Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CodeQL codesign error message #2043

Open
rnychyporuk-rbi opened this issue Dec 18, 2023 · 29 comments
Open

CodeQL codesign error message #2043

rnychyporuk-rbi opened this issue Dec 18, 2023 · 29 comments

Comments

@rnychyporuk-rbi
Copy link

We`re workin on CodeQL Static Application Security Testing (SAST) implementation for a Swift language using GitHub Actions. During this process, I encountered an issue with the CodeQL initialization step when integrating with a Fastlane-based build process.

When including the CodeQL initialization step (github/codeql-action/init@v2) in the GitHub Actions workflow before Fastlane-based build commands, the build job fails with a CodeSign error. The specific error message indicates that the CodeSign command has failed.

Interesting Behavior: if I remove the CodeQL initialization step from the GitHub Actions workflow, the build application process works perfectly without any issues - application builds well.

Error message from console output:

▸ ** ARCHIVE FAILED **
▸ The following build commands failed:
▸ 	CodeSign /Users/runner/Library/Developer/Xcode/DerivedData/APP-amdyapuwajsvoeelnrjmqpntrblu/Build/Intermediates.noindex/ArchiveIntermediates/APP_straging/IntermediateBuildFilesPath/UninstalledProducts/iphoneos/SaleforceNotificationService_staging.appex (in target 'SaleforceNotificationService_staging' from project 'APP')
▸ (1 failure)

From debug logs we got below entries:

/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/install_name_tool: warning: changes being made to the file will invalidate the code signature in: /Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang-stat-cache.semmle.00008433.slice.x86_64
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang-stat-cache.semmle.00008433.slice.x86_64: replacing existing signature
/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/install_name_tool: warning: changes being made to the file will invalidate the code signature in: /Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang-stat-cache.semmle.00008433.slice.arm64
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang-stat-cache.semmle.00008433.slice.arm64: replacing existing signature
[T 17:01:12 33906] Attempting to switch stdout/stderr to 7...
[T 17:01:12 33908] Attempting to switch stdout/stderr to 7...
[T 17:01:12 33909] Attempting to switch stdout/stderr to 7...
[T 17:01:12 33913] Attempting to switch stdout/stderr to 7...
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/usr/bin/codesign.semmle.00008433.145DE1E8.slice.x86_64: replacing existing signature
[T 17:01:12 33914] Attempting to switch stdout/stderr to 7...
[T 17:01:12 33912] Initializing tracer.
[T 17:01:12 33912] Initialising tags...
[T 17:01:12 33912] ID set to 0000000000008478_0000000000000001 (parent 0000000000008433_0000000000000001)
[T 17:01:12 33912] ==== Candidate to intercept: /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang-stat-cache (canonical: /Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang-stat-cache) ====
[T 17:01:12 33912] Executing the following tracer actions:
[T 17:01:12 33912] Tracer actions:
[T 17:01:12 33912] pre_invocations(0)
[T 17:01:12 33912] post_invocations(0)
[T 17:01:12 33912] trace_languages(1): [swift]
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/usr/bin/codesign.semmle.00008433.slice.x86_64: replacing existing signature
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/usr/bin/codesign.semmle.00008433.slice.x86_64: replacing existing signature
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/usr/bin/codesign.semmle.00008433.slice.x86_64: replacing existing signature
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/usr/bin/codesign.semmle.00008433.slice.x86_64: replacing existing signature

Why codeql replace signature and is it the case for failing our scan ?

@aibaars
Copy link
Collaborator

aibaars commented Dec 18, 2023

CodeQL traces the build process to figure out how source files are compiled and against which libraries/header files etc. To do this it uses the DYLD_INSERT_LIBRARIES environment variable to inject the CodeQL tracer into the running build process. On macOS the use of DYLD_INSERT_LIBRARIES is restricted when System Integrity Protection is enabled (it is on by default). System Integrity Protection removes the DYLD_INSERT_LIBRARIES variable from the environment for any binaries it considers to be part of the "system" (for example binaries installed in /usr/bin). To side-step these limitations, the CodeQL tracer copies binaries to a different folder (codeql_databases/working/copy-root) before running them. This copying may invalidate the original signature, so CodeQL provides them with new signatures.

The lines from the build-tracer.log above show that the CodeQL tracer is re-signing /usr/bin/clang-stat-cache which is normal. However, also see /usr/bin/codesign being re-signed, and perhaps that is causing problems. I'll ask the team to have a look.

In the mean time, could you try disabling CodeSigning for your build? CodeQL analysis only needs to intercept compiler processes, steps like packaging and signing are not important for the CodeQL scan.

@aibaars
Copy link
Collaborator

aibaars commented Dec 18, 2023

@rnychyporuk-rbi Hopefully github/codeql#15134 will fix the problem.

@adityasharad
Copy link
Contributor

This will be fixed in CodeQL 2.15.5.

@rnychyporuk-rbi
Copy link
Author

rnychyporuk-rbi commented Dec 26, 2023

Thank you @adityasharad .
Sorry for the question but how to specify 2.15.15 version for CodeQL Init Action (github/codeql-action/init@v2). I tried to force a couple options but none of them works. CodeQL Init action initialise 2.15.0 version - so I still get the same codesign error

  Found CodeQL tools version 2.15.0 in the toolcache.
  /Users/runner/actions-runner/_work/_tool/CodeQL/2.15.0/x64/codeql/codeql version --format=json
  {
    "productName" : "CodeQL",
    "vendor" : "GitHub",
    "version" : "2.15.0",
    "sha" : "d0c03afb046bf4964cf4c",
    "branches" : [
      "codeql-cli-2.15.0"
    ],
    "copyright" : "Copyright (C) 2019-2023 GitHub, Inc.",
    "unpackedLocation" : "/Users/runner/actions-runner/_work/_tool/CodeQL/2.15.0/x64/codeql",
    "configFileLocation" : "/Users/runner/.config/codeql/config",
    "configFileFound" : false,
    "features" : {
      "featuresInVersionResult" : true,
      "supportsPython312" : true
    }
  }

@aibaars
Copy link
Collaborator

aibaars commented Dec 27, 2023

Have you tried the tools: option? You can set it to the URL of a codeql bundle asset from the releases page of the github/codeql-action repository.

@jakobholmgrenhiq
Copy link

jakobholmgrenhiq commented Jan 4, 2024

I am running into a similar issue when building with fastlane where my action gets stuck on the codesigning step only when CodeQL is initialized prior to building.

The failing command is the following:
set -o pipefail && xcodebuild -workspace ./REDACTED.xcodeproj/project.xcworkspace -scheme REDACTED -configuration QA-Release -destination 'generic/platform=iOS' -archivePath ./build.xcarchive archive | tee /Users/runner/Library/Logs/gym/REDACTED\ QA.log | xcbeautify

In my case, the action gets stuck indefinitely with the last readable output being the following:
[13:03:49]: ▸ Signing REDACTED.framework (in target 'REDACTED' from project 'REDACTED')

This step usually completes in seconds but will get stuck until the action times out or is cancelled. This does not happen for the exact same pipeline without CodeQL.

The initialization, build, and analysis steps looks as follows:

      - name: Initialize CodeQL
        uses: github/codeql-action/[email protected]
        with:
          languages: swift
          queries: security-and-quality
          tools: https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.15.5/codeql-bundle-osx64.tar.gz

      - name: Build QA
         REDACTED fastlane step

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/[email protected]
        with:
          category: "/language:swift"

Runner: macos-13
Xcode-version: 15.0.1

Let me know if there is any additional information I should provide!

@aibaars
Copy link
Collaborator

aibaars commented Jan 4, 2024

@jakobholmgrenhiq Thanks for the detailed report! Could you try re-running the workflow with debug logging enabled? In that case the codeql-action uploads a debug artifact. The debug artifact contains a file log/build-tracer.log . Could you have a look at that file and post any lines that have the word codesign in them?

@AlexDenisov FYI

@jakobholmgrenhiq
Copy link

@jakobholmgrenhiq Thanks for the detailed report! Could you try re-running the workflow with debug logging enabled? In that case the codeql-action uploads a debug artifact. The debug artifact contains a file log/build-tracer.log . Could you have a look at that file and post any lines that have the word codesign in them?

@AlexDenisov FYI

First match is unique:

[T 13:21:58 9563] Attempting to switch stdout/stderr to 6...
/Users/runner/work/_temp/codeql_databases/working/copy-root/000001F5/usr/bin/codesign.semmle.000023CF.0A82CBC0.slice.x86_64: replacing existing signature
/Users/runner/work/_temp/codeql_databases/working/copy-root/000001F5/Applications/Xcode_15.0.1.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang-stat-cache.semmle.000023CF.09925910.slice.x86_64: replacing existing signature
/Users/runner/work/_temp/codeql_databases/working/copy-root/000001F5/usr/bin/codesign.semmle.000023CF.0B6BD7E8.slice.x86_64: replacing existing signature
/Users/runner/work/_temp/codeql_databases/working/copy-root/000001F5/usr/bin/codesign.semmle.000023CF.0BE22128.slice.x86_64: replacing existing signature

Rest looks as follows with slight variations:

[T 13:21:58 9570] Initializing tracer.
[T 13:21:58 9570] Initialising tags...
[T 13:21:58 9570] ID set to 0000000000002562_0000000000000001 (parent 00000000000023CF_0000000000000001)
[T 13:21:58 9570] ==== Candidate to intercept: /usr/bin/codesign (canonical: /usr/bin/codesign) ====
[T 13:21:58 9570] Lua: === Intercepted call to /usr/bin/codesign ===
[T 13:21:58 9570] Lua: Disabling tracing for language swift.
[T 13:21:58 9570] Executing the following tracer actions:
[T 13:21:58 9570] Tracer actions:
[T 13:21:58 9570] pre_invocations(0)
[T 13:21:58 9570] post_invocations(0)
[T 13:21:58 9570] trace_languages(0): []
[T 13:21:58 9570] Disabling tracing for this command.
/Applications/Xcode_15.0.1.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/install_name_tool: warning: changes being made to the file will invalidate the code signature in: /Users/runner/work/_temp/codeql_databases/working/copy-root/000001F5/Applications/Xcode_15.0.1.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang-stat-cache.semmle.000023CF.09925910.slice.arm64
[T 13:21:58 9573] Initializing tracer.
[T 13:21:58 9573] Initialising tags...
[T 13:21:58 9573] ID set to 0000000000002565_0000000000000001 (parent 00000000000023CF_0000000000000001)
[T 13:21:58 9573] ==== Candidate to intercept: /usr/bin/codesign (canonical: /usr/bin/codesign) ====
[T 13:21:58 9573] Lua: === Intercepted call to /usr/bin/codesign ===
[T 13:21:58 9573] Lua: Disabling tracing for language swift.
[T 13:21:58 9573] Executing the following tracer actions:
[T 13:21:58 9573] Tracer actions:
[T 13:21:58 9573] pre_invocations(0)
[T 13:21:58 9573] post_invocations(0)
[T 13:21:58 9573] trace_languages(0): []
[T 13:21:58 9573] Disabling tracing for this command.
/Users/runner/work/_temp/codeql_databases/working/copy-root/000001F5/Applications/Xcode_15.0.1.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/clang-stat-cache.semmle.000023CF.09925910.slice.arm64: replacing existing signature

Let me know if you want me to attach more complete logs.

@aibaars
Copy link
Collaborator

aibaars commented Jan 4, 2024

Thanks!

@AlexDenisov I see that tracing is disabled after intercepting /usr/bin/codesign, however, I still see re-signed versions of codesign in the copy-root folder so I guess github/codeql@6cbf8ab did not entirely have the desired effect. I had expected that the tracer would skip all the SIP avoidance once it was turned "off". I suppose this is because it is only turned off for swift, and there could in theory still be another language that requires tracing of the process.

@angelapwen
Copy link
Contributor

Is there any downside to adding the fix from github/codeql@6cbf8ab to all traced languages? If not we can try that out and see how it goes.

@jakobholmgrenhiq
Copy link

Let me know if I can assist by testing some release candidate, if at all possible, in our pipelines to see if it resolves it.

@aibaars
Copy link
Collaborator

aibaars commented Jan 10, 2024

Is there any downside to adding the fix from github/codeql@6cbf8ab to all traced languages? If not we can try that out and see how it goes.

I'm afraid that the above fix doesn't actually work. Even with trace: false the tracer will still relocate binaries, and I believe codesign does not "like" being relocated.

@aeisenberg
Copy link
Contributor

Any ideas on other ways we can solve this? Perhaps we can special-case codesign so that it's not even relocated?

@angelapwen
Copy link
Contributor

Following up — yes, Alex had a PR for exactly that in https://github.com/github/semmle-code/pull/48593 but it had to be reverted because it was failing integration tests on SIP-disabled ARM runners. I believe Alex is now working on the (separate) fix behind that issue https://github.com/github/codeql-c-team/issues/2160 and then https://github.com/github/semmle-code/pull/48593 can go in again. So, this issue is blocked on https://github.com/github/codeql-c-team/issues/2160 (correct me if wrong!)

@jakobholmgrenhiq
Copy link

Sorry to bump this if it is still blocked on another issue (which I sadly cant check before posting as it is internal). Do you have any estimates on when we can see this resolved?

@aeisenberg
Copy link
Contributor

No worries asking for an update. We are actively working on a fix. I can't make any promises on when it will be released. We will have more clarity next week as we collect more data.

@aeisenberg
Copy link
Contributor

This fix is unlikely to make it into the next CodeQL release 2.16.2, which is expected this week.

@SviatikLetsin
Copy link

SviatikLetsin commented Feb 28, 2024

We are still receiving the same issue with "replacing existing signature" using CodeQL 2.16.3:

[T 08:32:07 67951] Attempting to switch stdout/stderr to 3...
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/Applications/Xcode.app/Contents/Developer/usr/bin/git.semmle.0001096B.29181888.slice.x86_64: replacing existing signature
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/Applications/Xcode.app/Contents/Developer/usr/bin/git.semmle.0001096B.29181888.slice.arm64: replacing existing signature
[T 08:32:07 67947] Initializing tracer.
[T 08:32:07 67947] Initializing tags.

codeql version --format=json
{
  "productName" : "CodeQL",
  "vendor" : "GitHub",
  "version" : "2.16.3",
  "sha" : "89973abb6e1d3083dfb8426eb0e210df19ca36be"

Could you notify me about the progress, and when it might be fixed?

@aeisenberg
Copy link
Contributor

This appears to be a different problem. Previously, the error was with the codesign binary. Now, there are log messages about resigning the relocated git binary. This in and of itself isn't a problem.

Can you share more of your log that has the error message?

@SviatikLetsin
Copy link

Here is the whole log file:

[T 08:32:01 67898] Initializing tracer.
[T 08:32:01 67898] Initializing tags.
[T 08:32:01 67898] ID set to 000000000001093A_0000000000000001 (parent root)
[T 08:32:01 67898] Warning: SEMMLE_EXEC and SEMMLE_EXECP not set. Falling back to path lookup on argv[0].
[T 08:32:01 67898] ==== Candidate to intercept: df (canonical: /bin/df) ====
[T 08:32:01 67898] Executing the following tracer actions:
[T 08:32:01 67898] Tracer actions:
[T 08:32:01 67898] pre_invocations(0)
[T 08:32:01 67898] post_invocations(0)
[T 08:32:01 67898] trace_languages(1): [swift]
[T 08:32:03 67899] Initializing tracer.
[T 08:32:03 67899] Initializing tags.
[T 08:32:03 67899] ID set to 000000000001093B_0000000000000001 (parent root)
[T 08:32:03 67899] Warning: SEMMLE_EXEC and SEMMLE_EXECP not set. Falling back to path lookup on argv[0].
[T 08:32:03 67899] ==== Candidate to intercept: /Users/runner/actions-runner/externals/node16/bin/node (canonical: /Users/runner/actions-runner/externals/node16/bin/node) ====
[T 08:32:03 67899] Executing the following tracer actions:
[T 08:32:03 67899] Tracer actions:
[T 08:32:03 67899] pre_invocations(0)
[T 08:32:03 67899] post_invocations(0)
[T 08:32:03 67899] trace_languages(1): [swift]
[T 08:32:03 67901] Attempting to switch stdout/stderr to 5...
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/bin/df.semmle.0001093C.23844518.slice.x86_64: replacing existing signature
[T 08:32:03 67900] Initializing tracer.
[T 08:32:03 67900] Initializing tags.
[T 08:32:03 67900] ID set to 000000000001093C_0000000000000001 (parent 000000000001093B_0000000000000001)
[T 08:32:03 67900] ==== Candidate to intercept: /bin/df (canonical: /bin/df) ====
[T 08:32:03 67900] Executing the following tracer actions:
[T 08:32:03 67900] Tracer actions:
[T 08:32:03 67900] pre_invocations(0)
[T 08:32:03 67900] post_invocations(0)
[T 08:32:03 67900] trace_languages(1): [swift]
[T 08:32:03 67905] Attempting to switch stdout/stderr to 5...
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/bin/sh.semmle.00010940.36F67328.slice.x86_64: replacing existing signature
[T 08:32:03 67904] Initializing tracer.
[T 08:32:03 67904] Initializing tags.
[T 08:32:03 67904] ID set to 0000000000010940_0000000000000001 (parent 000000000001093B_0000000000000001)
[T 08:32:03 67904] ==== Candidate to intercept: /Users/runner/actions-runner/_work/_tool/CodeQL/2.16.3/x64/codeql/codeql (canonical: /Users/runner/actions-runner/_work/_tool/CodeQL/2.16.3/x64/codeql/codeql) ====
[T 08:32:03 67904] Executing the following tracer actions:
[T 08:32:03 67904] Tracer actions:
[T 08:32:03 67904] pre_invocations(0)
[T 08:32:03 67904] post_invocations(0)
[T 08:32:03 67904] trace_languages(1): [swift]
[T 08:32:03 67908] Attempting to switch stdout/stderr to 3...
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/bin/bash.semmle.00010940.39C84068.slice.x86_64: replacing existing signature
[T 08:32:04 67904] Initializing tracer.
[T 08:32:04 67904] Initializing tags.
[T 08:32:04 67904] ID set to 0000000000010940_0000000000000002 (parent 0000000000010940_0000000000000001)
[T 08:32:04 67904] ==== Candidate to intercept: /bin/bash (canonical: /bin/bash) ====
[T 08:32:04 67904] Executing the following tracer actions:
[T 08:32:04 67904] Tracer actions:
[T 08:32:04 67904] pre_invocations(0)
[T 08:32:04 67904] post_invocations(0)
[T 08:32:04 67904] trace_languages(1): [swift]
[T 08:32:04 67912] Attempting to switch stdout/stderr to 3...
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/usr/bin/uname.semmle.00010947.01AB46D0.slice.x86_64: replacing existing signature
[T 08:32:04 67911] Initializing tracer.
[T 08:32:04 67911] Initializing tags.
[T 08:32:04 67911] ID set to 0000000000010947_0000000000000001 (parent 0000000000010940_0000000000000002)
[T 08:32:04 67911] ==== Candidate to intercept: /usr/bin/uname (canonical: /usr/bin/uname) ====
[T 08:32:04 67911] Executing the following tracer actions:
[T 08:32:04 67911] Tracer actions:
[T 08:32:04 67911] pre_invocations(0)
[T 08:32:04 67911] post_invocations(0)
[T 08:32:04 67911] trace_languages(1): [swift]
[T 08:32:04 67916] Attempting to switch stdout/stderr to 3...
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/usr/bin/mktemp.semmle.0001094B.04840950.slice.x86_64: replacing existing signature
[T 08:32:04 67915] Initializing tracer.
[T 08:32:04 67915] Initializing tags.
[T 08:32:04 67915] ID set to 000000000001094B_0000000000000001 (parent 0000000000010940_0000000000000002)
[T 08:32:04 67915] ==== Candidate to intercept: /usr/bin/mktemp (canonical: /usr/bin/mktemp) ====
[T 08:32:04 67915] Executing the following tracer actions:
[T 08:32:04 67915] Tracer actions:
[T 08:32:04 67915] pre_invocations(0)
[T 08:32:04 67915] post_invocations(0)
[T 08:32:04 67915] trace_languages(1): [swift]
[T 08:32:04 67920] Attempting to switch stdout/stderr to 3...
/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/install_name_tool: warning: changes being made to the file will invalidate the code signature in: /Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/Users/runner/actions-runner/_work/_tool/CodeQL/2.16.3/x64/codeql/tools/osx64/java/bin/java.semmle.0001094F.076ABE20.slice.x86_64
/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin/install_name_tool: warning: changes being made to the file will invalidate the code signature in: /Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/Users/runner/actions-runner/_work/_tool/CodeQL/2.16.3/x64/codeql/tools/osx64/java/bin/java.semmle.0001094F.076ABE20.slice.x86_64
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/Users/runner/actions-runner/_work/_tool/CodeQL/2.16.3/x64/codeql/tools/osx64/java/bin/java.semmle.0001094F.076ABE20.slice.x86_64: replacing existing signature
[T 08:32:04 67919] Initializing tracer.
[T 08:32:04 67919] Initializing tags.
[T 08:32:04 67919] ID set to 000000000001094F_0000000000000001 (parent 0000000000010940_0000000000000002)
[T 08:32:04 67919] ==== Candidate to intercept: /Users/runner/actions-runner/_work/_tool/CodeQL/2.16.3/x64/codeql/tools/osx64/java/bin/java (canonical: /Users/runner/actions-runner/_work/_tool/CodeQL/2.16.3/x64/codeql/tools/osx64/java/bin/java) ====
[T 08:32:04 67919] Executing the following tracer actions:
[T 08:32:04 67919] Tracer actions:
[T 08:32:04 67919] pre_invocations(0)
[T 08:32:04 67919] post_invocations(0)
[T 08:32:04 67919] trace_languages(1): [swift]
[T 08:32:04 67919] Loading extra JVM options from SEMMLE_JAVA_TOOL_OPTIONS instead of in-process variable.
[T 08:32:04 67919] Warning: Ignored JNI_CreateJavaVM because codeql_extra_jvm_options/SEMMLE_JAVA_TOOL_OPTIONS is not set. JVM tracing is disabled for this process.
[T 08:32:04 67926] Attempting to switch stdout/stderr to 3...
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/bin/rm.semmle.00010955.258E0380.slice.x86_64: replacing existing signature
[T 08:32:04 67925] Initializing tracer.
[T 08:32:04 67925] Initializing tags.
[T 08:32:04 67925] ID set to 0000000000010955_0000000000000001 (parent 0000000000010940_0000000000000002)
[T 08:32:04 67925] ==== Candidate to intercept: /bin/rm (canonical: /bin/rm) ====
[T 08:32:04 67925] Executing the following tracer actions:
[T 08:32:04 67925] Tracer actions:
[T 08:32:04 67925] pre_invocations(0)
[T 08:32:04 67925] post_invocations(0)
[T 08:32:04 67925] trace_languages(1): [swift]
[T 08:32:04 67929] Initializing tracer.
[T 08:32:04 67929] Initializing tags.
[T 08:32:04 67929] ID set to 0000000000010959_0000000000000001 (parent 000000000001093B_0000000000000001)
[T 08:32:04 67929] ==== Candidate to intercept: /Users/runner/actions-runner/_work/_tool/CodeQL/2.16.3/x64/codeql/codeql (canonical: /Users/runner/actions-runner/_work/_tool/CodeQL/2.16.3/x64/codeql/codeql) ====
[T 08:32:04 67929] Executing the following tracer actions:
[T 08:32:04 67929] Tracer actions:
[T 08:32:04 67929] pre_invocations(0)
[T 08:32:04 67929] post_invocations(0)
[T 08:32:04 67929] trace_languages(1): [swift]
[T 08:32:04 67929] Initializing tracer.
[T 08:32:04 67929] Initializing tags.
[T 08:32:04 67929] ID set to 0000000000010959_0000000000000002 (parent 0000000000010959_0000000000000001)
[T 08:32:04 67929] ==== Candidate to intercept: /bin/bash (canonical: /bin/bash) ====
[T 08:32:04 67929] Executing the following tracer actions:
[T 08:32:04 67929] Tracer actions:
[T 08:32:04 67929] pre_invocations(0)
[T 08:32:04 67929] post_invocations(0)
[T 08:32:04 67929] trace_languages(1): [swift]
[T 08:32:04 67930] Initializing tracer.
[T 08:32:04 67930] Initializing tags.
[T 08:32:04 67930] ID set to 000000000001095A_0000000000000001 (parent 0000000000010959_0000000000000002)
[T 08:32:04 67930] ==== Candidate to intercept: /usr/bin/uname (canonical: /usr/bin/uname) ====
[T 08:32:04 67930] Executing the following tracer actions:
[T 08:32:04 67930] Tracer actions:
[T 08:32:04 67930] pre_invocations(0)
[T 08:32:04 67930] post_invocations(0)
[T 08:32:04 67930] trace_languages(1): [swift]
[T 08:32:04 67931] Initializing tracer.
[T 08:32:04 67931] Initializing tags.
[T 08:32:04 67931] ID set to 000000000001095B_0000000000000001 (parent 0000000000010959_0000000000000002)
[T 08:32:04 67931] ==== Candidate to intercept: /usr/bin/mktemp (canonical: /usr/bin/mktemp) ====
[T 08:32:04 67931] Executing the following tracer actions:
[T 08:32:04 67931] Tracer actions:
[T 08:32:04 67931] pre_invocations(0)
[T 08:32:04 67931] post_invocations(0)
[T 08:32:04 67931] trace_languages(1): [swift]
[T 08:32:04 67932] Initializing tracer.
[T 08:32:04 67932] Initializing tags.
[T 08:32:04 67932] ID set to 000000000001095C_0000000000000001 (parent 0000000000010959_0000000000000002)
[T 08:32:04 67932] ==== Candidate to intercept: /Users/runner/actions-runner/_work/_tool/CodeQL/2.16.3/x64/codeql/tools/osx64/java/bin/java (canonical: /Users/runner/actions-runner/_work/_tool/CodeQL/2.16.3/x64/codeql/tools/osx64/java/bin/java) ====
[T 08:32:04 67932] Executing the following tracer actions:
[T 08:32:04 67932] Tracer actions:
[T 08:32:04 67932] pre_invocations(0)
[T 08:32:04 67932] post_invocations(0)
[T 08:32:04 67932] trace_languages(1): [swift]
[T 08:32:04 67932] Loading extra JVM options from SEMMLE_JAVA_TOOL_OPTIONS instead of in-process variable.
[T 08:32:04 67932] Warning: Ignored JNI_CreateJavaVM because codeql_extra_jvm_options/SEMMLE_JAVA_TOOL_OPTIONS is not set. JVM tracing is disabled for this process.
[T 08:32:05 67933] Initializing tracer.
[T 08:32:05 67933] Initializing tags.
[T 08:32:05 67933] ID set to 000000000001095D_0000000000000001 (parent 0000000000010959_0000000000000002)
[T 08:32:05 67933] ==== Candidate to intercept: /bin/rm (canonical: /bin/rm) ====
[T 08:32:05 67933] Executing the following tracer actions:
[T 08:32:05 67933] Tracer actions:
[T 08:32:05 67933] pre_invocations(0)
[T 08:32:05 67933] post_invocations(0)
[T 08:32:05 67933] trace_languages(1): [swift]
[T 08:32:05 67934] Initializing tracer.
[T 08:32:05 67934] Initializing tags.
[T 08:32:05 67934] ID set to 000000000001095E_0000000000000001 (parent 000000000001093B_0000000000000001)
[T 08:32:05 67934] ==== Candidate to intercept: /bin/df (canonical: /bin/df) ====
[T 08:32:05 67934] Executing the following tracer actions:
[T 08:32:05 67934] Tracer actions:
[T 08:32:05 67934] pre_invocations(0)
[T 08:32:05 67934] post_invocations(0)
[T 08:32:05 67934] trace_languages(1): [swift]
[T 08:32:05 67935] Initializing tracer.
[T 08:32:05 67935] Initializing tags.
[T 08:32:05 67935] ID set to 000000000001095F_0000000000000001 (parent root)
[T 08:32:05 67935] Warning: SEMMLE_EXEC and SEMMLE_EXECP not set. Falling back to path lookup on argv[0].
[T 08:32:05 67935] ==== Candidate to intercept: /Users/runner/actions-runner/externals/node16/bin/node (canonical: /Users/runner/actions-runner/externals/node16/bin/node) ====
[T 08:32:05 67935] Executing the following tracer actions:
[T 08:32:05 67935] Tracer actions:
[T 08:32:05 67935] pre_invocations(0)
[T 08:32:05 67935] post_invocations(0)
[T 08:32:05 67935] trace_languages(1): [swift]
[T 08:32:05 67936] Initializing tracer.
[T 08:32:05 67936] Initializing tags.
[T 08:32:05 67936] ID set to 0000000000010960_0000000000000001 (parent root)
[T 08:32:05 67936] Warning: SEMMLE_EXEC and SEMMLE_EXECP not set. Falling back to path lookup on argv[0].
[T 08:32:05 67936] ==== Candidate to intercept: /Users/runner/actions-runner/externals/node16/bin/node (canonical: /Users/runner/actions-runner/externals/node16/bin/node) ====
[T 08:32:05 67936] Executing the following tracer actions:
[T 08:32:05 67936] Tracer actions:
[T 08:32:05 67936] pre_invocations(0)
[T 08:32:05 67936] post_invocations(0)
[T 08:32:05 67936] trace_languages(1): [swift]
[T 08:32:06 67937] Initializing tracer.
[T 08:32:06 67937] Initializing tags.
[T 08:32:06 67937] ID set to 0000000000010961_0000000000000001 (parent 0000000000010960_0000000000000001)
[T 08:32:06 67937] ==== Candidate to intercept: /Users/runner/actions-runner/_work/_tool/CodeQL/2.16.3/x64/codeql/codeql (canonical: /Users/runner/actions-runner/_work/_tool/CodeQL/2.16.3/x64/codeql/codeql) ====
[T 08:32:06 67937] Executing the following tracer actions:
[T 08:32:06 67937] Tracer actions:
[T 08:32:06 67937] pre_invocations(0)
[T 08:32:06 67937] post_invocations(0)
[T 08:32:06 67937] trace_languages(1): [swift]
[T 08:32:06 67937] Initializing tracer.
[T 08:32:06 67937] Initializing tags.
[T 08:32:06 67937] ID set to 0000000000010961_0000000000000002 (parent 0000000000010961_0000000000000001)
[T 08:32:06 67937] ==== Candidate to intercept: /bin/bash (canonical: /bin/bash) ====
[T 08:32:06 67937] Executing the following tracer actions:
[T 08:32:06 67937] Tracer actions:
[T 08:32:06 67937] pre_invocations(0)
[T 08:32:06 67937] post_invocations(0)
[T 08:32:06 67937] trace_languages(1): [swift]
[T 08:32:06 67938] Initializing tracer.
[T 08:32:06 67938] Initializing tags.
[T 08:32:06 67938] ID set to 0000000000010962_0000000000000001 (parent 0000000000010961_0000000000000002)
[T 08:32:06 67938] ==== Candidate to intercept: /usr/bin/uname (canonical: /usr/bin/uname) ====
[T 08:32:06 67938] Executing the following tracer actions:
[T 08:32:06 67938] Tracer actions:
[T 08:32:06 67938] pre_invocations(0)
[T 08:32:06 67938] post_invocations(0)
[T 08:32:06 67938] trace_languages(1): [swift]
[T 08:32:06 67939] Initializing tracer.
[T 08:32:06 67939] Initializing tags.
[T 08:32:06 67939] ID set to 0000000000010963_0000000000000001 (parent 0000000000010961_0000000000000002)
[T 08:32:06 67939] ==== Candidate to intercept: /usr/bin/mktemp (canonical: /usr/bin/mktemp) ====
[T 08:32:06 67939] Executing the following tracer actions:
[T 08:32:06 67939] Tracer actions:
[T 08:32:06 67939] pre_invocations(0)
[T 08:32:06 67939] post_invocations(0)
[T 08:32:06 67939] trace_languages(1): [swift]
[T 08:32:06 67940] Initializing tracer.
[T 08:32:06 67940] Initializing tags.
[T 08:32:06 67940] ID set to 0000000000010964_0000000000000001 (parent 0000000000010961_0000000000000002)
[T 08:32:06 67940] ==== Candidate to intercept: /Users/runner/actions-runner/_work/_tool/CodeQL/2.16.3/x64/codeql/tools/osx64/java/bin/java (canonical: /Users/runner/actions-runner/_work/_tool/CodeQL/2.16.3/x64/codeql/tools/osx64/java/bin/java) ====
[T 08:32:06 67940] Executing the following tracer actions:
[T 08:32:06 67940] Tracer actions:
[T 08:32:06 67940] pre_invocations(0)
[T 08:32:06 67940] post_invocations(0)
[T 08:32:06 67940] trace_languages(1): [swift]
[T 08:32:06 67940] Loading extra JVM options from SEMMLE_JAVA_TOOL_OPTIONS instead of in-process variable.
[T 08:32:06 67940] Warning: Ignored JNI_CreateJavaVM because codeql_extra_jvm_options/SEMMLE_JAVA_TOOL_OPTIONS is not set. JVM tracing is disabled for this process.
[T 08:32:06 67941] Initializing tracer.
[T 08:32:06 67941] Initializing tags.
[T 08:32:06 67941] ID set to 0000000000010965_0000000000000001 (parent 0000000000010961_0000000000000002)
[T 08:32:06 67941] ==== Candidate to intercept: /bin/rm (canonical: /bin/rm) ====
[T 08:32:06 67941] Executing the following tracer actions:
[T 08:32:06 67941] Tracer actions:
[T 08:32:06 67941] pre_invocations(0)
[T 08:32:06 67941] post_invocations(0)
[T 08:32:06 67941] trace_languages(1): [swift]
[T 08:32:06 67942] Initializing tracer.
[T 08:32:06 67942] Initializing tags.
[T 08:32:06 67942] ID set to 0000000000010966_0000000000000001 (parent 0000000000010960_0000000000000001)
[T 08:32:06 67942] ==== Candidate to intercept: /Users/runner/actions-runner/_work/_tool/CodeQL/2.16.3/x64/codeql/codeql (canonical: /Users/runner/actions-runner/_work/_tool/CodeQL/2.16.3/x64/codeql/codeql) ====
[T 08:32:06 67942] Executing the following tracer actions:
[T 08:32:06 67942] Tracer actions:
[T 08:32:06 67942] pre_invocations(0)
[T 08:32:06 67942] post_invocations(0)
[T 08:32:06 67942] trace_languages(1): [swift]
[T 08:32:06 67942] Initializing tracer.
[T 08:32:06 67942] Initializing tags.
[T 08:32:06 67942] ID set to 0000000000010966_0000000000000002 (parent 0000000000010966_0000000000000001)
[T 08:32:06 67942] ==== Candidate to intercept: /bin/bash (canonical: /bin/bash) ====
[T 08:32:06 67942] Executing the following tracer actions:
[T 08:32:06 67942] Tracer actions:
[T 08:32:06 67942] pre_invocations(0)
[T 08:32:06 67942] post_invocations(0)
[T 08:32:06 67942] trace_languages(1): [swift]
[T 08:32:07 67943] Initializing tracer.
[T 08:32:07 67943] Initializing tags.
[T 08:32:07 67943] ID set to 0000000000010967_0000000000000001 (parent 0000000000010966_0000000000000002)
[T 08:32:07 67943] ==== Candidate to intercept: /usr/bin/uname (canonical: /usr/bin/uname) ====
[T 08:32:07 67943] Executing the following tracer actions:
[T 08:32:07 67943] Tracer actions:
[T 08:32:07 67943] pre_invocations(0)
[T 08:32:07 67943] post_invocations(0)
[T 08:32:07 67943] trace_languages(1): [swift]
[T 08:32:07 67944] Initializing tracer.
[T 08:32:07 67944] Initializing tags.
[T 08:32:07 67944] ID set to 0000000000010968_0000000000000001 (parent 0000000000010966_0000000000000002)
[T 08:32:07 67944] ==== Candidate to intercept: /usr/bin/mktemp (canonical: /usr/bin/mktemp) ====
[T 08:32:07 67944] Executing the following tracer actions:
[T 08:32:07 67944] Tracer actions:
[T 08:32:07 67944] pre_invocations(0)
[T 08:32:07 67944] post_invocations(0)
[T 08:32:07 67944] trace_languages(1): [swift]
[T 08:32:07 67945] Initializing tracer.
[T 08:32:07 67945] Initializing tags.
[T 08:32:07 67945] ID set to 0000000000010969_0000000000000001 (parent 0000000000010966_0000000000000002)
[T 08:32:07 67945] ==== Candidate to intercept: /Users/runner/actions-runner/_work/_tool/CodeQL/2.16.3/x64/codeql/tools/osx64/java/bin/java (canonical: /Users/runner/actions-runner/_work/_tool/CodeQL/2.16.3/x64/codeql/tools/osx64/java/bin/java) ====
[T 08:32:07 67945] Executing the following tracer actions:
[T 08:32:07 67945] Tracer actions:
[T 08:32:07 67945] pre_invocations(0)
[T 08:32:07 67945] post_invocations(0)
[T 08:32:07 67945] trace_languages(1): [swift]
[T 08:32:07 67945] Loading extra JVM options from SEMMLE_JAVA_TOOL_OPTIONS instead of in-process variable.
[T 08:32:07 67945] Warning: Ignored JNI_CreateJavaVM because codeql_extra_jvm_options/SEMMLE_JAVA_TOOL_OPTIONS is not set. JVM tracing is disabled for this process.
[T 08:32:07 67946] Initializing tracer.
[T 08:32:07 67946] Initializing tags.
[T 08:32:07 67946] ID set to 000000000001096A_0000000000000001 (parent 0000000000010966_0000000000000002)
[T 08:32:07 67946] ==== Candidate to intercept: /bin/rm (canonical: /bin/rm) ====
[T 08:32:07 67946] Executing the following tracer actions:
[T 08:32:07 67946] Tracer actions:
[T 08:32:07 67946] pre_invocations(0)
[T 08:32:07 67946] post_invocations(0)
[T 08:32:07 67946] trace_languages(1): [swift]
[T 08:32:07 67948] Attempting to switch stdout/stderr to 5...
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/usr/bin/git.semmle.0001096B.25A91D00.slice.x86_64: replacing existing signature
[T 08:32:07 67947] Initializing tracer.
[T 08:32:07 67947] Initializing tags.
[T 08:32:07 67947] ID set to 000000000001096B_0000000000000001 (parent 0000000000010960_0000000000000001)
[T 08:32:07 67947] ==== Candidate to intercept: /usr/bin/git (canonical: /usr/bin/git) ====
[T 08:32:07 67947] Executing the following tracer actions:
[T 08:32:07 67947] Tracer actions:
[T 08:32:07 67947] pre_invocations(0)
[T 08:32:07 67947] post_invocations(0)
[T 08:32:07 67947] trace_languages(1): [swift]
[T 08:32:07 67951] Attempting to switch stdout/stderr to 3...
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/Applications/Xcode.app/Contents/Developer/usr/bin/git.semmle.0001096B.29181888.slice.x86_64: replacing existing signature
/Users/runner/actions-runner/_work/_temp/codeql_databases/working/copy-root/000001F6/Applications/Xcode.app/Contents/Developer/usr/bin/git.semmle.0001096B.29181888.slice.arm64: replacing existing signature
[T 08:32:07 67947] Initializing tracer.
[T 08:32:07 67947] Initializing tags.
[T 08:32:07 67947] ID set to 000000000001096B_0000000000000002 (parent 000000000001096B_0000000000000001)
[T 08:32:07 67947] ==== Candidate to intercept: /Applications/Xcode.app/Contents/Developer/usr/bin/git (canonical: /Applications/Xcode.app/Contents/Developer/usr/bin/git) ====
[T 08:32:07 67947] Executing the following tracer actions:
[T 08:32:07 67947] Tracer actions:
[T 08:32:07 67947] pre_invocations(0)
[T 08:32:07 67947] post_invocations(0)
[T 08:32:07 67947] trace_languages(1): [swift]

We are receving such error in the action:

  CodeQL detected code written in Swift but could not process any of it. Review our troubleshooting guide at https://gh.io/troubleshooting-code-scanning/no-source-code-seen-during-build .
  Error: Encountered a fatal error while running "/Users/runner/actions-runner/_work/_tool/CodeQL/2.16.3/x64/codeql/codeql database finalize --finalize-dataset --threads=12 --ram=30515 /Users/runner/actions-runner/_work/_temp/codeql_databases/swift". Exit code was 32 and last log line was: CodeQL detected code written in Swift but could not process any of it. Review our troubleshooting guide at https://gh.io/troubleshooting-code-scanning/no-source-code-seen-during-build . See the logs for more details.

@aibaars
Copy link
Collaborator

aibaars commented Feb 29, 2024

That log looks really short . I don't see any mention of the xcodebuild command in the tracer log. So either the build command isn't run or somehow it is not even seen by the tracer.

@AlexDenisov What do you think?

@rnychyporuk-rbi
Copy link
Author

Hey guys. Do we have any updates o this?

@redsun82
Copy link
Contributor

redsun82 commented Mar 11, 2024

👋 @rnychyporuk-rbi

As @aibaars points out, it's weird that the log terminates mentioning a git invocation without ever seeming to trace an actual xcode build as was the case previously.

Are you using default setup or the autobuild action? Or did you provide a custom build step? If you did not use default setup, could you provide a snippet of the codeql workflow you used? Could the build step exit early with success based on some git command result?

@jakobholmgrenhiq
Copy link

Let me know if I can provide any additional information to help progress this issue.

@ls-valentinas-bakaitis
Copy link

Hi @aeisenberg @redsun82 ,

I an having a similar issue where the fastlane will build successfully without CodeQL, but when CodeQL steps are added - the build fails.

@aeisenberg
Copy link
Contributor

@ls-valentinas-bakaitis, can you please create a new issue for this? This issue has gotten a bit convoluted and it's no longer clear what each new report is. In this new issue, please include your logs (especially the tracer logs, redacted is 👍) and your workflow file.

@ls-valentinas-bakaitis
Copy link

@aeisenberg I have submitted a new issue here: #2347

@mtengmo
Copy link

mtengmo commented Dec 10, 2024

Got the same issue:
2024-12-10T10:27:44.1722681Z ##[section]Starting: AdvancedSecurityCodeqlAnalyze
2024-12-10T10:27:44.1728592Z ==============================================================================
2024-12-10T10:27:44.1728720Z Task : Advanced Security Perform CodeQL analysis
2024-12-10T10:27:44.1728815Z Description : Finalizes the CodeQL database and runs the analysis queries.
2024-12-10T10:27:44.1728917Z Version : 1.1.299
2024-12-10T10:27:44.1729002Z Author : Microsoft Corporation
2024-12-10T10:27:44.1729080Z Help : https://aka.ms/advanced-security/code-scanning/detection
2024-12-10T10:27:44.1729168Z ==============================================================================
2024-12-10T10:27:44.7008822Z Session Id=ec8f953c-1a22-4c5c-94d1-bf31778bc137
2024-12-10T10:27:44.7011052Z Starting database finalization.
2024-12-10T10:27:44.7011346Z Database finalization is a time consuming process and may take a while to complete.
2024-12-10T10:27:44.7053508Z ##[group]Finalizing java
2024-12-10T10:27:44.7075791Z [command]C:\hostedtoolcache\windows\CodeQL\2.19.3\x64\codeql\codeql.exe database finalize --finalize-dataset --threads=0 --ram=4444 D:\a_temp\advancedsecurity.codeql\d\java
2024-12-10T10:27:46.7525947Z CodeQL did not detect any code written in languages supported by this CodeQL distribution (C/C++, C#, CSV, Go, HTML, Java/Kotlin, JavaScript/TypeScript, Java Properties Files, Python, Ruby, Swift, XML or YAML). Confirm that there is some source code for one of these languages in the project. For more information, review our troubleshooting guide at https://gh.io/troubleshooting-code-scanning/no-source-code-seen-during-build.
2024-12-10T10:27:46.8266707Z ##[endgroup]
2024-12-10T10:27:46.8341760Z ##[warning] Error running the 'database finalize' CodeQL command (32)
2024-12-10T10:27:46.8359770Z ##[error]Error running the 'database finalize' CodeQL command (32)
2024-12-10T10:27:46.8375231Z
2024-12-10T10:27:46.8375633Z ====================================================================================================
2024-12-10T10:27:46.8376008Z Analyzing CodeQL execution results.
2024-12-10T10:27:46.8376288Z CodeQL analysis finished with exit code 32.
2024-12-10T10:27:46.8376605Z Please refer to this document for guidance to troubleshoot https://aka.ms/codeQL-error-32
2024-12-10T10:27:46.8376962Z ====================================================================================================
2024-12-10T10:27:46.8377193Z
2024-12-10T10:27:46.8377443Z Learn more about the scan for the CodeQL build tasks:
2024-12-10T10:27:46.8377738Z https://aka.ms/advanced-security/code-scanning/detection
2024-12-10T10:27:46.8377922Z
2024-12-10T10:27:46.8571247Z ##[section]Finishing: AdvancedSecurityCodeqlAnalyze

@aeisenberg
Copy link
Contributor

@mtengmo, are you running in Azure DevOps? If so, please contact support for ADO. When you do, be sure to include the full set of logs for the tracer.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

10 participants