Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Unable to upload bom using version 1.9.1 #438

Open
sanderino666 opened this issue Jan 28, 2025 · 6 comments
Open

Unable to upload bom using version 1.9.1 #438

sanderino666 opened this issue Jan 28, 2025 · 6 comments

Comments

@sanderino666
Copy link

io.github.pmckeown:dependency-track-maven-plugin:1.9.1:upload-bom keeps failing with the error:

[ERROR] Failure integrating with Dependency Track: 400 Bad Request
[DEBUG] Error occurred during upload
io.github.pmckeown.dependencytrack.DependencyTrackException: Failure integrating with Dependency Track: 400 Bad Request
    at io.github.pmckeown.dependencytrack.upload.UploadBomAction.doUpload (UploadBomAction.java:99)
    at io.github.pmckeown.dependencytrack.upload.UploadBomAction.upload (UploadBomAction.java:54)
    at io.github.pmckeown.dependencytrack.upload.UploadBomMojo.performAction (UploadBomMojo.java:88)
    at io.github.pmckeown.dependencytrack.AbstractDependencyTrackMojo.execute (AbstractDependencyTrackMojo.java:105)
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126)
    at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328)
    at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174)
    at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75)
    at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162)
    at org.apache.maven.buildcache.BuildCacheMojosExecutionStrategy.execute (BuildCacheMojosExecutionStrategy.java:145)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73)
    at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53)
    at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173)
    at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101)
    at org.apache.maven.cli.MavenCli.execute (MavenCli.java:906)
    at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:283)
    at org.apache.maven.cli.MavenCli.main (MavenCli.java:206)
    at jdk.internal.reflect.DirectMethodHandleAccessor.invoke (DirectMethodHandleAccessor.java:103)
    at java.lang.reflect.Method.invoke (Method.java:580)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:283)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:226)
    at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:407)
    at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:[348](https://gitlab.pinkprivate.cloud/pz/openburgerzaken/services/usermanagementservice/-/jobs/2174447#L348))
Caused by: io.github.pmckeown.dependencytrack.DependencyTrackException: Failure integrating with Dependency Track: 400 Bad Request
    at io.github.pmckeown.dependencytrack.upload.UploadBomAction.doUpload (UploadBomAction.java:96)
    at io.github.pmckeown.dependencytrack.upload.UploadBomAction.upload (UploadBomAction.java:54)
    at io.github.pmckeown.dependencytrack.upload.UploadBomMojo.performAction (UploadBomMojo.java:88)
    at io.github.pmckeown.dependencytrack.AbstractDependencyTrackMojo.execute (AbstractDependencyTrackMojo.java:105)
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126)
    at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:328)
    at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:316)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:212)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:174)
    at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:75)
    at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:162)
    at org.apache.maven.buildcache.BuildCacheMojosExecutionStrategy.execute (BuildCacheMojosExecutionStrategy.java:145)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:159)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73)
    at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53)
    at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173)
    at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101)
    at org.apache.maven.cli.MavenCli.execute (MavenCli.java:906)
    at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:283)
    at org.apache.maven.cli.MavenCli.main (MavenCli.java:206)
    at jdk.internal.reflect.DirectMethodHandleAccessor.invoke (DirectMethodHandleAccessor.java:103)
    at java.lang.reflect.Method.invoke (Method.java:580)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:283)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:226)
    at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:407)
    at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:348)

Reverting back to version 1.7.0 fixes the issue.

I tried the following configuration options but they all fail with the same error:

Update parent set to true

[INFO] SSL Verification enabled: true
[DEBUG] bomLocation not supplied so using: /builds/pz/openburgerzaken/services/usermanagementservice/boot/target/bom.xml
[INFO] Update Project Parent : true
[INFO] Project Name: OPENburgerzaken UserManagementService
[INFO] Project Version: 1.0.8-SNAPSHOT
[INFO] Project is latest: true
[INFO] Project Tags: 
[INFO] Parent UUID: null
[INFO] Parent Name: OPENburgerzaken UserManagementService
[INFO] Parent Version: 1.0.8-SNAPSHOT
[INFO] PollingConfig[attempts=20,enabled=true,pause=1,timeUnit=SECONDS]

Update parent set to false

[INFO] SSL Verification enabled: true
[DEBUG] bomLocation not supplied so using: /builds/pz/openburgerzaken/services/usermanagementservice/boot/target/bom.xml
[INFO] Update Project Parent : false
[INFO] Project Name: OPENburgerzaken UserManagementService
[INFO] Project Version: 1.0.8-SNAPSHOT
[INFO] Project is latest: true
[INFO] Project Tags: 
[INFO] Parent UUID: null
[INFO] Parent Name: OPENburgerzaken UserManagementService
[INFO] Parent Version: 1.0.8-SNAPSHOT
[INFO] PollingConfig[attempts=20,enabled=true,pause=1,timeUnit=SECONDS]

Update parent set to false and no parent version, override default maven parent name

[INFO] SSL Verification enabled: true
[DEBUG] bomLocation not supplied so using: /builds/pz/openburgerzaken/services/usermanagementservice/boot/target/bom.xml
[INFO] Update Project Parent : false
[INFO] Project Name: OPENburgerzaken UserManagementService
[INFO] Project Version: 1.0.8-SNAPSHOT
[INFO] Project is latest: true
[INFO] Project Tags: 
[INFO] Parent UUID: null
[INFO] Parent Name: OPENburgerzaken UserManagementService
[INFO] Parent Version: null
[INFO] PollingConfig[attempts=20,enabled=true,pause=1,timeUnit=SECONDS]

Update parent set to false and no parent version, default maven parent name

[INFO] SSL Verification enabled: true
[DEBUG] bomLocation not supplied so using: /builds/pz/openburgerzaken/services/usermanagementservice/boot/target/bom.xml
[INFO] Update Project Parent : false
[INFO] Project Name: OPENburgerzaken UserManagementService
[INFO] Project Version: 1.0.8-SNAPSHOT
[INFO] Project is latest: true
[INFO] Project Tags: 
[INFO] Parent UUID: null
[INFO] Parent Name: usermanagementservice
[INFO] Parent Version: null
[INFO] PollingConfig[attempts=20,enabled=true,pause=1,timeUnit=SECONDS]

Update parent set to false and parent values empty strings

[INFO] SSL Verification enabled: true
[DEBUG] bomLocation not supplied so using: /builds/pz/openburgerzaken/services/usermanagementservice/boot/target/bom.xml
[INFO] Update Project Parent : false
[INFO] Project Name: OPENburgerzaken UserManagementService
[INFO] Project Version: 1.0.8-SNAPSHOT
[INFO] Project is latest: true
[INFO] Project Tags: 
[INFO] Parent UUID: 
[INFO] Parent Name: 
[INFO] Parent Version: 
[INFO] PollingConfig[attempts=20,enabled=true,pause=1,timeUnit=SECONDS]

Update parent set to false and parent name and version empty strings

[INFO] SSL Verification enabled: true
[DEBUG] bomLocation not supplied so using: /builds/pz/openburgerzaken/services/usermanagementservice/boot/target/bom.xml
[INFO] Update Project Parent : false
[INFO] Project Name: OPENburgerzaken UserManagementService
[INFO] Project Version: 1.0.8-SNAPSHOT
[INFO] Project is latest: true
[INFO] Project Tags: 
[INFO] Parent UUID: null
[INFO] Parent Name: 
[INFO] Parent Version: 
[INFO] PollingConfig[attempts=20,enabled=true,pause=1,timeUnit=SECONDS]
@pmckeown
Copy link
Owner

What version of Dependency Track server are you connecting to? Could be a difference an API that the later version of the plugin is using.

@sanderino666
Copy link
Author

We are using version 4.9.1

@sanderino666
Copy link
Author

FYI we'll upgrade to the latest dependency track version and report back (will be in a couple of days).

@sanderino666
Copy link
Author

We've upgraded Dependency Track to version 4.12.3 (latestt) and using version plugin version 1.9.1 we now get a 404:

[INFO] SSL Verification enabled: true
[DEBUG] bomLocation not supplied so using: /builds/pz/openburgerzaken/services/usermanagementservice/boot/target/bom.xml
[INFO] Update Project Parent : false
[INFO] Project Name: OPENburgerzaken UserManagementService
[INFO] Project Version: 1.0.8-SNAPSHOT
[INFO] Project is latest: true
[INFO] Project Tags: 
[INFO] Parent UUID: null
[INFO] Parent Name: usermanagementservice
[INFO] Parent Version: null
[INFO] PollingConfig[attempts=20,enabled=true,pause=1,timeUnit=SECONDS]
[DEBUG] Current working directory: /builds/pz/openburgerzaken/services/usermanagementservice
[DEBUG] looking for bom.xml at /builds/pz/openburgerzaken/services/usermanagementservice/boot/target/bom.xml
[ERROR] Failure integrating with Dependency Track: 404 Not Found
[DEBUG] Error occurred during upload
io.github.pmckeown.dependencytrack.DependencyTrackException: Failure integrating with Dependency Track: 404 Not Found

Switching back to plugin version 1.7.0 is still working as expected.

@pmckeown
Copy link
Owner

pmckeown commented Feb 5, 2025 via email

@sanderino666
Copy link
Author

I did not change the config between 1.7.0 and 1.9.1. What i can see from the logs is that although I set updateParent to false, it still sets the parent name. That might be the culprit as that parent name does not exist in Dependency Track. For some reason it now gets filled with the Maven project name.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@sanderino666 @pmckeown