dependency-check / dependency-check/DependencyCheck

ArtifactResolverException when no jar found in a pom project.

Open
#4,134 2 comments 2 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

**Describe the bug**
I want to verify the Quarkus BOM. The Maven build fails because the Dependency Check Maven Plugin wants to load jars that don't exist.

**Version of dependency-check used**
The problem occurs using version 7.0.0 of the maven plugin.

**Log file**
```text

[INFO] Analysis Started
[INFO] Finished Archive Analyzer (12 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (7 seconds)
[ERROR] ----------------------------------------------------
[ERROR] .NET Assembly Analyzer could not be initialized and at least one 'exe' or 'dll' was scanned. The 'dotnet' executable could not be found on the path; either disable the Assembly Analyzer or add the path to dotnet core in the configuration.
[ERROR] ----------------------------------------------------
[INFO] Finished Dependency Merging Analyzer (1 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Created CPE Index (3 seconds)
[INFO] Finished CPE Analyzer (16 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
00:01 INFO: Vulnerability found: jquery below 1.9.0b1
00:01 INFO: Vulnerability found: jquery below 1.12.0
00:01 INFO: Vulnerability found: jquery below 3.4.0
00:01 INFO: Vulnerability found: jquery below 3.5.0
00:01 INFO: Vulnerability found: jquery below 3.5.0
[INFO] Finished RetireJS Analyzer (2 seconds)
[INFO] Finished Sonatype OSS Index Analyzer (1 seconds)
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (1 seconds)
[INFO] Analysis Complete (58 seconds)
[INFO] Writing report to: C:\Entwicklung\github\odc-jar-error\target\dependency-check-report.json
[INFO] Writing report to: C:\Entwicklung\github\odc-jar-error\target\dependency-check-report.html
[WARNING]

One or more dependencies were identified with known vulnerabilities in quarkus-parent:

### **shortened**

[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 01:30 min
[INFO] Finished at: 2022-03-01T13:24:43+01:00
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:7.0.0:check (default) on project quarkus-parent: One or more exceptions occurred during dependency-check analysis: One or more exceptions occurred during analysis:
[ERROR] ArtifactResolverException: io.smallrye.reactive:vertx-mutiny-clients:jar:2.16.0 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] caused by ArtifactResolutionException: io.smallrye.reactive:vertx-mutiny-clients:jar:2.16.0 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] caused by ArtifactNotFoundException: io.smallrye.reactive:vertx-mutiny-clients:jar:2.16.0 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] ArtifactResolverException: io.vertx:vertx-grpc-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] caused by ArtifactResolutionException: io.vertx:vertx-grpc-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] caused by ArtifactNotFoundException: io.vertx:vertx-grpc-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] ArtifactResolverException: io.vertx:vertx-infinispan-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] caused by ArtifactResolutionException: io.vertx:vertx-infinispan-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] caused by ArtifactNotFoundException: io.vertx:vertx-infinispan-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] ArtifactResolverException: io.vertx:vertx-lang-kotlin-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] caused by ArtifactResolutionException: io.vertx:vertx-lang-kotlin-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] caused by ArtifactNotFoundException: io.vertx:vertx-lang-kotlin-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] ArtifactResolverException: io.vertx:vertx-sql-client-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] caused by ArtifactResolutionException: io.vertx:vertx-sql-client-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] caused by ArtifactNotFoundException: io.vertx:vertx-sql-client-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] ArtifactResolverException: io.vertx:vertx-tracing-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] caused by ArtifactResolutionException: io.vertx:vertx-tracing-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] caused by ArtifactNotFoundException: io.vertx:vertx-tracing-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException

Process finished with exit code 1

```

**To Reproduce**

```xml

4.0.0

de.xx.parent
quarkus-parent
1.0-SNAPSHOT
pom

quarkus-parent




io.quarkus.platform
quarkus-bom
2.6.3.Final
pom
import





org.owasp
dependency-check-maven
7.0.0

false

html
json





check





```

**Expected behavior**
Because it is a POM project, you cannot search for a JAR file.
https://search.maven.org/artifact/io.smallrye.reactive/vertx-mutiny-clients/2.16.0/pom

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.