-
Type:
Bug
-
Resolution: Won't Fix
-
Priority:
Major
-
Component/s: dependency-check-jenkins-plugin
-
None
-
Environment:Running Jenkins 2.16 on Windows Server 2008 under Tomcat 8.5.4. OWASP Dependency-Check Plugin 1.4.2
Around 50% of the time OWASP will not release a file after a scan (in windows). This causes a file-lock during SVN cleanup or workspace delete when attempting to run the maven build again.
I created a pre-scm batch script to kill any open handles before executing svn cleanup, which allows the build to continue... However, when post build OWASP runs, it'll fail due to when the file handle is killed in windows it causes an exception with the OWASP process on the next scan.
[DependencyCheck] One or more exceptions were thrown while executing Dependency-Check
[DependencyCheck] jzentry == 0,
[DependencyCheck] jzfile = 339280064,
[DependencyCheck] total = 1441,
[DependencyCheck] name = E:\Jenkins\workspace-removed-.jar,
[DependencyCheck] i = 1,
[DependencyCheck] message = null
At this point, the only option I have is to disable the OWASP scan from builds or restart tomcat/jenkins whenever it encounters a locked file.
Any other suggestions (other than moving to linux)?