OSCAL CLI 2.0.2 ~/.m2/toolchains.xml Error

[JoseGHdz]

Describe the bug

I downloaded the OSCAL CLI 2.0.2 file from the recent, and step 2 which does the mvn install does not finish due to and error that I am encountering that says: Please make sure you define the required toolchains in your ~/.m2/toolchains.xml file.

I was able to install OSCAL CLI 1.0.3 successfully but OSCAL CLI 2.0.2 is giving a lot of issues.

Maven Version: Apache Maven 3.9.5

The JDK version that I am using is:
openjdk version "17.0.12" 2024-07-16
OpenJDK Runtime Environment Temurin-17.0.12+7 (build 17.0.12+7)
OpenJDK 64-Bit Server VM Temurin-17.0.12+7 (build 17.0.12+7, mixed mode, sharing)

Who is the bug affecting?

The install of OSCAL CLI 2.0.2

What is affected by this bug?

Missing a file called: ~/.m2/toolchains.xml

When does this occur?

At the 'mvn install' step

How do we replicate the issue?

1. Download the OSCAL CLI 2.0.2
2. Follow step 2 of the install instructions
3. Receive the 'Please make sure you define the required toolchains in your ~/.m2/toolchains.xml file.' error at the end.

If applicable, add screenshots to help explain your problem.}
OSCAL CLI 2.0.2

OSCAL CLI 1.0.3

Expected behavior (i.e. solution)

The expected solution is to have a Build Success message just like the OSCAL CLI 1.0.3

Device in Use

Linux #24~22.04.1-Ubuntu SMP x86_64 GNU/Linux

[aj-stein]

Fellow community user here, I know this is a "fun" consequence of using the Maven ecosystem, but this error is because the Maven utility needs explicit instruction to know which Java development SDK to use for compiling the Java modules. This codebase cannot provide the answer for you, it is a per-computer setting wherever you compile.

https://foojay.io/today/introduction-to-maven-toolchains/

I have been bitten by this many times and it is a general issue for using Maven and setting specific toolchain choice. It is not a CLI issue that is fixable by this project.

[JoseGHdz]

Fellow community user here, I know this is a "fun" consequence of using the Maven ecosystem, but this error is because the Maven utility needs explicit instruction to know which Java development SDK to use for compiling the Java modules. This codebase cannot provide the answer for you, it is a per-computer setting wherever you compile.

https://foojay.io/today/introduction-to-maven-toolchains/

I have been bitten by this many times and it is a general issue for using Maven and setting specific toolchain choice. It is not a CLI issue that is fixable by this project.

I was able to setup the toolchains which points to the directory of my Temurin 17 JDK but now I am getting another issue thay says:

Failed to execute goal io.github.git-commit-id:git-commit-id-maven-plugin:9.0.1:revision (get-the-git-infos) on project oscal-cli-enhanced: .git directory is not found! Please specify a valid [dotGitDirectory] in your project

[aj-stein-gsa]

I was able to setup the toolchains which points to the directory of my Temurin 17 JDK but now I am getting another issue thay says:

Failed to execute goal io.github.git-commit-id:git-commit-id-maven-plugin:9.0.1:revision (get-the-git-infos) on project oscal-cli-enhanced: .git directory is not found! Please specify a valid [dotGitDirectory] in your project

First off, really sorry I dropped the ball here after I initially responded. I am getting back my sea legs so to speak, but I should have replied sooner.

Re our conversation a few minutes ago in the implementers meeting today, you will only need this git-based metadata from the relevant Maven plugin only when you build your own copy locally, not downloading a pre-build release. Just to confirm my guess from doing a lot of local development on the tool, can you confirm the following?

1. What Maven command did you specifically run mvn ... to get this error?
2. More generally, was your intent to build it locally? Just download the pre-built, signed release our sage, trustworthy community maintainers built in GitHub Actions?

UPDATE: I also realized that is not super helpful, some more follow on. Re 1 and 2, I will presume you wanted to quickly download the pre-built version. Some people know Maven supports this with a popular plugin. It is not the recommended way, but I do this quickly when using a Java environment where Maven is preinstalled to get things up and running. Perhaps you are looking for this?

# Current version of the plugin below is 3.8.0, read maven.org docs or use LATEST
# Check docs to periodically update 
# Run Maven
$ mvn \
  # With the current stable version of maven-dependency-plugin using the get command
  org.apache.maven.plugins:maven-dependency-plugin:3.8.0:get \
  # With the official OSS Maven central repo, URL below, yes you need /maven2 at the end
 -DremoteRepositories=https://repo1.maven.org/maven2 \
  # And download version 2.0.2 of the CLI
 -Dartifact=dev.metaschema.oscal:oscal-cli-enhanced:2.0.2:zip:oscal-cli
$ export OSCAL_CLI_PATH=$HOME/.m2/repositories/dev/metaschema/oscal/oscal-cli-enhanced/2.0.2
$ pushd $OSCAL_CLI_PATH
$ unzip *.zip
$ popd
$ export $PATH=$OSCAL_CLI_PATH/bin:$PATH # make sure you can use it from your terminal, observe the `bin we add; save it ~/.bashrc for ~/.zshrc for permanence
$ oscal-cli --version

Or with the LATEST alias for the plugin and the CLI:

# Run Maven
$ mvn \
  # With the LATEST stable version of maven-dependency-plugin using the get command
  org.apache.maven.plugins:maven-dependency-plugin:LATEST:get \
  # With the official OSS Maven central repo, URL below, yes you need /maven2 at the end
 -DremoteRepositories=https://repo1.maven.org/maven2 \
  # And download the LATEST version of the CLI
 -Dartifact=dev.metaschema.oscal:oscal-cli-enhanced:LATEST:zip:oscal-cli
$ # LATEST works for Maven, but it creates the explicit path name in the local Maven directories in the filesystem 
$ export OSCAL_CLI_PATH=$HOME/.m2/repositories/dev/metaschema/oscal/oscal-cli-enhanced/2.0.2
$ pushd $OSCAL_CLI_PATH
$ unzip *.zip
$ popd
$ export $PATH=$OSCAL_CLI_PATH/bin:$PATH # make sure you can use it from your terminal, save it ~/.bashrc for ~/.zshrc for permanence
$ oscal-cli --version

Now, if you look into ~/.m2/repositories/dev/metaschema/oscal/oscal-cli-enhanced/2.0.2 you will see that this gives you _only- the bare JAR archives and the XML metadata from Maven. This is the stripped down version and does not seem to include the full installer with the convenience shell script and things, and that is why this not the recommended method. I hope that helps. I had to test locally and writing about a gnarly CLASSPATH and necessary CLI args by hand is not so pleasant, which is why downloading with curl or wget is a heck of a lot easier.

Apologies, I was not hip on the use of :<type/>:<classifier/> with this Maven plugin. Something in a previous configuration downloads everything. Adding :zip:oscal-cli signals to download just that and everything is zipped into a bundle, I have updated the code samples above.

[JoseGHdz]

I was able to setup the toolchains which points to the directory of my Temurin 17 JDK but now I am getting another issue thay says:
Failed to execute goal io.github.git-commit-id:git-commit-id-maven-plugin:9.0.1:revision (get-the-git-infos) on project oscal-cli-enhanced: .git directory is not found! Please specify a valid [dotGitDirectory] in your project

First off, really sorry I dropped the ball here after I initially responded. I am getting back my sea legs so to speak, but I should have replied sooner.

Re our conversation a few minutes ago in the implementers meeting today, you will only need this git-based metadata from the relevant Maven plugin only when you build your own copy locally, not downloading a pre-build release. Just to confirm my guess from doing a lot of local development on the tool, can you confirm the following?

1. What Maven command did you specifically run mvn ... to get this error?
2. More generally, was your intent to build it locally? Just download the pre-built, signed release our sage, trustworthy community maintainers built in GitHub Actions?

UPDATE: I also realized that is not super helpful, some more follow on. Re 1 and 2, I will presume you wanted to quickly download the pre-built version. Some people know Maven supports this with a popular plugin. It is not the recommended way, but I do this quickly when using a Java environment where Maven is preinstalled to get things up and running. Perhaps you are looking for this?

# Current version of the plugin below is 3.8.0, read maven.org docs or use LATEST
# Check docs to periodically update 
# Run Maven
$ mvn \
  # With the current stable version of maven-dependency-plugin using the get command
  org.apache.maven.plugins:maven-dependency-plugin:3.8.0:get \
  # With the official OSS Maven central repo, URL below, yes you need /maven2 at the end
 -DremoteRepositories=https://repo1.maven.org/maven2 \
  # And download version 2.0.2 of the CLI
 -Dartifact=dev.metaschema.oscal:oscal-cli-enhanced:2.0.2

Or with the LATEST alias for the plugin and the CLI:

# Run Maven
$ mvn \
  # With the LATEST stable version of maven-dependency-plugin using the get command
  org.apache.maven.plugins:maven-dependency-plugin:LATEST:get \
  # With the official OSS Maven central repo, URL below, yes you need /maven2 at the end
 -DremoteRepositories=https://repo1.maven.org/maven2 \
  # And download the LATEST version of the CLI
 -Dartifact=dev.metaschema.oscal:oscal-cli-enhanced:LATEST

Now, if you look into ~/.m2/repositories/dev/metaschema/oscal/oscal-cli-enhanced/2.0.2 you will see that this gives you _only- the bare JAR archives and the XML metadata from Maven. This is the stripped down version and does not seem to include the full installer with the convenience shell script and things, and that is why this not the recommended method. I hope that helps. I had to test locally and writing about a gnarly CLASSPATH and necessary CLI args by hand is not so pleasant, which is why downloading with curl or wget is a heck of a lot easier.

1. I ran mvn install. I essentially followed the instructions from: https://github.com/usnistgov/oscal-cli but maybe the installation for this 2.0.2 is not the same process compared to 1.0.3

2, For right now I want to setup the system locally and validate real world data but I also want to set it up in AWS Cloud 9 in the future.

The OSCAL CLI 2.0.2 that I used was downloaded from: https://github.com/metaschema-framework/oscal-cli/releases/tag/v2.0.2 and then I tried to do the maven install. Which is why I can see that it gives me the git error now.

Are the curl/wget methods of installing the new CLI available? Or are those the instructions that are being setup for release?

[aj-stein-gsa]

1. I ran mvn install. I essentially followed the instructions from: https://github.com/usnistgov/oscal-cli but maybe the installation for this 2.0.2 is not the same process compared to 1.0.3

Understood. I would follow this repo's official documentation from now on. I want to also update the docs here and the NIST repo to make it more clear. More to follow later on that front.

2, For right now I want to setup the system locally and validate real world data but I also want to set it up in AWS Cloud 9 in the future.

The OSCAL CLI 2.0.2 that I used was downloaded from: https://github.com/metaschema-framework/oscal-cli/releases/tag/v2.0.2 and then I tried to do the maven install. Which is why I can see that it gives me the git error now.

Are the curl/wget methods of installing the new CLI available? Or are those the instructions that are being setup for release?

I think not on either. I will address that feedback with PRs for the README here and the usnistgov repo to keep it consistent. Thanks for the question.

Also, heads up, I did figure out how to make it work with Maven the way you wanted, so I will add that full thing to the READMEs PR as you would benefit from. See edits to #16 (comment).

[aj-stein-gsa]

I found a pretty efficient one-line with Maven that is even better for #21, @JoseGHdz. Dave will review for final approval, your feedback welcome. I tested this a few times and it combines a few steps with less error-prone, manual commands.

[JoseGHdz]

I found a pretty efficient one-line with Maven that is even better for #21, @JoseGHdz. Dave will review for final approval, your feedback welcome. I tested this a few times and it combines a few steps with less error-prone, manual commands.

I got it to work! I had to do some extra steps because it was not working, but the following steps worked for my MacOS system:

1. Install Maven if not Installed.

% brew install maven

2. Check Maven Version

% mvn -v

3. Download & Install oscal-cli using Maven

% mvn org.apache.maven.plugins:maven-dependency-plugin:LATEST:get
-DremoteRepositories=https://repo1.maven.org/maven2
-Dartifact=dev.metaschema.oscal:oscal-cli-enhanced:LATEST:zip:oscal-cli

4. Set the OSCAL_CLI_PATH

% export OSCAL_CLI_PATH=$HOME/.m2/repository/dev/metaschema/oscal/oscal-cli-enhanced/2.0.2

5. Unzip the downloaded items.

% pushd $OSCAL_CLI_PATH
% sudo unzip *.zip
% popd

6. Add oscal-cli to PATH

% nano ~/.zshrc

Insert the following line at the end of the file.

% export PATH=$PATH:$HOME/.m2/repository/dev/metaschema/oscal/oscal-cli-enhanced/2.0.2/bin

7. Apply Changes

% source ~/.zshrc

8. Verify the installation

% oscal-cli --version

Output: oscal-cli 2.0.2 built at 2024-08-20 13:19 from branch...

[aj-stein-gsa]

got it to work! I had to do some extra steps because it was not working, but the following steps worked for my MacOS system:

Glad you got it to work. If you want to have the full path with version to have specific versions of the CLI for testing you may want to look into tools like asdf and community tooling to handle all that for you. Glad you got it sorted out thought. I used the copy method to ensure I drop it in once custom folder and only needing to edit the path once. I would love feedback on the PR if you have any recommendations or concerns with that approach before it's hopefully merged.

[JoseGHdz]

got it to work! I had to do some extra steps because it was not working, but the following steps worked for my MacOS system:

Glad you got it to work. If you want to have the full path with version to have specific versions of the CLI for testing you may want to look into tools like asdf and community tooling to handle all that for you. Glad you got it sorted out thought. I used the copy method to ensure I drop it in once custom folder and only needing to edit the path once. I would love feedback on the PR if you have any recommendations or concerns with that approach before it's hopefully merged.

The only feedback is, would it be possible to integrate an automatic update mechanism for future CLI versions? For example, oscal-cli --update? For the future it would be much easier to update the cli that way instead of manually doing the whole update through the terminal. Just a thought that I had.

[aj-stein-gsa]

The only feedback is, would it be possible to integrate an automatic update mechanism for future CLI versions?

That usually means package manager integration (so for Mac, for example brew.sh). That is totally worth considering, but will have to discuss with other maintainers and figure out how to establish a brew repository and research similar Java apps deployed there.