CycloneDX / CycloneDX/cyclonedx-maven-plugin
Failed to execute goal org.cyclonedx:cyclonedx-maven-plugin:2.9.0:makeAggregateBom (default-cli) on project markedeve-service-udp: The BOM does not conform to the CycloneDX BOM standard as defined by the XSD
- Dominant language
- Java
- Stars
- 385
- Forks
- 107
- Avg merge
- 17h 31m
- Merged PRs (30d)
- 7
Description
When I run the "mvn org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom" command in 2.9.0, I will report the following exception, and switch to the lower version (2.7.11) is OK. What is the reason:
> [WARNING] Could not transfer metadata com.tydic.osworkflow:tydic-osworkflow:4.0.2-CLOUD-SNAPSHOT/maven-metadata.xml from/to terracotta-snapshots (http://www.terracotta.org/download/reflector/snapshots): status code: 403, reason phrase: Forbidden (403)
[WARNING] Could not transfer metadata com.tydic.osworkflow:tydic-osworkflow:4.0.2-CLOUD-SNAPSHOT/maven-metadata.xml from/to eclipselink.repository (http://www.eclipse.org/downloads/download.php?r=1&nf=1&file=/rt/eclipselink/maven.repo): Connect to www.eclipse.org:80 [www.eclipse.org/198.41.30.198] failed: connect timed out
[INFO] Excluding markedeve-service-udp-start
[WARNING] BOM dependency listed but is not depended upon: pkg:maven/org.objenesis/objenesis@2.6?type=jar
[WARNING] BOM dependency listed but is not depended upon: pkg:maven/com.google.protobuf/protobuf-java@3.11.4?type=jar
[INFO] CycloneDX: Creating BOM version 1.6 with 266 component(s)
[INFO] CycloneDX: Writing and validating BOM (XML): /cyrms/nut/jar/osssm-osca/osssm_code/xielei/markedeve-service/target/bom.xml
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for markedeve-service-udp 1.0.0:
[INFO]
[INFO] markedeve-service-udp .............................. FAILURE [08:21 min]
[INFO] markedeve-service-udp-api .......................... SKIPPED
[INFO] markedeve-service-udp-domain ....................... SKIPPED
[INFO] markedeve-service-udp-infrastructure ............... SKIPPED
[INFO] markedeve-service-udp-start ........................ SKIPPED
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 08:29 min
[INFO] Finished at: 2024-11-15T10:11:38+08:00
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.cyclonedx:cyclonedx-maven-plugin:2.9.0:makeAggregateBom (default-cli) on project markedeve-service-udp: The BOM does not conform to the CycloneDX BOM standard as defined by the XSD -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException
Contributor guide
Research direction
Reproduce the failure with the cyclonedx-maven-plugin 2.9.0 makeAggregateBom command and compare it with 2.7.11. Inspect target/bom.xml after generation, then rerun with Maven's -e and -X options to identify the XSD validation error. Done means the cause of the invalid BOM is identified and the affected version produces a conforming BOM.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100