CodeQL CLI "Analyze" + "--dowload" command failing

[srameshb-ia]

Hi All,

I am trying to follow the steps here : https://learn.microsoft.com/en-us/windows-hardware/drivers/develop/creating-a-driver-verification-log
https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/static-tools-and-codeql

I am seeing the following failures,

D:\Project\codeql-home>codeql database analyze databases\Folder --format=sarifv2.1.0 --output=D:\Project\codeql-home\databases\Recommended.sarif D:\Project\codeql-home\Windows-Driver-Developer-Supplemental-Tools\src\suites\windows_driver_mustfix.qls --verbosity=progress++ --logdir=logs\ --download
Picked up _JAVA_OPTIONS: -Djava.net.preferIPv4Stack=true
Writing logs to D:\Project\codeql-home\logs\database-analyze-20230530.173649.758.log.
Downloading queries...
Package specifications to check for download: D:\Project\codeql-home\Windows-Driver-Developer-Supplemental-Tools\src\suites\windows_driver_mustfix.qls
Recording pack reference microsoft/windows-drivers at D:\Project\codeql-home\Windows-Driver-Developer-Supplemental-Tools\src.
Packaging> Requesting package versions of codeql/cpp-queries from https://ghcr.io/v2/codeql/cpp-queries/tags/list?n=100
Packaging> GET Anonymous credentials 'https://ghcr.io/token?scope=repository:codeql/cpp-queries:pull'
A fatal error occurred: Could not create access credentials for codeql/cpp-queries.
(eventual cause: ConnectException "Connection timed out: no further information")

D:\Project\codeql-home>codeql pack install D:\Project\codeql-home\Windows-Driver-Developer-Supplemental-Tools\src
Picked up _JAVA_OPTIONS: -Djava.net.preferIPv4Stack=true
A fatal error occurred: Could not create access credentials for codeql/cpp-all.
(eventual cause: ConnectException "Connection timed out: no further information")

[srameshb-ia]

D:\Project\codeql-home\Windows-Driver-Developer-Supplemental-Tools\src>codeql --version
Picked up _JAVA_OPTIONS: -Djava.net.preferIPv4Stack=true
CodeQL command-line toolchain release 2.13.1.
Copyright (C) 2019-2023 GitHub, Inc.
Unpacked in: D:\Project\codeql-home\codeql
Analysis results depend critically on separately distributed query and
extractor modules. To list modules that are visible to the toolchain,
use 'codeql resolve qlpacks' and 'codeql resolve languages'.

D:\Project\codeql-home\Windows-Driver-Developer-Supplemental-Tools\src>codeql resolve qlpacks
Picked up _JAVA_OPTIONS: -Djava.net.preferIPv4Stack=true
legacy-upgrades (D:\Project\codeql-home\codeql\legacy-upgrades)
microsoft/windows-drivers (D:\Project\codeql-home\Windows-Driver-Developer-Supplemental-Tools\src)

D:\Project\codeql-home\Windows-Driver-Developer-Supplemental-Tools\src>codeql resolve languages
Picked up _JAVA_OPTIONS: -Djava.net.preferIPv4Stack=true
cpp (D:\Project\codeql-home\codeql\cpp)
csharp (D:\Project\codeql-home\codeql\csharp)
csv (D:\Project\codeql-home\codeql\csv)
go (D:\Project\codeql-home\codeql\go)
html (D:\Project\codeql-home\codeql\html)
java (D:\Project\codeql-home\codeql\java)
javascript (D:\Project\codeql-home\codeql\javascript)
properties (D:\Project\codeql-home\codeql\properties)
python (D:\Project\codeql-home\codeql\python)
ruby (D:\Project\codeql-home\codeql\ruby)
xml (D:\Project\codeql-home\codeql\xml)
yaml (D:\Project\codeql-home\codeql\yaml)
yaml (D:\Project\codeql-home\codeql\yaml)

[alexet]

It looks like the package registry timed out. Can you run curl https://ghcr.io/token?scope=repository:codeql/cpp-queries:pull to see if the request works from your network.

[srameshb-ia]

I see the "A fatal error occurred: Could not create access credentials for codeql/cpp-all.
(eventual cause: ConnectException "Connection timed out: no further information")" failure on both windows powerhsell and command line.

[alexet]

I think this is likely to be a firewall issue as it seems some applications can connect to https://ghcr.io/ and others can't. Is it possible to check if there are any relevant firewalls that could be blocking the request.

[srameshb-ia]

Hi I checked my firewall settings. It is turned off the entire time. Can you suggest other trouble shooting steps? @alexet

[srameshb-ia]

Are there other ways to download the needed dependencies to run the analyze command?

[alexet]

You can checkout the github/codeql repo at the relevant point in time (currently the branch codeql-cli-2.11.5) and point --additional-packs at that repo.