Skip to content

Have muzzle checks use internal artifact proxy - #8775

Merged
randomanderson merged 2 commits into
masterfrom
landerson/muzzle-internal-proxy
May 7, 2025
Merged

Have muzzle checks use internal artifact proxy#8775
randomanderson merged 2 commits into
masterfrom
landerson/muzzle-internal-proxy

Conversation

@randomanderson

Copy link
Copy Markdown
Contributor

What Does This Do

Follow up to #8554 and #8592 . Has muzzle use the internal proxy. Additionally, special case repositories were moved from the muzzle plugin to the extraRepository directive of individual projects.

Testing was done by remove central as a repository to ensure muzzle still passed with only the proxy working.

Motivation

Muzzle checks were not using the internal proxy and susceptible to maven central rate limits

Contributor Checklist

Jira ticket: [PROJ-IDENT]

@randomanderson
randomanderson requested review from a team as code ownersMay 6, 2025 23:26
@randomandersonrandomanderson added comp: testing Testing tag: no release notes Changes to exclude from release notes labels May 6, 2025
@pr-commenter

pr-commenterBot commented May 7, 2025

Copy link
Copy Markdown

Benchmarks

Startup

Parameters

BaselineCandidate
baseline_or_candidatebaselinecandidate
git_branchmasterlanderson/muzzle-internal-proxy
git_commit_date17466234951746624137
git_commit_sha6c8da4d07996ea
release_version1.50.0-SNAPSHOT~6c8da4d60a1.50.0-SNAPSHOT~07996ea361
See matching parameters
BaselineCandidate
applicationinsecure-bankinsecure-bank
ci_job_date17466270351746627035
ci_job_id927881146927881146
ci_pipeline_id6439563264395632
cpu_modelIntel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHzIntel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_versionLinux runner-gmcb38w3-project-304-concurrent-1-yg1wvhcl 6.8.0-1027-aws #29~22.04.1-Ubuntu SMP Sun Mar 30 07:45:38 UTC 2025 x86_64 x86_64 x86_64 GNU/LinuxLinux runner-gmcb38w3-project-304-concurrent-1-yg1wvhcl 6.8.0-1027-aws #29~22.04.1-Ubuntu SMP Sun Mar 30 07:45:38 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
moduleAgentAgent
parentNoneNone
variantiastiast

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 57 metrics, 14 unstable metrics.

Startup time reports for insecure-bank
gantt
title insecure-bank - global startup overhead: candidate=1.50.0-SNAPSHOT~07996ea361, baseline=1.50.0-SNAPSHOT~6c8da4d60a
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.024 s) : 0, 1024102
Total [baseline] (8.67 s) : 0, 8670125
Agent [candidate] (1.022 s) : 0, 1021660
Total [candidate] (8.637 s) : 0, 8636766
section iast
Agent [baseline] (1.146 s) : 0, 1146242
Total [baseline] (9.195 s) : 0, 9194811
Agent [candidate] (1.15 s) : 0, 1149996
Total [candidate] (9.216 s) : 0, 9215567
section iast_HARDCODED_SECRET_DISABLED
Agent [baseline] (1.15 s) : 0, 1150392
Total [baseline] (9.217 s) : 0, 9216988
Agent [candidate] (1.159 s) : 0, 1158742
Total [candidate] (9.236 s) : 0, 9236044
section iast_TELEMETRY_OFF
Agent [baseline] (1.16 s) : 0, 1160496
Total [baseline] (9.283 s) : 0, 9283306
Agent [candidate] (1.146 s) : 0, 1145735
Total [candidate] (9.208 s) : 0, 9208277
Loading
  • baseline results
ModuleVariantDurationΔ tracing
Agenttracing1.024 s-
Agentiast1.146 s122.141 ms (11.9%)
Agentiast_HARDCODED_SECRET_DISABLED1.15 s126.29 ms (12.3%)
Agentiast_TELEMETRY_OFF1.16 s136.395 ms (13.3%)
Totaltracing8.67 s-
Totaliast9.195 s524.687 ms (6.1%)
Totaliast_HARDCODED_SECRET_DISABLED9.217 s546.863 ms (6.3%)
Totaliast_TELEMETRY_OFF9.283 s613.181 ms (7.1%)
  • candidate results
ModuleVariantDurationΔ tracing
Agenttracing1.022 s-
Agentiast1.15 s128.337 ms (12.6%)
Agentiast_HARDCODED_SECRET_DISABLED1.159 s137.082 ms (13.4%)
Agentiast_TELEMETRY_OFF1.146 s124.075 ms (12.1%)
Totaltracing8.637 s-
Totaliast9.216 s578.8 ms (6.7%)
Totaliast_HARDCODED_SECRET_DISABLED9.236 s599.277 ms (6.9%)
Totaliast_TELEMETRY_OFF9.208 s571.511 ms (6.6%)
gantt
title insecure-bank - break down per module: candidate=1.50.0-SNAPSHOT~07996ea361, baseline=1.50.0-SNAPSHOT~6c8da4d60a
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (683.907 ms) : 0, 683907
BytebuddyAgent [candidate] (683.138 ms) : 0, 683138
GlobalTracer [baseline] (240.446 ms) : 0, 240446
GlobalTracer [candidate] (240.257 ms) : 0, 240257
AppSec [baseline] (55.246 ms) : 0, 55246
AppSec [candidate] (54.345 ms) : 0, 54345
Debugger [baseline] (10.581 ms) : 0, 10581
Debugger [candidate] (8.357 ms) : 0, 8357
Remote Config [baseline] (683.289 µs) : 0, 683
Remote Config [candidate] (696.877 µs) : 0, 697
Telemetry [baseline] (9.686 ms) : 0, 9686
Telemetry [candidate] (11.338 ms) : 0, 11338
section iast
BytebuddyAgent [baseline] (799.572 ms) : 0, 799572
BytebuddyAgent [candidate] (802.822 ms) : 0, 802822
GlobalTracer [baseline] (230.123 ms) : 0, 230123
GlobalTracer [candidate] (230.749 ms) : 0, 230749
IAST [baseline] (26.872 ms) : 0, 26872
IAST [candidate] (28.284 ms) : 0, 28284
AppSec [baseline] (51.903 ms) : 0, 51903
AppSec [candidate] (49.499 ms) : 0, 49499
Debugger [baseline] (5.933 ms) : 0, 5933
Debugger [candidate] (5.923 ms) : 0, 5923
Remote Config [baseline] (609.467 µs) : 0, 609
Remote Config [candidate] (591.92 µs) : 0, 592
Telemetry [baseline] (7.887 ms) : 0, 7887
Telemetry [candidate] (7.899 ms) : 0, 7899
section iast_HARDCODED_SECRET_DISABLED
BytebuddyAgent [baseline] (802.64 ms) : 0, 802640
BytebuddyAgent [candidate] (809.22 ms) : 0, 809220
GlobalTracer [baseline] (230.811 ms) : 0, 230811
GlobalTracer [candidate] (232.068 ms) : 0, 232068
IAST [baseline] (26.631 ms) : 0, 26631
IAST [candidate] (23.018 ms) : 0, 23018
AppSec [baseline] (52.275 ms) : 0, 52275
AppSec [candidate] (54.642 ms) : 0, 54642
Debugger [baseline] (5.94 ms) : 0, 5940
Debugger [candidate] (5.989 ms) : 0, 5989
Remote Config [baseline] (590.685 µs) : 0, 591
Remote Config [candidate] (588.144 µs) : 0, 588
Telemetry [baseline] (7.963 ms) : 0, 7963
Telemetry [candidate] (7.992 ms) : 0, 7992
section iast_TELEMETRY_OFF
BytebuddyAgent [baseline] (810.841 ms) : 0, 810841
BytebuddyAgent [candidate] (798.759 ms) : 0, 798759
GlobalTracer [baseline] (232.756 ms) : 0, 232756
GlobalTracer [candidate] (230.751 ms) : 0, 230751
IAST [baseline] (23.525 ms) : 0, 23525
IAST [candidate] (22.283 ms) : 0, 22283
AppSec [baseline] (55.286 ms) : 0, 55286
AppSec [candidate] (56.105 ms) : 0, 56105
Debugger [baseline] (5.978 ms) : 0, 5978
Debugger [candidate] (5.936 ms) : 0, 5936
Remote Config [baseline] (609.957 µs) : 0, 610
Remote Config [candidate] (598.214 µs) : 0, 598
Telemetry [baseline] (7.88 ms) : 0, 7880
Telemetry [candidate] (7.811 ms) : 0, 7811
Loading
Startup time reports for petclinic
gantt
title petclinic - global startup overhead: candidate=1.50.0-SNAPSHOT~07996ea361, baseline=1.50.0-SNAPSHOT~6c8da4d60a
dateFormat X
axisFormat %s
section tracing
Agent [baseline] (1.03 s) : 0, 1029941
Total [baseline] (10.51 s) : 0, 10510495
Agent [candidate] (1.025 s) : 0, 1024851
Total [candidate] (10.473 s) : 0, 10473420
section appsec
Agent [baseline] (1.164 s) : 0, 1164252
Total [baseline] (10.671 s) : 0, 10670697
Agent [candidate] (1.167 s) : 0, 1167080
Total [candidate] (10.739 s) : 0, 10738615
section iast
Agent [baseline] (1.154 s) : 0, 1153633
Total [baseline] (10.934 s) : 0, 10934206
Agent [candidate] (1.163 s) : 0, 1163378
Total [candidate] (10.861 s) : 0, 10861094
section profiling
Agent [baseline] (1.273 s) : 0, 1273433
Total [baseline] (10.855 s) : 0, 10854900
Agent [candidate] (1.283 s) : 0, 1282668
Total [candidate] (10.91 s) : 0, 10910383
Loading
  • baseline results
ModuleVariantDurationΔ tracing
Agenttracing1.03 s-
Agentappsec1.164 s134.31 ms (13.0%)
Agentiast1.154 s123.692 ms (12.0%)
Agentprofiling1.273 s243.491 ms (23.6%)
Totaltracing10.51 s-
Totalappsec10.671 s160.202 ms (1.5%)
Totaliast10.934 s423.711 ms (4.0%)
Totalprofiling10.855 s344.405 ms (3.3%)
  • candidate results
ModuleVariantDurationΔ tracing
Agenttracing1.025 s-
Agentappsec1.167 s142.229 ms (13.9%)
Agentiast1.163 s138.527 ms (13.5%)
Agentprofiling1.283 s257.817 ms (25.2%)
Totaltracing10.473 s-
Totalappsec10.739 s265.196 ms (2.5%)
Totaliast10.861 s387.674 ms (3.7%)
Totalprofiling10.91 s436.963 ms (4.2%)
gantt
title petclinic - break down per module: candidate=1.50.0-SNAPSHOT~07996ea361, baseline=1.50.0-SNAPSHOT~6c8da4d60a
dateFormat X
axisFormat %s
section tracing
BytebuddyAgent [baseline] (688.892 ms) : 0, 688892
BytebuddyAgent [candidate] (687.846 ms) : 0, 687846
GlobalTracer [baseline] (241.705 ms) : 0, 241705
GlobalTracer [candidate] (240.315 ms) : 0, 240315
AppSec [baseline] (56.071 ms) : 0, 56071
AppSec [candidate] (55.094 ms) : 0, 55094
Debugger [baseline] (9.842 ms) : 0, 9842
Debugger [candidate] (7.618 ms) : 0, 7618
Remote Config [baseline] (692.946 µs) : 0, 693
Remote Config [candidate] (684.573 µs) : 0, 685
Telemetry [baseline] (9.072 ms) : 0, 9072
Telemetry [candidate] (9.766 ms) : 0, 9766
section appsec
BytebuddyAgent [baseline] (701.963 ms) : 0, 701963
BytebuddyAgent [candidate] (704.575 ms) : 0, 704575
GlobalTracer [baseline] (237.857 ms) : 0, 237857
GlobalTracer [candidate] (237.205 ms) : 0, 237205
AppSec [baseline] (176.025 ms) : 0, 176025
AppSec [candidate] (176.412 ms) : 0, 176412
Debugger [baseline] (5.983 ms) : 0, 5983
Debugger [candidate] (6.336 ms) : 0, 6336
Remote Config [baseline] (614.751 µs) : 0, 615
Remote Config [candidate] (633.244 µs) : 0, 633
Telemetry [baseline] (7.387 ms) : 0, 7387
Telemetry [candidate] (7.449 ms) : 0, 7449
IAST [baseline] (21.875 ms) : 0, 21875
IAST [candidate] (21.781 ms) : 0, 21781
section iast
BytebuddyAgent [baseline] (804.552 ms) : 0, 804552
BytebuddyAgent [candidate] (813.477 ms) : 0, 813477
GlobalTracer [baseline] (231.774 ms) : 0, 231774
GlobalTracer [candidate] (232.884 ms) : 0, 232884
AppSec [baseline] (54.565 ms) : 0, 54565
AppSec [candidate] (51.113 ms) : 0, 51113
Debugger [baseline] (5.971 ms) : 0, 5971
Debugger [candidate] (5.909 ms) : 0, 5909
Remote Config [baseline] (597.754 µs) : 0, 598
Remote Config [candidate] (595.212 µs) : 0, 595
Telemetry [baseline] (7.984 ms) : 0, 7984
Telemetry [candidate] (7.944 ms) : 0, 7944
IAST [baseline] (23.803 ms) : 0, 23803
IAST [candidate] (26.248 ms) : 0, 26248
section profiling
ProfilingAgent [baseline] (103.192 ms) : 0, 103192
ProfilingAgent [candidate] (103.553 ms) : 0, 103553
BytebuddyAgent [baseline] (672.465 ms) : 0, 672465
BytebuddyAgent [candidate] (678.78 ms) : 0, 678780
GlobalTracer [baseline] (377.899 ms) : 0, 377899
GlobalTracer [candidate] (380.153 ms) : 0, 380153
AppSec [baseline] (54.472 ms) : 0, 54472
AppSec [candidate] (54.184 ms) : 0, 54184
Debugger [baseline] (6.155 ms) : 0, 6155
Debugger [candidate] (6.231 ms) : 0, 6231
Remote Config [baseline] (714.009 µs) : 0, 714
Remote Config [candidate] (691.664 µs) : 0, 692
Telemetry [baseline] (8.166 ms) : 0, 8166
Telemetry [candidate] (8.204 ms) : 0, 8204
Profiling [baseline] (103.218 ms) : 0, 103218
Profiling [candidate] (103.578 ms) : 0, 103578
Loading

Load

Parameters

BaselineCandidate
baseline_or_candidatebaselinecandidate
end_time2025-05-07T13:40:472025-05-07T13:48:33
git_branchmasterlanderson/muzzle-internal-proxy
git_commit_date17466234951746624137
git_commit_sha6c8da4d07996ea
release_version1.50.0-SNAPSHOT~6c8da4d60a1.50.0-SNAPSHOT~07996ea361
start_time2025-05-07T13:40:322025-05-07T13:48:19
See matching parameters
BaselineCandidate
applicationinsecure-bankinsecure-bank
ci_job_date17466261141746626114
ci_job_id927881147927881147
ci_pipeline_id6439563264395632
cpu_modelIntel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHzIntel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_versionLinux runner-brbdd7pm-project-304-concurrent-1-gscaebps 6.8.0-1027-aws #29~22.04.1-Ubuntu SMP Sun Mar 30 07:45:38 UTC 2025 x86_64 x86_64 x86_64 GNU/LinuxLinux runner-brbdd7pm-project-304-concurrent-1-gscaebps 6.8.0-1027-aws #29~22.04.1-Ubuntu SMP Sun Mar 30 07:45:38 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
variantiastiast

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 18 unstable metrics.

Request duration reports for petclinic
gantt
title petclinic - request duration [CI 0.99] : candidate=1.50.0-SNAPSHOT~07996ea361, baseline=1.50.0-SNAPSHOT~6c8da4d60a
dateFormat X
axisFormat %s
section baseline
no_agent (1.357 ms) : 1337, 1376
. : milestone, 1357,
appsec (1.749 ms) : 1725, 1772
. : milestone, 1749,
appsec_no_iast (1.746 ms) : 1722, 1769
. : milestone, 1746,
code_origins (1.68 ms) : 1653, 1707
. : milestone, 1680,
iast (1.518 ms) : 1494, 1542
. : milestone, 1518,
profiling (1.513 ms) : 1489, 1537
. : milestone, 1513,
tracing (1.495 ms) : 1469, 1520
. : milestone, 1495,
section candidate
no_agent (1.354 ms) : 1334, 1373
. : milestone, 1354,
appsec (1.758 ms) : 1734, 1782
. : milestone, 1758,
appsec_no_iast (1.745 ms) : 1722, 1769
. : milestone, 1745,
code_origins (1.687 ms) : 1660, 1714
. : milestone, 1687,
iast (1.509 ms) : 1485, 1533
. : milestone, 1509,
profiling (1.505 ms) : 1481, 1529
. : milestone, 1505,
tracing (1.514 ms) : 1490, 1538
. : milestone, 1514,
Loading
  • baseline results
VariantRequest duration [CI 0.99]Δ no_agent
no_agent1.357 ms [1.337 ms, 1.376 ms]-
appsec1.749 ms [1.725 ms, 1.772 ms]392.217 µs (28.9%)
appsec_no_iast1.746 ms [1.722 ms, 1.769 ms]389.089 µs (28.7%)
code_origins1.68 ms [1.653 ms, 1.707 ms]323.581 µs (23.9%)
iast1.518 ms [1.494 ms, 1.542 ms]161.852 µs (11.9%)
profiling1.513 ms [1.489 ms, 1.537 ms]156.868 µs (11.6%)
tracing1.495 ms [1.469 ms, 1.52 ms]138.007 µs (10.2%)
  • candidate results
VariantRequest duration [CI 0.99]Δ no_agent
no_agent1.354 ms [1.334 ms, 1.373 ms]-
appsec1.758 ms [1.734 ms, 1.782 ms]404.535 µs (29.9%)
appsec_no_iast1.745 ms [1.722 ms, 1.769 ms]391.724 µs (28.9%)
code_origins1.687 ms [1.66 ms, 1.714 ms]333.393 µs (24.6%)
iast1.509 ms [1.485 ms, 1.533 ms]155.48 µs (11.5%)
profiling1.505 ms [1.481 ms, 1.529 ms]151.324 µs (11.2%)
tracing1.514 ms [1.49 ms, 1.538 ms]160.22 µs (11.8%)
Request duration reports for insecure-bank
gantt
title insecure-bank - request duration [CI 0.99] : candidate=1.50.0-SNAPSHOT~07996ea361, baseline=1.50.0-SNAPSHOT~6c8da4d60a
dateFormat X
axisFormat %s
section baseline
no_agent (385.697 µs) : 365, 406
. : milestone, 386,
iast (526.035 µs) : 504, 548
. : milestone, 526,
iast_FULL (743.065 µs) : 721, 765
. : milestone, 743,
iast_GLOBAL (578.739 µs) : 556, 601
. : milestone, 579,
iast_HARDCODED_SECRET_DISABLED (522.305 µs) : 500, 545
. : milestone, 522,
iast_INACTIVE (474.936 µs) : 452, 498
. : milestone, 475,
iast_TELEMETRY_OFF (510.522 µs) : 488, 534
. : milestone, 511,
tracing (466.257 µs) : 444, 488
. : milestone, 466,
section candidate
no_agent (388.268 µs) : 369, 408
. : milestone, 388,
iast (531.621 µs) : 507, 556
. : milestone, 532,
iast_FULL (743.323 µs) : 721, 765
. : milestone, 743,
iast_GLOBAL (569.317 µs) : 547, 591
. : milestone, 569,
iast_HARDCODED_SECRET_DISABLED (524.689 µs) : 503, 546
. : milestone, 525,
iast_INACTIVE (474.391 µs) : 452, 497
. : milestone, 474,
iast_TELEMETRY_OFF (512.905 µs) : 490, 536
. : milestone, 513,
tracing (467.043 µs) : 445, 489
. : milestone, 467,
Loading
  • baseline results
VariantRequest duration [CI 0.99]Δ no_agent
no_agent385.697 µs [365.355 µs, 406.038 µs]-
iast526.035 µs [504.26 µs, 547.81 µs]140.339 µs (36.4%)
iast_FULL743.065 µs [720.968 µs, 765.162 µs]357.369 µs (92.7%)
iast_GLOBAL578.739 µs [556.382 µs, 601.095 µs]193.042 µs (50.1%)
iast_HARDCODED_SECRET_DISABLED522.305 µs [499.653 µs, 544.958 µs]136.609 µs (35.4%)
iast_INACTIVE474.936 µs [452.12 µs, 497.753 µs]89.24 µs (23.1%)
iast_TELEMETRY_OFF510.522 µs [487.534 µs, 533.51 µs]124.825 µs (32.4%)
tracing466.257 µs [444.212 µs, 488.302 µs]80.56 µs (20.9%)
  • candidate results
VariantRequest duration [CI 0.99]Δ no_agent
no_agent388.268 µs [368.544 µs, 407.993 µs]-
iast531.621 µs [507.138 µs, 556.103 µs]143.352 µs (36.9%)
iast_FULL743.323 µs [721.386 µs, 765.261 µs]355.055 µs (91.4%)
iast_GLOBAL569.317 µs [547.149 µs, 591.486 µs]181.049 µs (46.6%)
iast_HARDCODED_SECRET_DISABLED524.689 µs [502.987 µs, 546.391 µs]136.42 µs (35.1%)
iast_INACTIVE474.391 µs [451.998 µs, 496.783 µs]86.122 µs (22.2%)
iast_TELEMETRY_OFF512.905 µs [489.671 µs, 536.139 µs]124.637 µs (32.1%)
tracing467.043 µs [444.643 µs, 489.444 µs]78.775 µs (20.3%)

Dacapo

@PerfectSlayerPerfectSlayer left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you know what is impact of using getenv() on Gradle build cache (rather than some API based on provider or something, hard to remember which one works the best with there env cache)

cc @bric3

@bric3

bric3 commented May 7, 2025

Copy link
Copy Markdown
Contributor

@randomanderson@PerfectSlayer Configuration cache should work as these calls are intercepted I believe, see here.

However providers.environmentVariable would be preferred for configuration avoidance as providers are lazy. That being said, the remotes are created in a static initializer that do not have access to the project instance, which needs to be changed first to be able to use providers.

@PerfectSlayerPerfectSlayer left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for your feedback!
Let's try it then and revisit this later 😉

@randomanderson
randomandersonforce-pushed the landerson/muzzle-internal-proxy branch from 5ae3e73 to 07996eaCompareMay 7, 2025 13:22
@randomanderson
randomanderson merged commit 746a7fd into masterMay 7, 2025
@randomanderson
randomanderson deleted the landerson/muzzle-internal-proxy branch May 7, 2025 14:36
@github-actionsgithub-actionsBot added this to the 1.50.0 milestone May 7, 2025
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

comp: testingTestingtag: no release notesChanges to exclude from release notes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants

@randomanderson@bric3@PerfectSlayer