dependency-check / dependency-check/DependencyCheck
ArtifactResolverException when no jar found in a pom project.
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
**Describe the bug**
I want to verify the Quarkus BOM. The Maven build fails because the Dependency Check Maven Plugin wants to load jars that don't exist.
**Version of dependency-check used**
The problem occurs using version 7.0.0 of the maven plugin.
**Log file**
```text
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (12 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (7 seconds)
[ERROR] ----------------------------------------------------
[ERROR] .NET Assembly Analyzer could not be initialized and at least one 'exe' or 'dll' was scanned. The 'dotnet' executable could not be found on the path; either disable the Assembly Analyzer or add the path to dotnet core in the configuration.
[ERROR] ----------------------------------------------------
[INFO] Finished Dependency Merging Analyzer (1 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Created CPE Index (3 seconds)
[INFO] Finished CPE Analyzer (16 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
00:01 INFO: Vulnerability found: jquery below 1.9.0b1
00:01 INFO: Vulnerability found: jquery below 1.12.0
00:01 INFO: Vulnerability found: jquery below 3.4.0
00:01 INFO: Vulnerability found: jquery below 3.5.0
00:01 INFO: Vulnerability found: jquery below 3.5.0
[INFO] Finished RetireJS Analyzer (2 seconds)
[INFO] Finished Sonatype OSS Index Analyzer (1 seconds)
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (1 seconds)
[INFO] Analysis Complete (58 seconds)
[INFO] Writing report to: C:\Entwicklung\github\odc-jar-error\target\dependency-check-report.json
[INFO] Writing report to: C:\Entwicklung\github\odc-jar-error\target\dependency-check-report.html
[WARNING]
One or more dependencies were identified with known vulnerabilities in quarkus-parent:
### **shortened**
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time: 01:30 min
[INFO] Finished at: 2022-03-01T13:24:43+01:00
[INFO] ------------------------------------------------------------------------
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:7.0.0:check (default) on project quarkus-parent: One or more exceptions occurred during dependency-check analysis: One or more exceptions occurred during analysis:
[ERROR] ArtifactResolverException: io.smallrye.reactive:vertx-mutiny-clients:jar:2.16.0 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] caused by ArtifactResolutionException: io.smallrye.reactive:vertx-mutiny-clients:jar:2.16.0 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] caused by ArtifactNotFoundException: io.smallrye.reactive:vertx-mutiny-clients:jar:2.16.0 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] ArtifactResolverException: io.vertx:vertx-grpc-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] caused by ArtifactResolutionException: io.vertx:vertx-grpc-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] caused by ArtifactNotFoundException: io.vertx:vertx-grpc-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] ArtifactResolverException: io.vertx:vertx-infinispan-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] caused by ArtifactResolutionException: io.vertx:vertx-infinispan-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] caused by ArtifactNotFoundException: io.vertx:vertx-infinispan-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] ArtifactResolverException: io.vertx:vertx-lang-kotlin-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] caused by ArtifactResolutionException: io.vertx:vertx-lang-kotlin-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] caused by ArtifactNotFoundException: io.vertx:vertx-lang-kotlin-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] ArtifactResolverException: io.vertx:vertx-sql-client-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] caused by ArtifactResolutionException: io.vertx:vertx-sql-client-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] caused by ArtifactNotFoundException: io.vertx:vertx-sql-client-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] ArtifactResolverException: io.vertx:vertx-tracing-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] caused by ArtifactResolutionException: io.vertx:vertx-tracing-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] caused by ArtifactNotFoundException: io.vertx:vertx-tracing-parent:jar:4.2.2 was not found in https://artifactory.int.xx.de/artifactory/libs-release during a previous attempt. This failure was cached in the local repository and resolution is not reattempted until the update interval of central has elapsed or updates are forced
[ERROR] -> [Help 1]
[ERROR]
[ERROR] To see the full stack trace of the errors, re-run Maven with the -e switch.
[ERROR] Re-run Maven using the -X switch to enable full debug logging.
[ERROR]
[ERROR] For more information about the errors and possible solutions, please read the following articles:
[ERROR] [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException
Process finished with exit code 1
```
**To Reproduce**
```xml
4.0.0
de.xx.parent
quarkus-parent
1.0-SNAPSHOT
pom
quarkus-parent
io.quarkus.platform
quarkus-bom
2.6.3.Final
pom
import
org.owasp
dependency-check-maven
7.0.0
false
html
json
check
```
**Expected behavior**
Because it is a POM project, you cannot search for a JAR file.
https://search.maven.org/artifact/io.smallrye.reactive/vertx-mutiny-clients/2.16.0/pom
Contributor guide
Assessment
This issue has not been assessed yet.