CycloneDX / CycloneDX/cyclonedx-gradle-plugin
"Unable to resolve POM" for jars in flatDir repo
- Dominant language
- Java
- Stars
- 240
- Forks
- 103
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 11
Description
We have some jars that can't be referenced from Maven but are instead in a flatDir repo:
```
plugins {
id 'org.cyclonedx.bom' version '1.7.4'
}
cyclonedxBom {
outputFormat = "json"
}
repositories {
google()
mavenCentral()
flatDir { dirs "$rootProject.projectDir/libs" }
}
dependencies {
implementation 'oracle:ojdbc11:19c' // Resolves to flatDir repo
}
```
But this errors when running the cyclonedx task:
```
$ ./gradlew cyclonedx
> Task :cyclonedxBom
An unexpected issue occurred attempting to create a PackageURL for :myproject:unspecified
Unable to resolve POM for oracle:ojdbc11:19c: org.gradle.api.internal.artifacts.ivyservice.DefaultLenientConfiguration$ArtifactResolveException: Could not resolve all files for configuration ':detachedConfiguration179'.
```
I'd expect an SBOM to still be created. For example `cdxgen` does create an SBOM for this project with no error.
Is there any way to make this work?
Contributor guide
Research direction
Start by reproducing the failure with the provided Gradle configuration and the cyclonedxBom task, focusing on dependency resolution for the flatDir repository and oracle:ojdbc11:19c. Done means the task creates an SBOM without the Unable to resolve POM error while preserving handling of regular Maven dependencies.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100