Skip to content

Conversation

@randomanderson
Copy link
Contributor

What Does This Do

Follow up to #8554 and #8592 . Has muzzle use the internal proxy. Additionally, special case repositories were moved from the muzzle plugin to the extraRepository directive of individual projects.

Testing was done by remove central as a repository to ensure muzzle still passed with only the proxy working.

Motivation

Muzzle checks were not using the internal proxy and susceptible to maven central rate limits

Contributor Checklist

Jira ticket: [PROJ-IDENT]

@randomanderson randomanderson requested review from a team as code owners May 6, 2025 23:26
@randomanderson randomanderson added comp: testing Testing tag: no release notes Changes to exclude from release notes labels May 6, 2025
@randomanderson randomanderson requested a review from mcculls May 6, 2025 23:26
@pr-commenter
Copy link

pr-commenter bot commented May 7, 2025

Benchmarks

Startup

Parameters

Baseline Candidate
baseline_or_candidate baseline candidate
git_branch master landerson/muzzle-internal-proxy
git_commit_date 1746623495 1746624137
git_commit_sha 6c8da4d 07996ea
release_version 1.50.0-SNAPSHOT~6c8da4d60a 1.50.0-SNAPSHOT~07996ea361
See matching parameters
Baseline Candidate
application insecure-bank insecure-bank
ci_job_date 1746627035 1746627035
ci_job_id 927881146 927881146
ci_pipeline_id 64395632 64395632
cpu_model Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version Linux runner-gmcb38w3-project-304-concurrent-1-yg1wvhcl 6.8.0-1027-aws #29~22.04.1-Ubuntu SMP Sun Mar 30 07:45:38 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux Linux runner-gmcb38w3-project-304-concurrent-1-yg1wvhcl 6.8.0-1027-aws #29~22.04.1-Ubuntu SMP Sun Mar 30 07:45:38 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
module Agent Agent
parent None None
variant iast iast

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 57 metrics, 14 unstable metrics.

Startup time reports for insecure-bank
gantt
    title insecure-bank - global startup overhead: candidate=1.50.0-SNAPSHOT~07996ea361, baseline=1.50.0-SNAPSHOT~6c8da4d60a

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.024 s) : 0, 1024102
Total [baseline] (8.67 s) : 0, 8670125
Agent [candidate] (1.022 s) : 0, 1021660
Total [candidate] (8.637 s) : 0, 8636766
section iast
Agent [baseline] (1.146 s) : 0, 1146242
Total [baseline] (9.195 s) : 0, 9194811
Agent [candidate] (1.15 s) : 0, 1149996
Total [candidate] (9.216 s) : 0, 9215567
section iast_HARDCODED_SECRET_DISABLED
Agent [baseline] (1.15 s) : 0, 1150392
Total [baseline] (9.217 s) : 0, 9216988
Agent [candidate] (1.159 s) : 0, 1158742
Total [candidate] (9.236 s) : 0, 9236044
section iast_TELEMETRY_OFF
Agent [baseline] (1.16 s) : 0, 1160496
Total [baseline] (9.283 s) : 0, 9283306
Agent [candidate] (1.146 s) : 0, 1145735
Total [candidate] (9.208 s) : 0, 9208277
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 1.024 s -
Agent iast 1.146 s 122.141 ms (11.9%)
Agent iast_HARDCODED_SECRET_DISABLED 1.15 s 126.29 ms (12.3%)
Agent iast_TELEMETRY_OFF 1.16 s 136.395 ms (13.3%)
Total tracing 8.67 s -
Total iast 9.195 s 524.687 ms (6.1%)
Total iast_HARDCODED_SECRET_DISABLED 9.217 s 546.863 ms (6.3%)
Total iast_TELEMETRY_OFF 9.283 s 613.181 ms (7.1%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 1.022 s -
Agent iast 1.15 s 128.337 ms (12.6%)
Agent iast_HARDCODED_SECRET_DISABLED 1.159 s 137.082 ms (13.4%)
Agent iast_TELEMETRY_OFF 1.146 s 124.075 ms (12.1%)
Total tracing 8.637 s -
Total iast 9.216 s 578.8 ms (6.7%)
Total iast_HARDCODED_SECRET_DISABLED 9.236 s 599.277 ms (6.9%)
Total iast_TELEMETRY_OFF 9.208 s 571.511 ms (6.6%)
gantt
    title insecure-bank - break down per module: candidate=1.50.0-SNAPSHOT~07996ea361, baseline=1.50.0-SNAPSHOT~6c8da4d60a

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (683.907 ms) : 0, 683907
BytebuddyAgent [candidate] (683.138 ms) : 0, 683138
GlobalTracer [baseline] (240.446 ms) : 0, 240446
GlobalTracer [candidate] (240.257 ms) : 0, 240257
AppSec [baseline] (55.246 ms) : 0, 55246
AppSec [candidate] (54.345 ms) : 0, 54345
Debugger [baseline] (10.581 ms) : 0, 10581
Debugger [candidate] (8.357 ms) : 0, 8357
Remote Config [baseline] (683.289 µs) : 0, 683
Remote Config [candidate] (696.877 µs) : 0, 697
Telemetry [baseline] (9.686 ms) : 0, 9686
Telemetry [candidate] (11.338 ms) : 0, 11338
section iast
BytebuddyAgent [baseline] (799.572 ms) : 0, 799572
BytebuddyAgent [candidate] (802.822 ms) : 0, 802822
GlobalTracer [baseline] (230.123 ms) : 0, 230123
GlobalTracer [candidate] (230.749 ms) : 0, 230749
IAST [baseline] (26.872 ms) : 0, 26872
IAST [candidate] (28.284 ms) : 0, 28284
AppSec [baseline] (51.903 ms) : 0, 51903
AppSec [candidate] (49.499 ms) : 0, 49499
Debugger [baseline] (5.933 ms) : 0, 5933
Debugger [candidate] (5.923 ms) : 0, 5923
Remote Config [baseline] (609.467 µs) : 0, 609
Remote Config [candidate] (591.92 µs) : 0, 592
Telemetry [baseline] (7.887 ms) : 0, 7887
Telemetry [candidate] (7.899 ms) : 0, 7899
section iast_HARDCODED_SECRET_DISABLED
BytebuddyAgent [baseline] (802.64 ms) : 0, 802640
BytebuddyAgent [candidate] (809.22 ms) : 0, 809220
GlobalTracer [baseline] (230.811 ms) : 0, 230811
GlobalTracer [candidate] (232.068 ms) : 0, 232068
IAST [baseline] (26.631 ms) : 0, 26631
IAST [candidate] (23.018 ms) : 0, 23018
AppSec [baseline] (52.275 ms) : 0, 52275
AppSec [candidate] (54.642 ms) : 0, 54642
Debugger [baseline] (5.94 ms) : 0, 5940
Debugger [candidate] (5.989 ms) : 0, 5989
Remote Config [baseline] (590.685 µs) : 0, 591
Remote Config [candidate] (588.144 µs) : 0, 588
Telemetry [baseline] (7.963 ms) : 0, 7963
Telemetry [candidate] (7.992 ms) : 0, 7992
section iast_TELEMETRY_OFF
BytebuddyAgent [baseline] (810.841 ms) : 0, 810841
BytebuddyAgent [candidate] (798.759 ms) : 0, 798759
GlobalTracer [baseline] (232.756 ms) : 0, 232756
GlobalTracer [candidate] (230.751 ms) : 0, 230751
IAST [baseline] (23.525 ms) : 0, 23525
IAST [candidate] (22.283 ms) : 0, 22283
AppSec [baseline] (55.286 ms) : 0, 55286
AppSec [candidate] (56.105 ms) : 0, 56105
Debugger [baseline] (5.978 ms) : 0, 5978
Debugger [candidate] (5.936 ms) : 0, 5936
Remote Config [baseline] (609.957 µs) : 0, 610
Remote Config [candidate] (598.214 µs) : 0, 598
Telemetry [baseline] (7.88 ms) : 0, 7880
Telemetry [candidate] (7.811 ms) : 0, 7811
Loading
Startup time reports for petclinic
gantt
    title petclinic - global startup overhead: candidate=1.50.0-SNAPSHOT~07996ea361, baseline=1.50.0-SNAPSHOT~6c8da4d60a

    dateFormat X
    axisFormat %s
section tracing
Agent [baseline] (1.03 s) : 0, 1029941
Total [baseline] (10.51 s) : 0, 10510495
Agent [candidate] (1.025 s) : 0, 1024851
Total [candidate] (10.473 s) : 0, 10473420
section appsec
Agent [baseline] (1.164 s) : 0, 1164252
Total [baseline] (10.671 s) : 0, 10670697
Agent [candidate] (1.167 s) : 0, 1167080
Total [candidate] (10.739 s) : 0, 10738615
section iast
Agent [baseline] (1.154 s) : 0, 1153633
Total [baseline] (10.934 s) : 0, 10934206
Agent [candidate] (1.163 s) : 0, 1163378
Total [candidate] (10.861 s) : 0, 10861094
section profiling
Agent [baseline] (1.273 s) : 0, 1273433
Total [baseline] (10.855 s) : 0, 10854900
Agent [candidate] (1.283 s) : 0, 1282668
Total [candidate] (10.91 s) : 0, 10910383
Loading
  • baseline results
Module Variant Duration Δ tracing
Agent tracing 1.03 s -
Agent appsec 1.164 s 134.31 ms (13.0%)
Agent iast 1.154 s 123.692 ms (12.0%)
Agent profiling 1.273 s 243.491 ms (23.6%)
Total tracing 10.51 s -
Total appsec 10.671 s 160.202 ms (1.5%)
Total iast 10.934 s 423.711 ms (4.0%)
Total profiling 10.855 s 344.405 ms (3.3%)
  • candidate results
Module Variant Duration Δ tracing
Agent tracing 1.025 s -
Agent appsec 1.167 s 142.229 ms (13.9%)
Agent iast 1.163 s 138.527 ms (13.5%)
Agent profiling 1.283 s 257.817 ms (25.2%)
Total tracing 10.473 s -
Total appsec 10.739 s 265.196 ms (2.5%)
Total iast 10.861 s 387.674 ms (3.7%)
Total profiling 10.91 s 436.963 ms (4.2%)
gantt
    title petclinic - break down per module: candidate=1.50.0-SNAPSHOT~07996ea361, baseline=1.50.0-SNAPSHOT~6c8da4d60a

    dateFormat X
    axisFormat %s
section tracing
BytebuddyAgent [baseline] (688.892 ms) : 0, 688892
BytebuddyAgent [candidate] (687.846 ms) : 0, 687846
GlobalTracer [baseline] (241.705 ms) : 0, 241705
GlobalTracer [candidate] (240.315 ms) : 0, 240315
AppSec [baseline] (56.071 ms) : 0, 56071
AppSec [candidate] (55.094 ms) : 0, 55094
Debugger [baseline] (9.842 ms) : 0, 9842
Debugger [candidate] (7.618 ms) : 0, 7618
Remote Config [baseline] (692.946 µs) : 0, 693
Remote Config [candidate] (684.573 µs) : 0, 685
Telemetry [baseline] (9.072 ms) : 0, 9072
Telemetry [candidate] (9.766 ms) : 0, 9766
section appsec
BytebuddyAgent [baseline] (701.963 ms) : 0, 701963
BytebuddyAgent [candidate] (704.575 ms) : 0, 704575
GlobalTracer [baseline] (237.857 ms) : 0, 237857
GlobalTracer [candidate] (237.205 ms) : 0, 237205
AppSec [baseline] (176.025 ms) : 0, 176025
AppSec [candidate] (176.412 ms) : 0, 176412
Debugger [baseline] (5.983 ms) : 0, 5983
Debugger [candidate] (6.336 ms) : 0, 6336
Remote Config [baseline] (614.751 µs) : 0, 615
Remote Config [candidate] (633.244 µs) : 0, 633
Telemetry [baseline] (7.387 ms) : 0, 7387
Telemetry [candidate] (7.449 ms) : 0, 7449
IAST [baseline] (21.875 ms) : 0, 21875
IAST [candidate] (21.781 ms) : 0, 21781
section iast
BytebuddyAgent [baseline] (804.552 ms) : 0, 804552
BytebuddyAgent [candidate] (813.477 ms) : 0, 813477
GlobalTracer [baseline] (231.774 ms) : 0, 231774
GlobalTracer [candidate] (232.884 ms) : 0, 232884
AppSec [baseline] (54.565 ms) : 0, 54565
AppSec [candidate] (51.113 ms) : 0, 51113
Debugger [baseline] (5.971 ms) : 0, 5971
Debugger [candidate] (5.909 ms) : 0, 5909
Remote Config [baseline] (597.754 µs) : 0, 598
Remote Config [candidate] (595.212 µs) : 0, 595
Telemetry [baseline] (7.984 ms) : 0, 7984
Telemetry [candidate] (7.944 ms) : 0, 7944
IAST [baseline] (23.803 ms) : 0, 23803
IAST [candidate] (26.248 ms) : 0, 26248
section profiling
ProfilingAgent [baseline] (103.192 ms) : 0, 103192
ProfilingAgent [candidate] (103.553 ms) : 0, 103553
BytebuddyAgent [baseline] (672.465 ms) : 0, 672465
BytebuddyAgent [candidate] (678.78 ms) : 0, 678780
GlobalTracer [baseline] (377.899 ms) : 0, 377899
GlobalTracer [candidate] (380.153 ms) : 0, 380153
AppSec [baseline] (54.472 ms) : 0, 54472
AppSec [candidate] (54.184 ms) : 0, 54184
Debugger [baseline] (6.155 ms) : 0, 6155
Debugger [candidate] (6.231 ms) : 0, 6231
Remote Config [baseline] (714.009 µs) : 0, 714
Remote Config [candidate] (691.664 µs) : 0, 692
Telemetry [baseline] (8.166 ms) : 0, 8166
Telemetry [candidate] (8.204 ms) : 0, 8204
Profiling [baseline] (103.218 ms) : 0, 103218
Profiling [candidate] (103.578 ms) : 0, 103578
Loading

Load

Parameters

Baseline Candidate
baseline_or_candidate baseline candidate
end_time 2025-05-07T13:40:47 2025-05-07T13:48:33
git_branch master landerson/muzzle-internal-proxy
git_commit_date 1746623495 1746624137
git_commit_sha 6c8da4d 07996ea
release_version 1.50.0-SNAPSHOT~6c8da4d60a 1.50.0-SNAPSHOT~07996ea361
start_time 2025-05-07T13:40:32 2025-05-07T13:48:19
See matching parameters
Baseline Candidate
application insecure-bank insecure-bank
ci_job_date 1746626114 1746626114
ci_job_id 927881147 927881147
ci_pipeline_id 64395632 64395632
cpu_model Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
kernel_version Linux runner-brbdd7pm-project-304-concurrent-1-gscaebps 6.8.0-1027-aws #29~22.04.1-Ubuntu SMP Sun Mar 30 07:45:38 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux Linux runner-brbdd7pm-project-304-concurrent-1-gscaebps 6.8.0-1027-aws #29~22.04.1-Ubuntu SMP Sun Mar 30 07:45:38 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux
variant iast iast

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 12 metrics, 18 unstable metrics.

Request duration reports for petclinic
gantt
    title petclinic - request duration [CI 0.99] : candidate=1.50.0-SNAPSHOT~07996ea361, baseline=1.50.0-SNAPSHOT~6c8da4d60a
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.357 ms) : 1337, 1376
.   : milestone, 1357,
appsec (1.749 ms) : 1725, 1772
.   : milestone, 1749,
appsec_no_iast (1.746 ms) : 1722, 1769
.   : milestone, 1746,
code_origins (1.68 ms) : 1653, 1707
.   : milestone, 1680,
iast (1.518 ms) : 1494, 1542
.   : milestone, 1518,
profiling (1.513 ms) : 1489, 1537
.   : milestone, 1513,
tracing (1.495 ms) : 1469, 1520
.   : milestone, 1495,
section candidate
no_agent (1.354 ms) : 1334, 1373
.   : milestone, 1354,
appsec (1.758 ms) : 1734, 1782
.   : milestone, 1758,
appsec_no_iast (1.745 ms) : 1722, 1769
.   : milestone, 1745,
code_origins (1.687 ms) : 1660, 1714
.   : milestone, 1687,
iast (1.509 ms) : 1485, 1533
.   : milestone, 1509,
profiling (1.505 ms) : 1481, 1529
.   : milestone, 1505,
tracing (1.514 ms) : 1490, 1538
.   : milestone, 1514,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 1.357 ms [1.337 ms, 1.376 ms] -
appsec 1.749 ms [1.725 ms, 1.772 ms] 392.217 µs (28.9%)
appsec_no_iast 1.746 ms [1.722 ms, 1.769 ms] 389.089 µs (28.7%)
code_origins 1.68 ms [1.653 ms, 1.707 ms] 323.581 µs (23.9%)
iast 1.518 ms [1.494 ms, 1.542 ms] 161.852 µs (11.9%)
profiling 1.513 ms [1.489 ms, 1.537 ms] 156.868 µs (11.6%)
tracing 1.495 ms [1.469 ms, 1.52 ms] 138.007 µs (10.2%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 1.354 ms [1.334 ms, 1.373 ms] -
appsec 1.758 ms [1.734 ms, 1.782 ms] 404.535 µs (29.9%)
appsec_no_iast 1.745 ms [1.722 ms, 1.769 ms] 391.724 µs (28.9%)
code_origins 1.687 ms [1.66 ms, 1.714 ms] 333.393 µs (24.6%)
iast 1.509 ms [1.485 ms, 1.533 ms] 155.48 µs (11.5%)
profiling 1.505 ms [1.481 ms, 1.529 ms] 151.324 µs (11.2%)
tracing 1.514 ms [1.49 ms, 1.538 ms] 160.22 µs (11.8%)
Request duration reports for insecure-bank
gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.50.0-SNAPSHOT~07996ea361, baseline=1.50.0-SNAPSHOT~6c8da4d60a
    dateFormat X
    axisFormat %s
section baseline
no_agent (385.697 µs) : 365, 406
.   : milestone, 386,
iast (526.035 µs) : 504, 548
.   : milestone, 526,
iast_FULL (743.065 µs) : 721, 765
.   : milestone, 743,
iast_GLOBAL (578.739 µs) : 556, 601
.   : milestone, 579,
iast_HARDCODED_SECRET_DISABLED (522.305 µs) : 500, 545
.   : milestone, 522,
iast_INACTIVE (474.936 µs) : 452, 498
.   : milestone, 475,
iast_TELEMETRY_OFF (510.522 µs) : 488, 534
.   : milestone, 511,
tracing (466.257 µs) : 444, 488
.   : milestone, 466,
section candidate
no_agent (388.268 µs) : 369, 408
.   : milestone, 388,
iast (531.621 µs) : 507, 556
.   : milestone, 532,
iast_FULL (743.323 µs) : 721, 765
.   : milestone, 743,
iast_GLOBAL (569.317 µs) : 547, 591
.   : milestone, 569,
iast_HARDCODED_SECRET_DISABLED (524.689 µs) : 503, 546
.   : milestone, 525,
iast_INACTIVE (474.391 µs) : 452, 497
.   : milestone, 474,
iast_TELEMETRY_OFF (512.905 µs) : 490, 536
.   : milestone, 513,
tracing (467.043 µs) : 445, 489
.   : milestone, 467,
Loading
  • baseline results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 385.697 µs [365.355 µs, 406.038 µs] -
iast 526.035 µs [504.26 µs, 547.81 µs] 140.339 µs (36.4%)
iast_FULL 743.065 µs [720.968 µs, 765.162 µs] 357.369 µs (92.7%)
iast_GLOBAL 578.739 µs [556.382 µs, 601.095 µs] 193.042 µs (50.1%)
iast_HARDCODED_SECRET_DISABLED 522.305 µs [499.653 µs, 544.958 µs] 136.609 µs (35.4%)
iast_INACTIVE 474.936 µs [452.12 µs, 497.753 µs] 89.24 µs (23.1%)
iast_TELEMETRY_OFF 510.522 µs [487.534 µs, 533.51 µs] 124.825 µs (32.4%)
tracing 466.257 µs [444.212 µs, 488.302 µs] 80.56 µs (20.9%)
  • candidate results
Variant Request duration [CI 0.99] Δ no_agent
no_agent 388.268 µs [368.544 µs, 407.993 µs] -
iast 531.621 µs [507.138 µs, 556.103 µs] 143.352 µs (36.9%)
iast_FULL 743.323 µs [721.386 µs, 765.261 µs] 355.055 µs (91.4%)
iast_GLOBAL 569.317 µs [547.149 µs, 591.486 µs] 181.049 µs (46.6%)
iast_HARDCODED_SECRET_DISABLED 524.689 µs [502.987 µs, 546.391 µs] 136.42 µs (35.1%)
iast_INACTIVE 474.391 µs [451.998 µs, 496.783 µs] 86.122 µs (22.2%)
iast_TELEMETRY_OFF 512.905 µs [489.671 µs, 536.139 µs] 124.637 µs (32.1%)
tracing 467.043 µs [444.643 µs, 489.444 µs] 78.775 µs (20.3%)

Dacapo

Copy link
Contributor

@PerfectSlayer PerfectSlayer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you know what is impact of using getenv() on Gradle build cache (rather than some API based on provider or something, hard to remember which one works the best with there env cache)

cc @bric3

@bric3
Copy link
Contributor

bric3 commented May 7, 2025

@randomanderson @PerfectSlayer Configuration cache should work as these calls are intercepted I believe, see here.

However providers.environmentVariable would be preferred for configuration avoidance as providers are lazy. That being said, the remotes are created in a static initializer that do not have access to the project instance, which needs to be changed first to be able to use providers.

Copy link
Contributor

@PerfectSlayer PerfectSlayer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for your feedback!
Let's try it then and revisit this later 😉

@randomanderson randomanderson force-pushed the landerson/muzzle-internal-proxy branch from 5ae3e73 to 07996ea Compare May 7, 2025 13:22
@randomanderson randomanderson merged commit 746a7fd into master May 7, 2025
454 of 455 checks passed
@randomanderson randomanderson deleted the landerson/muzzle-internal-proxy branch May 7, 2025 14:36
@github-actions github-actions bot added this to the 1.50.0 milestone May 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

comp: testing Testing tag: no release notes Changes to exclude from release notes

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants