CycloneDX / CycloneDX/cyclonedx-gradle-plugin
NoSuchMethodError org.codehaus.plexus.util.xml.pull.MXParser.<init>(org.codehaus.plexus.util.xml.pull.EntityReplacementMap)
- Dominant language
- Java
- Stars
- 239
- Forks
- 102
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 11
Description
I'm unable to use this plugin, as it errors out:
```
$ ./gradlew server-jetty-app:cyclonedxBom -info
...
CycloneDX: Parameters
------------------------------------------------------------------------
schemaVersion : 1.4
includeBomSerialNumber : true
includeConfigs : [runtimeClasspath]
skipConfigs : [compileClasspath, testCompileClasspath]
destination : /home/devin/dev/deephaven/deephaven-core/server/jetty-app/build/reports
outputName : CycloneDX-Sbom
------------------------------------------------------------------------
CycloneDX: Resolving Dependencies
Resource missing. [HTTP GET: https://repo.maven.apache.org/maven2/io/deephaven/server-jetty/0.20.0/server-jetty-0.20.0.pom]
Unable to resolve POM for io.deephaven:server-jetty:0.20.0: org.gradle.api.internal.artifacts.ivyservice.DefaultLenientConfiguration$ArtifactResolveException: Could not resolve all files for configuration ':server-jetty-app:detachedConfiguration1'.
Resource missing. [HTTP GET: https://repo.maven.apache.org/maven2/io/deephaven/log-to-slf4j/0.20.0/log-to-slf4j-0.20.0.pom]
Unable to resolve POM for io.deephaven:log-to-slf4j:0.20.0: org.gradle.api.internal.artifacts.ivyservice.DefaultLenientConfiguration$ArtifactResolveException: Could not resolve all files for configuration ':serv
er-jetty-app:detachedConfiguration2'.
Resource missing. [HTTP GET: https://repo.maven.apache.org/maven2/io/deephaven/logback-print-stream-globals/0.20.0/logback-print-stream-globals-0.20.0.pom]
Unable to resolve POM for io.deephaven:logback-print-stream-globals:0.20.0: org.gradle.api.internal.artifacts.ivyservice.DefaultLenientConfiguration$ArtifactResolveException: Could not resolve all files for conf
iguration ':server-jetty-app:detachedConfiguration3'.
Resource missing. [HTTP GET: https://repo.maven.apache.org/maven2/io/deephaven/logback-logbuffer/0.20.0/logback-logbuffer-0.20.0.pom]
Unable to resolve POM for io.deephaven:logback-logbuffer:0.20.0: org.gradle.api.internal.artifacts.ivyservice.DefaultLenientConfiguration$ArtifactResolveException: Could not resolve all files for configuration '
:server-jetty-app:detachedConfiguration4'.
```
It looks like it's trying to resolve local projects as if they were remote.
For reference, the dependencies of this project looks like:
```
dependencies {
implementation project(':server-jetty')
runtimeOnly project(':log-to-slf4j')
runtimeOnly project(':logback-print-stream-globals')
runtimeOnly project(':logback-logbuffer')
}
```
There's a potentially relevant error complaining about NoSuchMethod:
```
$ ./gradlew server-jetty-app:cyclonedxBom --stacktrace
...
java.lang.NoSuchMethodError: 'void org.codehaus.plexus.util.xml.pull.MXParser.(org.codehaus.plexus.util.xml.pull.EntityReplacementMap)'
at org.apache.maven.model.io.xpp3.MavenXpp3Reader.read(MavenXpp3Reader.java:590)
at org.apache.maven.model.io.xpp3.MavenXpp3Reader.read(MavenXpp3Reader.java:609)
at org.cyclonedx.gradle.MavenHelper.readPom(MavenHelper.java:312)
at org.cyclonedx.gradle.MavenHelper.extractPom(MavenHelper.java:274)
at org.cyclonedx.gradle.CycloneDxTask.convertArtifact(CycloneDxTask.java:486)
at org.cyclonedx.gradle.CycloneDxTask.lambda$null$3(CycloneDxTask.java:296)
at org.cyclonedx.gradle.CycloneDxTask.lambda$createBom$4(CycloneDxTask.java:286)
at org.cyclonedx.gradle.CycloneDxTask.createBom(CycloneDxTask.java:245)
```
For reference, this is the branch I'm working against https://github.com/devinrsmith/deephaven-core/tree/sbom-cyclonedx.
I'm happy to iterate or provide further debugging information.
Thanks.
Contributor guide
Research direction
Reproduce the failure with `./gradlew server-jetty-app:cyclonedxBom --stacktrace` using the referenced Deephaven branch. Start with `org.cyclonedx.gradle.MavenHelper.readPom`, `extractPom`, and `CycloneDxTask.convertArtifact`, then trace the Maven parser dependency; done means local project dependencies no longer trigger the NoSuchMethodError or remote-POM resolution warnings.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100