CycloneDX / CycloneDX/cyclonedx-maven-plugin

Incomplete manifest generated in case of intermediate issues in resolving artifacts

Open
#583 7 comments 2 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
385
Forks
107
Avg merge
17h 31m
Merged PRs (30d)
7

Description

We observed an issue with one of our generations recently which resulted in an incomplete manifest. Generated manifest had 63 components, but we expected 378. The only thing we found in the logs was this:

```
00:07:03,692 INFO [org.jbo.sbo.cli.fea.sbo.gen.ProcessRunner] (main) [WARNING] An error occurred building dependency graph: Could not collect dependencies: org.kie.trustyai:explainability-service:jar:999.0.0.managedsvc-redhat-01048 mdc:[{buildId=BD2PHNKA6UAAA}]
00:07:03,703 INFO [org.jbo.sbo.cli.fea.sbo.gen.ProcessRunner] (main) [INFO] CycloneDX: Creating BOM version 1.4 with 63 component(s) mdc:[{buildId=BD2PHNKA6UAAA}]
00:07:03,991 INFO [org.jbo.sbo.cli.fea.sbo.gen.ProcessRunner] (main) [INFO] CycloneDX: Writing and validating BOM (JSON): /tmp/sbomer-workdir/product-0/target/bom.json mdc:[{buildId=BD2PHNKA6UAAA}]
```

This points us to this:

https://github.com/CycloneDX/cyclonedx-maven-plugin/blob/db2a35b908911d21c1d26da02beb5809ff0d2b13/src/main/java/org/cyclonedx/maven/DefaultProjectDependenciesConverter.java#L98-L102

This was introduced as part of #55 in this commit https://github.com/CycloneDX/cyclonedx-maven-plugin/commit/0666338549dac4cb3845b7a69387ac695e69435e by @stevespringett.

For the record, here is a complete run:

```
5:32:41,092 INFO [org.jbo.sbo.cli.fea.sbo.gen.ProcessRunner] (main) [INFO] CycloneDX: Creating BOM version 1.4 with 378 component(s) mdc:[{buildId=BD2PHNKA6UAAA}]
15:32:41,207 INFO [org.jbo.sbo.cli.fea.sbo.gen.ProcessRunner] (main) [INFO] CycloneDX: Writing and validating BOM (JSON): /tmp/sbomer-workdir/product-0/target/bom.json mdc:[{buildId=BD2PHNKA6UAAA}]
```

I think this is a **wrong approach**. If we cannot build the dependency graph, we should not attempt to generate a partial manifest silently. If there is really a use case for it, it should be at least exposed via flag, but I still think continuing with manifest generation should be disabled by default.

Contributor guide

Open the contributing guide

Research direction

Start with DefaultProjectDependenciesConverter.java at the linked lines and review the change from issue #55. Reproduce the dependency-graph failure shown in the logs, then verify that BOM generation does not silently continue with a partial manifest by default; any optional behavior should be covered by the issue's requested flag decision.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.