dependency-track: Error was: Input length = 1 while publishing bom.xml in Jenkins pipeline for node.js applications
Current Behavior
After an upgrade from 4.5.0 to 4.6.2 all Jenkins nodejs pipelines started to fail with the same error code. Error was: Input length = 1
[Pipeline] sh
+ case $- in
+ return
+ npx @cyclonedx/bom@3.10.6 --include-dev -o bom.xml
npx: installed 76 in 9.844s
[Pipeline] dependencyTrackPublisher
[DependencyTrack] Publishing artifact to Dependency-Track
[DependencyTrack] An error occurred processing artifact "/home/jenkins/workspace/i-project_minimal-project_master/bom.xml". Error was: Input length = 1
[Pipeline] }
[Pipeline] // script
[Pipeline] }
[Pipeline] // stage
[Pipeline] }
[Pipeline] // withEnv
[Pipeline] }
[Pipeline] // node
[Pipeline] End of Pipeline
ERROR: Uploading artifact failed
[Bitbucket] Notifying commit build result
[Bitbucket] Build result notified
Finished: FAILURE
So far my troubleshooting included:
- Downgrading OWASP Dependency Track Jenkins plugin from 4.2.0 to 4.0.0 since it was upgraded in the same time as pipelines started to fail.
- Checked project files for UTF-8 Encoding
- Changed
npx @cyclonedx/cyclonedx-npm
to npx@cyclonedx/bom@3.10.6
Steps to Reproduce
- Upgrade Dependency Track from 4.5.0 to 4.6.2
- Upgrade OWASP Dependency Track Plugin from 4.0.0 to 4.2.0
- Nothing else, nodejs pipelines just breaks on publishing to D-Track from now.
Expected Behavior
Publish bom.xml to Dependency Track
Dependency-Track Version
4.6.2
Dependency-Track Distribution
Container Image
Database Server
PostgreSQL
Database Server Version
No response
Browser
Mozilla Firefox
Checklist
- I have read and understand the contributing guidelines
- I have checked the existing issues for whether this defect was already reported
About this issue
- Original URL
- State: open
- Created 2 years ago
- Comments: 17 (8 by maintainers)
Here’s bom. bom.xml.gz
OWASP Plugin has been downgraded as well from 4.2.0 to 4.0.0 (It has been updated in the same time as D-Track) I’ll see what I can do about providing SBOM here.