CycloneDX / CycloneDX/cyclonedx-gradle-plugin

"Unable to resolve POM" for jars in flatDir repo

Open
#302 7 comments 4 reactions 0 assignees View on GitHub
bug question
Dominant language
Java
Stars
240
Forks
103
Avg merge
1d 9h
Merged PRs (30d)
11

Description

We have some jars that can't be referenced from Maven but are instead in a flatDir repo:

```
plugins {
id 'org.cyclonedx.bom' version '1.7.4'
}

cyclonedxBom {
outputFormat = "json"
}

repositories {
google()
mavenCentral()
flatDir { dirs "$rootProject.projectDir/libs" }
}

dependencies {
implementation 'oracle:ojdbc11:19c' // Resolves to flatDir repo
}
```

But this errors when running the cyclonedx task:

```
$ ./gradlew cyclonedx

> Task :cyclonedxBom
An unexpected issue occurred attempting to create a PackageURL for :myproject:unspecified
Unable to resolve POM for oracle:ojdbc11:19c: org.gradle.api.internal.artifacts.ivyservice.DefaultLenientConfiguration$ArtifactResolveException: Could not resolve all files for configuration ':detachedConfiguration179'.
```

I'd expect an SBOM to still be created. For example `cdxgen` does create an SBOM for this project with no error.

Is there any way to make this work?

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the failure with the provided Gradle configuration and the cyclonedxBom task, focusing on dependency resolution for the flatDir repository and oracle:ojdbc11:19c. Done means the task creates an SBOM without the Unable to resolve POM error while preserving handling of regular Maven dependencies.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.