CycloneDX / CycloneDX/cyclonedx-gradle-plugin

NoSuchMethodError org.codehaus.plexus.util.xml.pull.MXParser.<init>(org.codehaus.plexus.util.xml.pull.EntityReplacementMap)

Open
#246 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
239
Forks
102
Avg merge
1d 9h
Merged PRs (30d)
11

Description

I'm unable to use this plugin, as it errors out:

```
$ ./gradlew server-jetty-app:cyclonedxBom -info

...

CycloneDX: Parameters
------------------------------------------------------------------------
schemaVersion : 1.4
includeBomSerialNumber : true
includeConfigs : [runtimeClasspath]
skipConfigs : [compileClasspath, testCompileClasspath]
destination : /home/devin/dev/deephaven/deephaven-core/server/jetty-app/build/reports
outputName : CycloneDX-Sbom
------------------------------------------------------------------------
CycloneDX: Resolving Dependencies
Resource missing. [HTTP GET: https://repo.maven.apache.org/maven2/io/deephaven/server-jetty/0.20.0/server-jetty-0.20.0.pom]
Unable to resolve POM for io.deephaven:server-jetty:0.20.0: org.gradle.api.internal.artifacts.ivyservice.DefaultLenientConfiguration$ArtifactResolveException: Could not resolve all files for configuration ':server-jetty-app:detachedConfiguration1'.
Resource missing. [HTTP GET: https://repo.maven.apache.org/maven2/io/deephaven/log-to-slf4j/0.20.0/log-to-slf4j-0.20.0.pom]
Unable to resolve POM for io.deephaven:log-to-slf4j:0.20.0: org.gradle.api.internal.artifacts.ivyservice.DefaultLenientConfiguration$ArtifactResolveException: Could not resolve all files for configuration ':serv
er-jetty-app:detachedConfiguration2'.
Resource missing. [HTTP GET: https://repo.maven.apache.org/maven2/io/deephaven/logback-print-stream-globals/0.20.0/logback-print-stream-globals-0.20.0.pom]
Unable to resolve POM for io.deephaven:logback-print-stream-globals:0.20.0: org.gradle.api.internal.artifacts.ivyservice.DefaultLenientConfiguration$ArtifactResolveException: Could not resolve all files for conf
iguration ':server-jetty-app:detachedConfiguration3'.
Resource missing. [HTTP GET: https://repo.maven.apache.org/maven2/io/deephaven/logback-logbuffer/0.20.0/logback-logbuffer-0.20.0.pom]
Unable to resolve POM for io.deephaven:logback-logbuffer:0.20.0: org.gradle.api.internal.artifacts.ivyservice.DefaultLenientConfiguration$ArtifactResolveException: Could not resolve all files for configuration '
:server-jetty-app:detachedConfiguration4'.
```

It looks like it's trying to resolve local projects as if they were remote.

For reference, the dependencies of this project looks like:

```
dependencies {
implementation project(':server-jetty')

runtimeOnly project(':log-to-slf4j')
runtimeOnly project(':logback-print-stream-globals')
runtimeOnly project(':logback-logbuffer')
}
```

There's a potentially relevant error complaining about NoSuchMethod:

```
$ ./gradlew server-jetty-app:cyclonedxBom --stacktrace

...

java.lang.NoSuchMethodError: 'void org.codehaus.plexus.util.xml.pull.MXParser.(org.codehaus.plexus.util.xml.pull.EntityReplacementMap)'
at org.apache.maven.model.io.xpp3.MavenXpp3Reader.read(MavenXpp3Reader.java:590)
at org.apache.maven.model.io.xpp3.MavenXpp3Reader.read(MavenXpp3Reader.java:609)
at org.cyclonedx.gradle.MavenHelper.readPom(MavenHelper.java:312)
at org.cyclonedx.gradle.MavenHelper.extractPom(MavenHelper.java:274)
at org.cyclonedx.gradle.CycloneDxTask.convertArtifact(CycloneDxTask.java:486)
at org.cyclonedx.gradle.CycloneDxTask.lambda$null$3(CycloneDxTask.java:296)
at org.cyclonedx.gradle.CycloneDxTask.lambda$createBom$4(CycloneDxTask.java:286)
at org.cyclonedx.gradle.CycloneDxTask.createBom(CycloneDxTask.java:245)
```

For reference, this is the branch I'm working against https://github.com/devinrsmith/deephaven-core/tree/sbom-cyclonedx.

I'm happy to iterate or provide further debugging information.

Thanks.

Contributor guide

Open the contributing guide

Research direction

Reproduce the failure with `./gradlew server-jetty-app:cyclonedxBom --stacktrace` using the referenced Deephaven branch. Start with `org.cyclonedx.gradle.MavenHelper.readPom`, `extractPom`, and `CycloneDxTask.convertArtifact`, then trace the Maven parser dependency; done means local project dependencies no longer trigger the NoSuchMethodError or remote-POM resolution warnings.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.