Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

v2.19.9 Frogbot unable to pull snapshot dependencies #636

Open
wilsonjean opened this issue Feb 7, 2024 · 0 comments
Open

v2.19.9 Frogbot unable to pull snapshot dependencies #636

wilsonjean opened this issue Feb 7, 2024 · 0 comments
Labels
bug Something isn't working

Comments

@wilsonjean
Copy link

wilsonjean commented Feb 7, 2024 •
edited

Describe the bug

With the latest version (v2.19.9) of frogbot when scanning maven repositories using github actions, frogbot does not differentiate between snapshot and release repos. When using an older version (v2.19.1), that behavior is still there.
This results in snapshots not being resolvable with the latest version of frogbot.

Current behavior

Output from v2.19.1

 19:17:13 [Info] Running SCA scan for maven vulnerable dependencies in /tmp/jfrog.cli.temp.-1707333432-3372566281/comp-operations-bus directory...
  19:17:13 [Info] Calculating Maven dependencies...
  19:17:13 [Info] The build-info-extractor jar is not cached locally. Downloading it now...
  You can set the repository from which this jar is downloaded.
  Read more about it at https://jfrog.com/help/r/jfrog-cli/downloading-the-maven-and-gradle-extractor-jars
  19:17:13 [Info] Downloading JFrog's Dependency from https://releases.jfrog.io/artifactory/oss-release-local/org/jfrog/buildinfo/build-info-extractor-maven3/2.41.7/build-info-extractor-maven3-2.41.7-uber.jar
  19:17:14 [Info] Running Mvn...
  19:17:14 [Info] Running mvn command: /opt/java/openjdk/bin/java -classpath /opt/maven/apache-maven-3.6.3/boot/plexus-classworlds-2.6.0.jar -Dmaven.home=/opt/maven/apache-maven-3.6.3 -DbuildInfoConfig.propertiesFile=/tmp/jfrog/properties/extractorProperties2838557318 -Dm3plugin.lib=/tmp/jfrog.cli.temp.-1707333432-2793619834/dependencies/maven/2.41.7 -Dclassworlds.conf=/tmp/jfrog.cli.temp.-1707333432-2793619834/dependencies/maven/2.41.7/classworlds.conf -Dmaven.multiModuleProjectDirectory=/tmp/jfrog.cli.temp.-1707333432-3372566281/comp-operations-bus -DbuildInfoConfig.artifactoryResolutionEnabled=true org.codehaus.plexus.classworlds.launcher.Launcher -B compile test-compile -Dcheckstyle.skip -Denforcer.skip
  [main] INFO org.apache.maven.cli.event.ExecutionEventLogger - Scanning for projects...
  [main] INFO org.apache.maven.cli.transfer.Slf4jMavenTransferListener - Downloading from artifactory-release: https://artifactory/artifactory/comp-maven/org/springframework/boot/spring-boot-starter-parent/2.2.5.RELEASE/spring-boot-starter-parent-2.2.5.RELEASE.pom
  [main] INFO org.apache.maven.cli.transfer.Slf4jMavenTransferListener - Downloaded from artifactory-release: https://artifactory/artifactory/comp-maven/org/springframework/boot/spring-boot-starter-parent/2.2.5.RELEASE/spring-boot-starter-parent-2.2.5.RELEASE.pom (8.1 kB at 18 kB/s)
  [main] INFO org.apache.maven.cli.transfer.Slf4jMavenTransferListener - Downloading from artifactory-release: https://artifactory/artifactory/comp-maven/org/springframework/boot/spring-boot-dependencies/2.2.5.RELEASE/spring-boot-dependencies-2.2.5.RELEASE.pom
  [main] INFO org.apache.maven.cli.transfer.Slf4jMavenTransferListener - Downloaded from artifactory-release: https://artifactory/artifactory/comp-maven/org/springframework/boot/spring-boot-dependencies/2.2.5.RELEASE/spring-boot-dependencies-2.2.5.RELEASE.pom (127 kB at 1.3 MB/s)
  [main] INFO org.apache.maven.cli.transfer.Slf4jMavenTransferListener - Downloading from artifactory-snapshot: https://artifactory/artifactory/comp-maven/ca/company/comp-core-bus-bom/2024.06-SNAPSHOT/maven-metadata.xml
  [main] INFO org.apache.maven.cli.transfer.Slf4jMavenTransferListener - Downloaded from artifactory-snapshot: https://artifactory/artifactory/comp-maven/ca/company/comp-core-bus-bom/2024.06-SNAPSHOT/maven-metadata.xml (611 B at 2.2 kB/s)
  [main] INFO org.apache.maven.cli.transfer.Slf4jMavenTransferListener - Downloading from artifactory-snapshot: https://artifactory/artifactory/comp-maven/ca/company/comp-core-bus-bom/2024.06-SNAPSHOT/comp-core-bus-bom-2024.06-20240207.181752-8.pom
  [main] INFO org.apache.maven.cli.transfer.Slf4jMavenTransferListener - Downloaded from artifactory-snapshot: https://artifactory/artifactory/comp-maven/ca/company/comp-core-bus-bom/2024.06-SNAPSHOT/comp-core-bus-bom-2024.06-20240207.181752-8.pom (1.3 kB at 9.9 kB/s)

Output from v2.19.9

   20:19:17 [Info] Extracted repository successfully
  20:19:17 [Info] Scanning source branch...
  20:19:17 [Info] Preforming 1 SCA scans:
  [
    {
      "Technology": "maven",
      "WorkingDirectory": "/tmp/jfrog.cli.temp.-1706905156-2898861125/comp-operations-bus",
      "Descriptors": [
        "/tmp/jfrog.cli.temp.-1706905156-2898861125/comp-operations-bus/pom.xml"
      ]
    }
  ]
  20:19:17 [Info] Running SCA scan for maven vulnerable dependencies in /tmp/jfrog.cli.temp.-1706905156-2898861125/comp-operations-bus directory...
  20:19:17 [Info] Calculating Maven dependencies...
  20:19:21 [Info] [INFO] Scanning for projects...
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/boot/spring-boot-starter-parent/2.2.5.RELEASE/spring-boot-starter-parent-2.2.5.RELEASE.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/boot/spring-boot-starter-parent/2.2.5.RELEASE/spring-boot-starter-parent-2.2.5.RELEASE.pom (8.1 kB at 27 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/boot/spring-boot-dependencies/2.2.5.RELEASE/spring-boot-dependencies-2.2.5.RELEASE.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/boot/spring-boot-dependencies/2.2.5.RELEASE/spring-boot-dependencies-2.2.5.RELEASE.pom (127 kB at 2.7 MB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/com/fasterxml/jackson/jackson-bom/2.13.5/jackson-bom-2.13.5.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/com/fasterxml/jackson/jackson-bom/2.13.5/jackson-bom-2.13.5.pom (17 kB at 671 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/com/fasterxml/jackson/jackson-parent/2.13/jackson-parent-2.13.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/com/fasterxml/jackson/jackson-parent/2.13/jackson-parent-2.13.pom (7.3 kB at 330 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/com/fasterxml/oss-parent/43/oss-parent-43.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/com/fasterxml/oss-parent/43/oss-parent-43.pom (24 kB at 1.1 MB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/io/rest-assured/rest-assured-bom/5.3.2/rest-assured-bom-5.3.2.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/io/rest-assured/rest-assured-bom/5.3.2/rest-assured-bom-5.3.2.pom (4.3 kB at 203 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/apache/logging/log4j/log4j-bom/2.17.2/log4j-bom-2.17.2.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/apache/logging/log4j/log4j-bom/2.17.2/log4j-bom-2.17.2.pom (8.1 kB at 386 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/apache/logging/logging-parent/5/logging-parent-5.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/apache/logging/logging-parent/5/logging-parent-5.pom (3.3 kB at 126 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/apache/apache/24/apache-24.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/apache/apache/24/apache-24.pom (20 kB at 933 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/spring-framework-bom/5.3.29/spring-framework-bom-5.3.29.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/spring-framework-bom/5.3.29/spring-framework-bom-5.3.29.pom (5.7 kB at 269 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/boot/spring-boot-dependencies/2.7.15/spring-boot-dependencies-2.7.15.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/boot/spring-boot-dependencies/2.7.15/spring-boot-dependencies-2.7.15.pom (110 kB at 3.9 MB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/com/datastax/oss/java-driver-bom/4.14.1/java-driver-bom-4.14.1.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/com/datastax/oss/java-driver-bom/4.14.1/java-driver-bom-4.14.1.pom (4.1 kB at 180 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/io/dropwizard/metrics/metrics-bom/4.2.19/metrics-bom-4.2.19.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/io/dropwizard/metrics/metrics-bom/4.2.19/metrics-bom-4.2.19.pom (7.5 kB at 343 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/io/dropwizard/metrics/metrics-parent/4.2.19/metrics-parent-4.2.19.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/io/dropwizard/metrics/metrics-parent/4.2.19/metrics-parent-4.2.19.pom (20 kB at 964 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/codehaus/groovy/groovy-bom/3.0.19/groovy-bom-3.0.19.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/codehaus/groovy/groovy-bom/3.0.19/groovy-bom-3.0.19.pom (26 kB at 1.3 MB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/infinispan/infinispan-bom/13.0.18.Final/infinispan-bom-13.0.18.Final.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/infinispan/infinispan-bom/13.0.18.Final/infinispan-bom-13.0.18.Final.pom (18 kB at 869 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/infinispan/infinispan-build-configuration-parent/13.0.18.Final/infinispan-build-configuration-parent-13.0.18.Final.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/infinispan/infinispan-build-configuration-parent/13.0.18.Final/infinispan-build-configuration-parent-13.0.18.Final.pom (16 kB at 753 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/jboss/jboss-parent/36/jboss-parent-36.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/jboss/jboss-parent/36/jboss-parent-36.pom (67 kB at 3.2 MB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/glassfish/jersey/jersey-bom/2.35/jersey-bom-2.35.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/glassfish/jersey/jersey-bom/2.35/jersey-bom-2.35.pom (19 kB at 878 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/eclipse/ee4j/project/1.0.6/project-1.0.6.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/eclipse/ee4j/project/1.0.6/project-1.0.6.pom (13 kB at 741 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/eclipse/jetty/jetty-bom/9.4.51.v20230217/jetty-bom-9.4.51.v20230217.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/eclipse/jetty/jetty-bom/9.4.51.v20230217/jetty-bom-9.4.51.v20230217.pom (18 kB at 883 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/junit/junit-bom/5.8.2/junit-bom-5.8.2.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/junit/junit-bom/5.8.2/junit-bom-5.8.2.pom (5.6 kB at 313 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/jetbrains/kotlin/kotlin-bom/1.6.21/kotlin-bom-1.6.21.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/jetbrains/kotlin/kotlin-bom/1.6.21/kotlin-bom-1.6.21.pom (9.3 kB at 389 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/jetbrains/kotlinx/kotlinx-coroutines-bom/1.6.4/kotlinx-coroutines-bom-1.6.4.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/jetbrains/kotlinx/kotlinx-coroutines-bom/1.6.4/kotlinx-coroutines-bom-1.6.4.pom (4.3 kB at 195 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/io/micrometer/micrometer-bom/1.9.14/micrometer-bom-1.9.14.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/io/micrometer/micrometer-bom/1.9.14/micrometer-bom-1.9.14.pom (7.1 kB at 173 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/mockito/mockito-bom/4.5.1/mockito-bom-4.5.1.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/mockito/mockito-bom/4.5.1/mockito-bom-4.5.1.pom (3.0 kB at 142 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/io/netty/netty-bom/4.1.97.Final/netty-bom-4.1.97.Final.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/io/netty/netty-bom/4.1.97.Final/netty-bom-4.1.97.Final.pom (13 kB at 510 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/sonatype/oss/oss-parent/7/oss-parent-7.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/sonatype/oss/oss-parent/7/oss-parent-7.pom (4.6 kB at 272 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/com/squareup/okhttp3/okhttp-bom/4.9.3/okhttp-bom-4.9.3.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/com/squareup/okhttp3/okhttp-bom/4.9.3/okhttp-bom-4.9.3.pom (3.0 kB at 160 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/com/oracle/database/jdbc/ojdbc-bom/21.5.0.0/ojdbc-bom-21.5.0.0.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/com/oracle/database/jdbc/ojdbc-bom/21.5.0.0/ojdbc-bom-21.5.0.0.pom (13 kB at 632 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/io/prometheus/simpleclient_bom/0.15.0/simpleclient_bom-0.15.0.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/io/prometheus/simpleclient_bom/0.15.0/simpleclient_bom-0.15.0.pom (5.8 kB at 263 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/io/prometheus/parent/0.15.0/parent-0.15.0.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/io/prometheus/parent/0.15.0/parent-0.15.0.pom (12 kB at 638 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/com/querydsl/querydsl-bom/5.0.0/querydsl-bom-5.0.0.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/com/querydsl/querydsl-bom/5.0.0/querydsl-bom-5.0.0.pom (7.2 kB at 398 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/io/r2dbc/r2dbc-bom/Borca-SR2/r2dbc-bom-Borca-SR2.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/io/r2dbc/r2dbc-bom/Borca-SR2/r2dbc-bom-Borca-SR2.pom (3.8 kB at 167 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/io/projectreactor/reactor-bom/2020.0.35/reactor-bom-2020.0.35.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/io/projectreactor/reactor-bom/2020.0.35/reactor-bom-2020.0.35.pom (4.6 kB at 209 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/io/rest-assured/rest-assured-bom/4.5.1/rest-assured-bom-4.5.1.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/io/rest-assured/rest-assured-bom/4.5.1/rest-assured-bom-4.5.1.pom (5.8 kB at 291 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/io/rsocket/rsocket-bom/1.1.3/rsocket-bom-1.1.3.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/io/rsocket/rsocket-bom/1.1.3/rsocket-bom-1.1.3.pom (2.6 kB at 132 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/data/spring-data-bom/2021.2.15/spring-data-bom-2021.2.15.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/data/spring-data-bom/2021.2.15/spring-data-bom-2021.2.15.pom (5.7 kB at 317 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/integration/spring-integration-bom/5.5.18/spring-integration-bom-5.5.18.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/integration/spring-integration-bom/5.5.18/spring-integration-bom-5.5.18.pom (9.2 kB at 459 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/security/spring-security-bom/5.7.10/spring-security-bom-5.7.10.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/security/spring-security-bom/5.7.10/spring-security-bom-5.7.10.pom (5.7 kB at 272 kB/s)
  [INFO] Downloading from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/session/spring-session-bom/2021.2.2/spring-session-bom-2021.2.2.pom
  [INFO] Downloaded from artifactory: https://artifactory/artifactory/comp-maven/org/springframework/session/spring-session-bom/2021.2.2/spring-session-bom-2021.2.2.pom (3.1 kB at 119 kB/s)
  Error: ] Some problems were encountered while processing the POMs:
  Error:  Non-resolvable import POM: The following artifacts could not be resolved: ca.company:comp-core-bus-bom:pom:2024.06-SNAPSHOT (absent): Could not find artifact ca.company:comp-core-bus-bom:pom:2024.06-SNAPSHOT @ line 170, column 16
   @ 
  Error:  The build could not read 1 project -> [Help 1]
  Error:    
  Error:    The project ca.company:comp-operations-bus:2024.06-SNAPSHOT (/tmp/jfrog.cli.temp.-1706905156-2898861125/comp-operations-bus/pom.xml) has 1 error
  Error:      Non-resolvable import POM: The following artifacts could not be resolved: ca.company:comp-core-bus-bom:pom:2024.06-SNAPSHOT (absent): Could not find artifact ca.company:comp-core-bus-bom:pom:2024.06-SNAPSHOT @ line 170, column 16 -> [Help 2]

Reproduction steps

No response

Expected behavior

No response

JFrog Frogbot version

v2.19.9

Package manager info

maven pom.xml

Git provider

GitHub

JFrog Frogbot configuration yaml file

No response

Operating system type and version

ubuntu-latest

JFrog Xray version

No response
@wilsonjean wilsonjean added the bug Something isn't working label Feb 7, 2024
@wilsonjean wilsonjean changed the title v2.19.9 Frogbot does not differentiate between artifactory maven snapshot and maven release repositories v2.19.9 Frogbot unable to pull snapshot dependencies Feb 7, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@wilsonjean