3.8. Applying patch to Red Hat build of Apache Camel for Spring Boot
Using the new patch-maven-plugin mechanism, you can apply a patch to your Red Hat Red Hat build of Apache Camel for Spring Boot application. This mechanism allows you to change the individual versions provided by different Red Hat application BOMS, for example, camel-spring-boot-bom.
The purpose of the patch-maven-plugin is to update the versions of the dependencies listed in the Camel on Spring Boot BOM to the versions specified in the patch metadata that you wish to apply to your applications.
The patch-maven-plugin performs the following operations:
- Retrieve the patch metadata related to current Red Hat application BOMs.
- Apply the version changes to <dependencyManagement> imported from the BOMs.
After the patch-maven-plugin fetches the metadata, it iterates through all managed and direct dependencies of the project where the plugin was declared and replaces the dependency versions (if they match) using CVE/patch metadata. After the versions are replaced, the Maven build continues and progresses through standard Maven project stages.
Procedure
The following procedure explains how to apply the patch to your application.
Add
patch-maven-pluginto your project’spom.xmlfile. The version of thepatch-maven-pluginmust be the same as the version of the Camel on Spring Boot BOM.<build> <plugins> <<plugin> <groupId>com.redhat.camel.springboot.platform</groupId> <artifactId>patch-maven-plugin</artifactId> <version>${camel-spring-boot-version}</version> <extensions>true</extensions> </plugin> </plugins> </build>When you run any of the
mvn clean deploy,mvn validate, ormvn dependency:treecommands, the plugin searches through the project modules to check if the modules use the Red Hat Red Hat build of Apache Camel for Spring Boot BOM. Only the following is the supported BOM:-
com.redhat.camel.springboot.platform:camel-spring-boot-bom: for Red Hat build of Apache Camel for Spring Boot BOM
-
If the plugin does not find the above BOM, the plugin displays the following messages:
$ mvn clean install [INFO] Scanning for projects... [INFO] ========== Red Hat Maven patching ========== [INFO] [PATCH] No project in the reactor uses Camel on Spring Boot product BOM. Skipping patch processing. [INFO] [PATCH] Done in 7ms =================================================If the correct BOM is used, the patch metadata is found, but without any patches.
$ mvn clean install [INFO] Scanning for projects... [INFO] ========== Red Hat Maven patching ========== [INFO] [PATCH] Reading patch metadata and artifacts from 2 project repositories [INFO] [PATCH] - redhat-ga-repository: http://maven.repository.redhat.com/ga/ [INFO] [PATCH] - central: https://repo.maven.apache.org/maven2 Downloading from redhat-ga-repository: http://maven.repository.redhat.com/ga/com/redhat/camel/springboot/platform/redhat-camel-spring-boot-patch-metadata/maven-metadata.xml Downloading from central: https://repo.maven.apache.org/maven2/com/redhat/camel/springboot/platform/redhat-camel-spring-boot-patch-metadata/maven-metadata.xml [INFO] [PATCH] Resolved patch descriptor: /path/to/.m2/repository/com/redhat/camel/springboot/platform/redhat-camel-spring-boot-patch-metadata/3.20.1.redhat-00043/redhat-camel-spring-boot-patch-metadata-3.20.1.redhat-00043.xml [INFO] [PATCH] Patch metadata found for com.redhat.camel.springboot.platform/camel-spring-boot-bom/[3.20,3.21) [INFO] [PATCH] Done in 938ms =================================================The
patch-maven-pluginattempts to fetch this Maven metadata.For the projects with Camel Spring Boot BOM, the
com.redhat.camel.springboot.platform:redhat-camel-spring-boot-patch-metadata/maven-metadata.xmlis resolved. This XML data is the metadata for the artifact with thecom.redhat.camel.springboot.platform:redhat-camel-spring-boot-patch-metadata:RELEASEcoordinates.Example metadata generated by Maven
<?xml version="1.0" encoding="UTF-8"?> <metadata> <groupId>com.redhat.camel.springboot.platform</groupId> <artifactId>redhat-camel-spring-boot-patch-metadata</artifactId> <versioning> <release>3.20.1.redhat-00041</release> <versions> <version>3.20.1.redhat-00041</version> </versions> <lastUpdated>20230322103858</lastUpdated> </versioning> </metadata>
-
The
patch-maven-pluginparses the metadata to select the version which applies to the current project. This action is possible only for the Maven projects using Camel on Spring Boot BOM with the specific version. Only the metadata that matches the version range or later is applicable, and it fetches only the latest version of the metadata. The
patch-maven-plugincollects a list of remote Maven repositories for downloading the patch metadata identified bygroupId,artifactId, andversionfound in previous steps. These Maven repositories are listed in the project’s<repositories>elements in the active profiles, and also the repositories from thesettings.xmlfile.$ mvn clean install [INFO] Scanning for projects... [INFO] ========== Red Hat Maven patching ========== [INFO] [PATCH] Reading patch metadata and artifacts from 2 project repositories [INFO] [PATCH] - MRRC-GA: https://maven.repository.redhat.com/ga [INFO] [PATCH] - central: https://repo.maven.apache.org/maven2Whether the metadata comes from a remote repository, local repository, or ZIP file, it is analyzed by the
patch-maven-plugin. The fetched metadata contains a list of CVEs, and for each CVE, we have a list of the affected Maven artifacts (specified by glob patterns and version ranges) together with a version that contains a fix for a given CVE. For example,<?xml version="1.0" encoding="UTF-8" ?> <<metadata xmlns="urn:redhat:patch-metadata:1"> <product-bom groupId="com.redhat.camel.springboot.platform" artifactId="camel-spring-boot-bom" versions="[3.20,3.21)" /> <cves> </cves> <fixes> <fix id="HF0-1" description="logback-classic (Example) - Version Bump"> <affects groupId="ch.qos.logback" artifactId="logback-classic" versions="[1.0,1.3.0)" fix="1.3.0" /> </fix> </fixes> </metadata>Finally a list of fixes specified in patch metadata is consulted when iterating over all managed dependencies in the current project. These dependencies (and managed dependencies) that match are changed to fixed versions. For example:
$ mvn dependency:tree [INFO] Scanning for projects... [INFO] ========== Red Hat Maven patching ========== [INFO] [PATCH] Reading patch metadata and artifacts from 3 project repositories [INFO] [PATCH] - redhat-ga-repository: http://maven.repository.redhat.com/ga/ [INFO] [PATCH] - local: file:///path/to/.m2/repository [INFO] [PATCH] - central: https://repo.maven.apache.org/maven2 [INFO] [PATCH] Resolved patch descriptor:/path/to/.m2/repository/com/redhat/camel/springboot/platform/redhat-camel-spring-boot-patch-metadata/3.20.1.redhat-00043/redhat-camel-spring-boot-patch-metadata-3.20.1.redhat-00043.xml [INFO] [PATCH] Patch metadata found for com.redhat.camel.springboot.platform/camel-spring-boot-bom/[3.20,3.21) [INFO] [PATCH] - patch contains 1 patch fix [INFO] [PATCH] Processing managed dependencies to apply patch fixes... [INFO] [PATCH] - HF0-1: logback-classic (Example) - Version Bump [INFO] [PATCH] Applying change ch.qos.logback/logback-classic/[1.0,1.3.0) -> 1.3.0 [INFO] [PATCH] Project com.test:yaml-routes [INFO] [PATCH] - managed dependency: ch.qos.logback/logback-classic/1.2.11 -> 1.3.0 [INFO] [PATCH] Done in 39ms =================================================
Skipping the patch
If you do not wish to apply a specific patch to your project, the patch-maven-plugin provides a skip option. Assuming that you have already added the patch-maven-plugin to the project’s pom.xml file, and you do not wish to alter the versions, you can use one of the following method to skip the patch.
-
Add the skip option to your project’s
pom.xmlfile as follows.
<build>
<plugins>
<plugin>
<groupId>com.redhat.camel.springboot.platform</groupId>
<artifactId>patch-maven-plugin</artifactId>
<version>${camel-spring-boot-version}</version>
<extensions>true</extensions>
<configuration>
<skip>true</skip>
</configuration>
</plugin>
</plugins>
</build>-
Or use the
-DskipPatchoption when running themvncommand as follows.
$ mvn clean install -DskipPatch
[INFO] Scanning for projects...
[INFO]
[INFO] -------------------------< com.example:test-csb >-------------------------
[INFO] Building A Camel Spring Boot Route 1.0-SNAPSHOT
...
As shown in the above output, the patch-maven-plugin was not invoked, which resulted in the patch not being applied to the application.
'%20d='M201.5%20305.5c-13.8%200-24.9-11.1-24.9-24.6%200-13.8%2011.1-24.9%2024.9-24.9%2013.6%200%2024.6%2011.1%2024.6%2024.9%200%2013.6-11.1%2024.6-24.6%2024.6zM504%20256c0%20137-111%20248-248%20248S8%20393%208%20256%20119%208%20256%208s248%20111%20248%20248zm-132.3-41.2c-9.4%200-17.7%203.9-23.8%2010-22.4-15.5-52.6-25.5-86.1-26.6l17.4-78.3%2055.4%2012.5c0%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.3%2024.9-24.9s-11.1-24.9-24.9-24.9c-9.7%200-18%205.8-22.1%2013.8l-61.2-13.6c-3-.8-6.1%201.4-6.9%204.4l-19.1%2086.4c-33.2%201.4-63.1%2011.3-85.5%2026.8-6.1-6.4-14.7-10.2-24.1-10.2-34.9%200-46.3%2046.9-14.4%2062.8-1.1%205-1.7%2010.2-1.7%2015.5%200%2052.6%2059.2%2095.2%20132%2095.2%2073.1%200%20132.3-42.6%20132.3-95.2%200-5.3-.6-10.8-1.9-15.8%2031.3-16%2019.8-62.5-14.9-62.5zM302.8%20331c-18.2%2018.2-76.1%2017.9-93.6%200-2.2-2.2-6.1-2.2-8.3%200-2.5%202.5-2.5%206.4%200%208.6%2022.8%2022.8%2087.3%2022.8%20110.2%200%202.5-2.2%202.5-6.1%200-8.6-2.2-2.2-6.1-2.2-8.3%200zm7.7-75c-13.6%200-24.6%2011.1-24.6%2024.9%200%2013.6%2011.1%2024.6%2024.6%2024.6%2013.8%200%2024.9-11.1%2024.9-24.6%200-13.8-11-24.9-24.9-24.9z'/%3e%3c/svg%3e){kind=small}