Attribute "dependsOn" empty for parent module in multimodule ci-friendly maven project #263
Comments
|
oh, interesting case: can you share a sample simplified project, so we can reproduce and work on improving? |
I'll try to setup something similar and upload it to GH. Will post link to repo afterwards |
I created something similar to our real project in GH repo: https://github.com/asoldo11/demo There are 2 branches:
If there's anything else I can help, let me know |
|
@hboutemy I also tried to run ResultsI do not know if this means anything to You or can help You track down what might be the problem. Also, if You see something in pom.xml problematic and that it can be defined differently, while keeping all relations as is, please let me know so I could test it both on demo and real project. |
|
@asoldo11 ok, I can build, then I'll need your help to define very concretely what you get vs what you expect in your example
|
json in "dependencies" : [
{
"ref" : "pkg:maven/com.example/demo@rev?type=pom",
"dependsOn" : [ ]
},I would expect it to be something like: "dependencies" : [
{
"ref" : "pkg:maven/com.example/demo@rev?type=pom",
"dependsOn" : [
"pkg:maven/com.example/demo-child-1@rev?type=jar",
"pkg:maven/com.example/demo-child-2@rev?type=jar"
]
},
json in "dependencies" : [
{
"ref" : "pkg:maven/com.example/demo@0.0.1-SNAPSHOT?type=pom",
"dependsOn" : [
"pkg:maven/com.example/demo-child-2@0.0.1-SNAPSHOT?type=jar",
"pkg:maven/com.example/demo-child-1@0.0.1-SNAPSHOT?type=jar"
]
},I always looked only json, but same goes for XMLs in <dependencies>
<dependency ref="pkg:maven/com.example/demo@rev?type=pom" />I would expect it to be like this <dependencies>
<dependency ref="pkg:maven/com.example/demo@rev?type=pom">
<dependency ref="pkg:maven/com.example/demo-child-2@rev?type=jar"/>
<dependency ref="pkg:maven/com.example/demo-child-1@rev?type=jar"/>
</dependency> |
|
any progress on this one? |
hboutemy
added a commit
that referenced
this issue
Feb 25, 2023
Signed-off-by: Hervé Boutemy <hboutemy@apache.org>
|
test added in #292 (failing as expected) |
hboutemy
added a commit
that referenced
this issue
Feb 28, 2023
Signed-off-by: Hervé Boutemy <hboutemy@apache.org>
hboutemy
added a commit
that referenced
this issue
Feb 28, 2023
Signed-off-by: Hervé Boutemy <hboutemy@apache.org>
hboutemy
added a commit
that referenced
this issue
Feb 28, 2023
Signed-off-by: Hervé Boutemy <hboutemy@apache.org>
hboutemy
added a commit
that referenced
this issue
Mar 9, 2023
Signed-off-by: Hervé Boutemy <hboutemy@apache.org>
knrc
pushed a commit
to knrc/cyclonedx-maven-plugin
that referenced
this issue
Apr 11, 2023
Signed-off-by: Hervé Boutemy <hboutemy@apache.org>
knrc
added a commit
to knrc/cyclonedx-maven-plugin
that referenced
this issue
Apr 11, 2023
knrc
pushed a commit
to knrc/cyclonedx-maven-plugin
that referenced
this issue
Apr 13, 2023
Signed-off-by: Hervé Boutemy <hboutemy@apache.org>
knrc
added a commit
to knrc/cyclonedx-maven-plugin
that referenced
this issue
Apr 13, 2023
Signed-off-by: Kevin Conner <kev.conner@gmail.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
I am using cylonedx-maven-plugin v2.7.4 to generate SBOM, which I upload to DependencyTrack.
I tried creating a bunch of different projects and uploading analysis to the tool, and for every one I tested, I always got appropriate dependency graph.
But for maven ci-friendly multimodule maven project, dependency graph is not generated at all (I just have root node without + sign like on other projects). I tried with several other multimodule maven projects that are not ci-friendly, but for them I get dependency graph.
If I upload analysis for just one maven module inside this "problematic" maven project, I get corresponding dependency graph (I tried this with all modules inside it and all of them produced graph).
I am attaching both SBOMs for parent project and for one module, only replacing some URLs (all PURLs are intact) which are business private. (module_bom.json produces graph, parent_bom.json does not) sboms.zip
The cycloneDX maven plugin is defined in the root pom.xml like this:
Maven CI-friendly adjustment is done exactly like here.
I am running maven goal
mvn clean packagefrom root of the project.Logs for parent project SBOM creation below:
LOG
From the data itself, I see that inside dependencies, dependsOn for ref that represents root project with packaging POM is empty:
and for other multimodule maven projects this list contains list of all modules and dependencies.
If I manually fill module references for parent ref and upload such SBOM, graph is than correctly displayed.
The text was updated successfully, but these errors were encountered: