SonarQube - Bitbucket server fails to decorate pull request

SonarQube
, ,
1

SonarQube : 9.4 (Enterprise), Scanner: 4.7.0.2747, Bitbucket Server: v6.10.0

We have integrated Sonar with our Bitbucket Server instance and executed scan from Jenkins multibranch pipeline (like mentioned in the guide).

Though scan just works fine its unable to decorate Pull Request in Bitbucket server, there is below analysis warning for project,

Pull request decoration did not happen. Failed to access Bitbucket Server, the repository or the pull request

At the same time I see below in the Sonar container logs

2022.05.05 14:02:21 INFO  ce[AYCUh1Zs21sFk0FIvlSr][o.s.a.c.b.BitbucketServerRestClient] Unable to contact Bitbucket server: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:352)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:295)
        at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:290)
...........
2022.05.05 14:02:21 WARN  ce[AYCUh1Zs21sFk0FIvlSr][c.s.G.D.B.E] Pull request decoration did not happen. Failed to access Bitbucket Server, the repository or the pull request: Unable to contact Bitbucket server

We had certificate issue while configuring the Bitbucket server earlier, so we have started the docker container with env variable with jks file details. After that we managed to connect successfully and import projects from it,

SONARQUBE_WEB_JVM_OPTS: -Djavax.net.ssl.trustStore=/tmp/sonarqube.jks -Djavax.net.ssl.trustStorePassword=pass

So the question is how is it managed to connect for import operation with SSL but not to decorate ? Does it mean it does not use these JVM option while running decorating PR ? Is there a some other
JVM property which I am missing ?

Just to check connectivity from inside the container I have run SSLPoke with the JKS file and its just works fine.

bash-5.1# $JAVA_HOME/bin/java -Djavax.net.ssl.trustStore=/tmp/sonarqube.jks -Djavax.net.ssl.trustStorePassword=pass SSLPoke bitbucket 443 Successfully connected

Any suggestions would be helpful.

Thanks.

2

Ok, So after adding certificate manually into /etc/ssl/certs/ca-certificates.crt like mentioned earlier I had to restart SonarQube server from UI and after the PR decoration worked fine. :grinning:

But these changes will be lost once the container recreated, So I am still looking for permanent way of adding certificate.

Appreciate any assistance on this.

Thanks.

3

Ok, after many trial and error and going thorough the docs managed to fix it.

As per the SonarQube docs Sonar runs in two different java processes, one for the Web Server and other for Compute Engine which is responsible for all background tasks.

Env variable SONARQUBE_WEB_JVM_OPTS is only used by WebServer and that’s why it worked earlier to load repo from Bitbucket etc.

But since ComputeEngine is the one doing PR decoration (in the background) and it does not have ca cert it was failing with SSL unknown cert issue. To fix we can add Compute Engine env variable SONAR_CE_JAVAADDITIONALOPTS with same jks details.

SONAR_CE_JAVAADDITIONALOPTS: -Djavax.net.ssl.trustStore=/tmp/sonarqube.jks -Djavax.net.ssl.trustStorePassword=pass

That’s it :grinning: and after docker container restart it works for PR decoration as well.

I wish Sonar team adds docs specially on how to handle selfsigned or internally generated CA certificates. Since its kind of very common in many organizations.

Thanks.

4

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.