Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-58648

Dependency-check publisher 5.0.2 does not show Results

    XMLWordPrintable

    Details

    • Similar Issues:

      Description

      I'm using ODC 5.0.2 Jenkins Plugin.
      It always sets results to UNSTABLE with or without defined thresholds and does not show neither Trends nor Results.
      Build Arguments:
      --project DCTest --scan OSSTest --enableExperimental --disableArchive --log SRSCAdep.log --cveValidForHours 24 --enableRetired --junitFailOnCVSS 11
      Publisher is configured

      Possible Bug

      This is the Job's console output:


      Started by user Administrator
      Running as SYSTEM
      Building in workspace /var/lib/jenkins/jobs/DCTest/workspace
      [DependencyCheck] [INFO] Checking for updates
      [DependencyCheck] [INFO] Skipping NVD check since last check was within 24 hours.
      [DependencyCheck] [INFO] Skipping RetireJS update since last update was within 24 hours.
      [DependencyCheck] [INFO] Check for updates complete (10 ms)
      [DependencyCheck] [INFO]
      [DependencyCheck]
      [DependencyCheck] Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
      [DependencyCheck]
      [DependencyCheck]
      [DependencyCheck] [INFO] Analysis Started
      [DependencyCheck] [INFO] Finished File Name Analyzer (0 seconds)
      [DependencyCheck] [INFO] Finished Jar Analyzer (0 seconds)
      [DependencyCheck] [INFO] Finished Central Analyzer (0 seconds)
      [DependencyCheck] [INFO] Finished Assembly Analyzer (0 seconds)
      [DependencyCheck] [INFO] Finished Python Package Analyzer (0 seconds)
      [DependencyCheck] [INFO] Finished Dependency Merging Analyzer (0 seconds)
      [DependencyCheck] [INFO] Finished Version Filter Analyzer (0 seconds)
      [DependencyCheck] [INFO] Finished Hint Analyzer (0 seconds)
      [DependencyCheck] [INFO] Created CPE Index (3 seconds)
      [DependencyCheck] [INFO] Finished CPE Analyzer (5 seconds)
      [DependencyCheck] [INFO] Finished False Positive Analyzer (0 seconds)
      [DependencyCheck] [INFO] Finished NVD CVE Analyzer (0 seconds)
      [DependencyCheck] 00:00 INFO: Vulnerability found: jquery below 1.9.0b1
      [DependencyCheck] 00:00 INFO: Vulnerability found: jquery below 1.12.0
      [DependencyCheck] 00:00 INFO: Vulnerability found: jquery below 1.12.0
      [DependencyCheck] 00:00 INFO: Vulnerability found: jquery below 3.4.0
      [DependencyCheck] 00:01 INFO: Vulnerability found: bootstrap below 4.3.1
      [DependencyCheck] 00:01 INFO: Vulnerability found: bootstrap below 4.1.2
      [DependencyCheck] 00:01 INFO: Vulnerability found: bootstrap below 4.1.2
      [DependencyCheck] 00:01 INFO: Vulnerability found: bootstrap below 4.1.2
      [DependencyCheck] [INFO] Finished RetireJS Analyzer (4 seconds)
      [DependencyCheck] [INFO] Finished Sonatype OSS Index Analyzer (0 seconds)
      [DependencyCheck] [INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
      [DependencyCheck] [INFO] Finished Dependency Bundling Analyzer (1 seconds)
      [DependencyCheck] [INFO] Analysis Complete (14 seconds)
      Build step 'Invoke Dependency-Check' changed build result to SUCCESS
      [DependencyCheck] Collecting Dependency-Check artifact
      [DependencyCheck] Unable to find Dependency-Check reports to parse
      Build step 'Publish Dependency-Check results' changed build result to UNSTABLE
      Finished: UNSTABLE

      Log

      Attached log contains no errors

        Attachments

          Activity

          Hide
          sspringett Steve Springett added a comment -

          This is the clue: 

          [DependencyCheck] Unable to find Dependency-Check reports to parse
          

          What does the job configuration have for 'artifact'?

           

          Show
          sspringett Steve Springett added a comment - This is the clue:  [DependencyCheck] Unable to find Dependency-Check reports to parse What does the job configuration have for 'artifact'?  
          Hide
          mbarzanti Marco Barzanti added a comment -

          I changed cli arguments as follows:

          --project DCTest --scan "/var/lib/jenkins/workspace/OSSTest-src" --enableExperimental --disableArchive --log SRSCAdep.log --cveValidForHours 24 --enableRetired --junitFailOnCVSS 11 --out "/var/lib/jenkins/workspace/OSSTest"

          Nothing was changed, no results and I had:

          [DependencyCheck] Unable to find Dependency-Check reports to parse

           

          Show
          mbarzanti Marco Barzanti added a comment - I changed cli arguments as follows: --project DCTest --scan "/var/lib/jenkins/workspace/OSSTest-src" --enableExperimental --disableArchive --log SRSCAdep.log --cveValidForHours 24 --enableRetired --junitFailOnCVSS 11 --out "/var/lib/jenkins/workspace/OSSTest" Nothing was changed, no results and I had: [DependencyCheck] Unable to find Dependency-Check reports to parse  
          Hide
          milkyman Horst Krause added a comment - - edited

          Same for us, when updating from DependencyCheck v4 to v5.

          It looks like the default path for report search was "**/dependency-check-report.xml" in v4 and has changed to "dependency-check-report.xml" in v5.

          We had this field empty in all our job configs. For v4 this was fine. With v5 the reports are not found any more and additionally when a job is triggered the empty report path field is changed automatically to "dependency-check-report.xml".

          So our solution was to change the report path in all jobs to "**/dependency-check-report.xml". Now the reports are found again.

           

          Update: I realized that https://wiki.jenkins.io/display/JENKINS/OWASP+Dependency-Check+Plugin announces a 5.0.2 in july which "Changed the default artifact pattern to **/dependency-check-report.xml".

          So perhaps the issue creator should check if the proper version is running in his installation.

          BTW: Die report file does exist in the jobs workspace?

          Show
          milkyman Horst Krause added a comment - - edited Same for us, when updating from DependencyCheck v4 to v5. It looks like the default path for report search was "**/dependency-check-report.xml" in v4 and has changed to "dependency-check-report.xml" in v5. We had this field empty in all our job configs. For v4 this was fine. With v5 the reports are not found any more and additionally when a job is triggered the empty report path field is changed automatically to "dependency-check-report.xml". So our solution was to change the report path in all jobs to "**/dependency-check-report.xml". Now the reports are found again.   Update: I realized that  https://wiki.jenkins.io/display/JENKINS/OWASP+Dependency-Check+Plugin  announces a 5.0.2 in july which "Changed the default artifact pattern to **/dependency-check-report.xml". So perhaps the issue creator should check if the proper version is running in his installation. BTW: Die report file does exist in the jobs workspace?
          Hide
          sspringett Steve Springett added a comment -

          Also note that https://wiki.jenkins.io/display/JENKINS/OWASP+Dependency-Check+Plugin is readonly and cannot be modified. v5.0.2 is not the current release. Currently release is 5.1.0 https://plugins.jenkins.io/dependency-check-jenkins-plugin

           

          Show
          sspringett Steve Springett added a comment - Also note that https://wiki.jenkins.io/display/JENKINS/OWASP+Dependency-Check+Plugin  is readonly and cannot be modified. v5.0.2 is not the current release. Currently release is 5.1.0  https://plugins.jenkins.io/dependency-check-jenkins-plugin  

            People

            Assignee:
            Unassigned Unassigned
            Reporter:
            mbarzanti Marco Barzanti
            Votes:
            0 Vote for this issue
            Watchers:
            3 Start watching this issue

              Dates

              Created:
              Updated: