I'm doing it in air gapped env)

you will go forward but compile will fail - so still something is missing.

Hi Szymon,

I've done as you've suggested and am now getting the same issues as you have above.  The pentaho-commons-xul fails to build (but doesn't block anything at this point), and maven then fails in not being able to resolve the pentaho-encryption-support dependency. 

I've tried changing the kettle /core/pom.xml dependency for pentaho-encryption-support to a different version - but no such luck.  I've tried manually installing the jar file from 9.4.0.0 (one I built earlier) - but I'm a maven and pom.xml novice - so likely am doing something wrong:

mvn install:install-file -Dfile=pentaho-encryption-support.jar ^
                         -DgroupId=org.pentaho ^
                         -DartifactId=pentaho-encryption-support ^
                         -Dversion=9.4.0.0-SNAPSHOT ^
                         -Dpackaging=jar

The error is now slightly different I get a compile failure - but basically, it's the same saying that the encryption support package doesn't exist.

Will try to work on it some more when I get a chance.

Have you done:

mvn -X clean install

in 

maven-parent-poms cloned repository and its subdirectories that include pom files? 

Please additionaly clone and build  with mvn clean install

https://github.com/pentaho/metastore

https://github.com/pentaho/maven-project-archetypes

https://github.com/pentaho/pentaho-maven-plugins

https://github.com/pentaho/pentaho-connections

https://github.com/pentaho/pentaho-actionsequence-dom

https://github.com/pentaho/pentaho-commons-xul (this one failed as I'm doing it in air gapped env)

you will go forward but compile will fail - so still something is missing.

Ok - got past that now.  had to remove the 'org.' in the group id.

mvn install:install-file -Dfile=pentaho-encryption-support.jar ^
                         -DgroupId=pentaho ^
                         -DartifactId=pentaho-encryption-support ^
                         -Dversion=9.4.0.0-SNAPSHOT ^
                         -Dpackaging=jar

kettle/core/pom.xml:

    <dependency>
          <groupId>pentaho</groupId>
          <artifactId>pentaho-encryption-support</artifactId>
          <version>9.4.0.0-SNAPSHOT</version>
    </dependency>

The build still requires further repositories such as:
git clone https://github.com/pentaho/pentaho-registry.git
git clone https://github.com/pentaho/mondrian.git

the journey continues...

Hi Szymon,

I've done as you've suggested and am now getting the same issues as you have above.  The pentaho-commons-xul fails to build (but doesn't block anything at this point), and maven then fails in not being able to resolve the pentaho-encryption-support dependency. 

I've tried changing the kettle /core/pom.xml dependency for pentaho-encryption-support to a different version - but no such luck.  I've tried manually installing the jar file from 9.4.0.0 (one I built earlier) - but I'm a maven and pom.xml novice - so likely am doing something wrong:

mvn install:install-file -Dfile=pentaho-encryption-support.jar ^
                         -DgroupId=org.pentaho ^
                         -DartifactId=pentaho-encryption-support ^
                         -Dversion=9.4.0.0-SNAPSHOT ^
                         -Dpackaging=jar

The error is now slightly different I get a compile failure - but basically, it's the same saying that the encryption support package doesn't exist.

Will try to work on it some more when I get a chance.

Have you done:

mvn -X clean install

in 

maven-parent-poms cloned repository and its subdirectories that include pom files? 

Please additionaly clone and build  with mvn clean install

https://github.com/pentaho/metastore

https://github.com/pentaho/maven-project-archetypes

https://github.com/pentaho/pentaho-maven-plugins

https://github.com/pentaho/pentaho-connections

https://github.com/pentaho/pentaho-actionsequence-dom

https://github.com/pentaho/pentaho-commons-xul (this one failed as I'm doing it in air gapped env)

you will go forward but compile will fail - so still something is missing.