CodeQL is attempting to connect to 146.75.116.215

[axidex]

Hello everyone,

I'm having a problem with CodeQL trying to connect to 146.75.116.215. I don't want it to go there, but it keeps trying. Can you please help me figure out how to prevent this?

[redsun82]

Hi @axidex! Could you please provide more context? What command are you running when you see this? Or is this happening in the context of github/codeql-action in a workflow run?

[axidex]

Hi @axidex! Could you please provide more context? What command are you running when you see this? Or is this happening in the context of github/codeql-action in a workflow run?

I'm launching CodeQL CLI with commands below in my k8s cluster

codeql/codeql database create --source-root=src --language=java --threads=0 --overwrite --build-mode=none --db-cluster --ram=8000 java_db

codeql/codeql database analyze --output=java_report_java --threads=0 --format=sarif-latest --threat-model=local --no-print-diagnostics-summary --sarif-add-snippets --no-sarif-minify --sarif-multicause-markdown --no-group-results --no-default-compilation-cache --compilation-cache=/tmp/tmp --verbose --off-heap-ram=0 --no-download --ram=8000 java_db/java

[redsun82]

After a bit of a search, I had found out that address is for repo.maven.apache.org (try dig repo.maven.apache.org on Linux or macOS, or nslookup repo.maven.apache.org on Windows). By default in order to run analysis on java we try to build it, and in this maven is queried because of that. Even when using --build-mode=none, maven will still be queried for dependencies if we detect a maven build.

[axidex]

Ohh, Thank you. I'm using proxies for Maven, PyPI, etc. Which proxies should I define for correct CodeQL work?

[redsun82]

ah, I see! How are you configuring the maven proxy? If it's done in the maven on-disk configuration, I would expect CodeQL to pick it up, but I might be wrong. I'll also ask the internal team responsible for this for guidance.

[axidex]

ah, I see! How are you configuring the maven proxy? If it's done in the maven on-disk configuration, I would expect CodeQL to pick it up, but I might be wrong. I'll also ask the internal team responsible for this for guidance.

Thank you. Do you have a complete list of external resources that are used for CodeQL builds, in which I should include a proxy?

[redsun82]

Proxy settings set up as in https://maven.apache.org/settings.html#Proxies or set up via a package registry entry in the pom.xml file are picked up also by CodeQL, but please report if you're finding it's not the case, as it might be a bug.

[redsun82]

Thank you. Do you have a complete list of external resources that are used for CodeQL builds, in which I should include a proxy?

Sorry, I don't think we maintain such a list. Outside of language packs, CodeQL may undestandably contact github when running codeql pack or codeql github commands. When running autobuild or doing build mode none analysis for a given language, requests may be sent out depending on the language and build system detected in the repository. For java analysis with a maven build, no other external resources than maven will be fetched. For python analysis we no longer fetch external resources (although we did in past versions), so PyPy should not be contacted.

[axidex]

Thank you. Do you have a complete list of external resources that are used for CodeQL builds, in which I should include a proxy?

Sorry, I don't think we maintain such a list. Outside of language packs, CodeQL may undestandably contact github when running codeql pack or codeql github commands. When running autobuild or doing build mode none analysis for a given language, requests may be sent out depending on the language and build system detected in the repository. For java analysis with a maven build, no other external resources than maven will be fetched. For python analysis we no longer fetch external resources (although we did in past versions), so PyPy should not be contacted.

Thank you for reply. I will try investigate the most widely used package managers and configure them with proxies for CodeQL