Gradle 7.1 [Android] Execution failed for task ':app:cyclonedxBom'.

[gitWK86]

os

Android Studio 2021.1.1 version
gradle 7.1.1
java version "11.0.7" 2020-04-14 LTS

details

The demo project failed to obtain dependencies,
The configuration is as follows

No problem after replacing with gradle version 4.2.2......

build.gradle in the root directory

// Top-level build file where you can add configuration options common to all sub-projects/modules.
plugins {
    id 'com.android.application' version '7.1.1' apply false
    id 'com.android.library' version '7.1.1' apply false
    id 'org.jetbrains.kotlin.android' version '1.5.30' apply false
    id "org.cyclonedx.bom" version "1.4.1" apply false
}

task clean(type: Delete) {
    delete rootProject.buildDir
}

app/build.gradle

plugins {
    id 'com.android.application'
    id 'org.jetbrains.kotlin.android'
}

android {
    compileSdk 31

    defaultConfig {
        applicationId "com.h.testabc"
        minSdk 21
        targetSdk 31
        versionCode 1
        versionName "1.0"

        testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
    }

    buildTypes {
        release {
            minifyEnabled false
            proguardFiles getDefaultProguardFile('proguard-android-optimize.txt'), 'proguard-rules.pro'
        }
    }
    compileOptions {
        sourceCompatibility JavaVersion.VERSION_11
        targetCompatibility JavaVersion.VERSION_11
    }
    kotlinOptions {
        jvmTarget = '11'
    }
    buildFeatures {
        viewBinding true
    }
}

apply plugin: "org.cyclonedx.bom"

// skipConfigs doesn't work
cyclonedxBom {
    // skipConfigs is a list of configuration names to exclude when generating the BOM
    //skipConfigs += [":app:debugAndroidTestCompileClasspath", "testCompileClasspath","demoDebugAndroidTestCompileClasspath","app:demoDebugAndroidTestCompileClasspath",":app:demoDebugAndroidTestCompileClasspath"]
}

dependencies {

    implementation 'androidx.core:core-ktx:1.7.0'
    implementation 'androidx.appcompat:appcompat:1.3.0'
    implementation 'com.google.android.material:material:1.4.0'
    implementation 'androidx.constraintlayout:constraintlayout:2.0.4'
    implementation 'androidx.navigation:navigation-fragment-ktx:2.3.5'
    implementation 'androidx.navigation:navigation-ui-ktx:2.3.5'
    testImplementation 'junit:junit:4.13.2'
    androidTestImplementation 'androidx.test.ext:junit:1.1.3'
    androidTestImplementation 'androidx.test.espresso:espresso-core:3.4.0'
}

error log

Execution failed for task ':app:cyclonedxBom'.
> Could not resolve all dependencies for configuration ':app:debugAndroidTestCompileClasspath'.
   > The consumer was configured to find an API of a component, preferably optimized for Android, as well as attribute 'com.android.build.api.attributes.BuildTypeAttr' with value 'debug', attribute 'com.android.build.api.attributes.AgpVersionAttr' with value '7.1.1', attribute 'org.jetbrains.kotlin.platform.type' with value 'androidJvm'. However we cannot choose between the following variants of project :app:
       - Configuration ':app:debugApiElements' variant android-base-module-metadata declares an API of a component, as well as attribute 'com.android.build.api.attributes.AgpVersionAttr' with value '7.1.1', attribute 'com.android.build.api.attributes.BuildTypeAttr' with value 'debug', attribute 'org.jetbrains.kotlin.platform.type' with value 'androidJvm':
           - Unmatched attributes:
               - Provides attribute 'artifactType' with value 'android-base-module-metadata' but the consumer didn't ask for it
               - Provides attribute 'com.android.build.gradle.internal.attributes.VariantAttr' with value 'debug' but the consumer didn't ask for it
               - Doesn't say anything about its target Java environment (preferred optimized for Android)
       - Configuration ':app:debugApiElements' variant android-feature-all-metadata declares an API of a component, as well as attribute 'com.android.build.api.attributes.AgpVersionAttr' with value '7.1.1', attribute 'com.android.build.api.attributes.BuildTypeAttr' with value 'debug', attribute 'org.jetbrains.kotlin.platform.type' with value 'androidJvm':
           - Unmatched attributes:
               - Provides attribute 'artifactType' with value 'android-feature-all-metadata' but the consumer didn't ask for it
               - Provides attribute 'com.android.build.gradle.internal.attributes.VariantAttr' with value 'debug' but the consumer didn't ask for it
               - Doesn't say anything about its target Java environment (preferred optimized for Android)
       - Configuration ':app:debugApiElements' variant android-feature-res-ap_ declares an API of a component, as well as attribute 'com.android.build.api.attributes.AgpVersionAttr' with value '7.1.1', attribute 'com.android.build.api.attributes.BuildTypeAttr' with value 'debug', attribute 'org.jetbrains.kotlin.platform.type' with value 'androidJvm':
           - Unmatched attributes:
               - Provides attribute 'artifactType' with value 'android-feature-res-ap_' but the consumer didn't ask for it
               - Provides attribute 'com.android.build.gradle.internal.attributes.VariantAttr' with value 'debug' but the consumer didn't ask for it
               - Doesn't say anything about its target Java environment (preferred optimized for Android)
       - Configuration ':app:debugApiElements' variant android-feature-signing-config-data declares an API of a component, as well as attribute 'com.android.build.api.attributes.AgpVersionAttr' with value '7.1.1', attribute 'com.android.build.api.attributes.BuildTypeAttr' with value 'debug', attribute 'org.jetbrains.kotlin.platform.type' with value 'androidJvm':
           - Unmatched attributes:
               - Provides attribute 'artifactType' with value 'android-feature-signing-config-data' but the consumer didn't ask for it
               - Provides attribute 'com.android.build.gradle.internal.attributes.VariantAttr' with value 'debug' but the consumer didn't ask for it
               - Doesn't say anything about its target Java environment (preferred optimized for Android)
       - Configuration ':app:debugApiElements' variant android-feature-signing-config-versions declares an API of a component, as well as attribute 'com.android.build.api.attributes.AgpVersionAttr' with value '7.1.1', attribute 'com.android.build.api.attributes.BuildTypeAttr' with value 'debug', attribute 'org.jetbrains.kotlin.platform.type' with value 'androidJvm':
           - Unmatched attributes:
               - Provides attribute 'artifactType' with value 'android-feature-signing-config-versions' but the consumer didn't ask for it
               - Provides attribute 'com.android.build.gradle.internal.attributes.VariantAttr' with value 'debug' but the consumer didn't ask for it
               - Doesn't say anything about its target Java environment (preferred optimized for Android)
       - Configuration ':app:debugApiElements' variant android-java-res declares an API of a component, as well as attribute 'com.android.build.api.attributes.AgpVersionAttr' with value '7.1.1', attribute 'com.android.build.api.attributes.BuildTypeAttr' with value 'debug', attribute 'org.jetbrains.kotlin.platform.type' with value 'androidJvm':
           - Unmatched attributes:
               - Provides attribute 'artifactType' with value 'android-java-res' but the consumer didn't ask for it
               - Provides attribute 'com.android.build.gradle.internal.attributes.VariantAttr' with value 'debug' but the consumer didn't ask for it
               - Doesn't say anything about its target Java environment (preferred optimized for Android)
       - Configuration ':app:debugApiElements' variant android-manifest-metadata declares an API of a component, as well as attribute 'com.android.build.api.attributes.AgpVersionAttr' with value '7.1.1', attribute 'com.android.build.api.attributes.BuildTypeAttr' with value 'debug', attribute 'org.jetbrains.kotlin.platform.type' with value 'androidJvm':
           - Unmatched attributes:
               - Provides attribute 'artifactType' with value 'android-manifest-metadata' but the consumer didn't ask for it
               - Provides attribute 'com.android.build.gradle.internal.attributes.VariantAttr' with value 'debug' but the consumer didn't ask for it
               - Doesn't say anything about its target Java environment (preferred optimized for Android)

* Try:
Run with --stacktrace option to get the stack trace. Run with --info or --debug option to get more log output. Run with --scan to get full insights.

[gounthar]

Same for me with

Build #AI-211.7628.21.2111.8139111, built on February 1, 2022
Runtime version: 11.0.11+9-b60-7590822 amd64
VM: OpenJDK 64-Bit Server VM by Oracle Corporation
Windows 10 10.0
GC: G1 Young Generation, G1 Old Generation
Memory: 1280M
Cores: 8
Registry: external.system.auto.import.disabled=true
Non-Bundled Plugins: com.thoughtworks.gauge (211.6693.111), org.jetbrains.kotlin (211-1.6.10-release-923-AS7442.40), org.intellij.plugins.markdown (211.7142.37)

and

// Top-level build file where you can add configuration options common to all sub-projects/modules.
plugins {
    id 'com.android.application' version '7.1.1' apply false
    id 'com.android.library' version '7.1.1' apply false
    id 'org.cyclonedx.bom' version "1.4.1"
}

task clean(type: Delete) {
    delete rootProject.buildDir
}

I get this as a result:

gradlew cyclonedxBom

Welcome to Gradle 7.2!

Here are the highlights of this release:
 - Toolchain support for Scala
 - More cache hits when Java source files have platform-specific line endings
 - More resilient remote HTTP build cache behavior

For more details see https://docs.gradle.org/7.2/release-notes.html

Starting a Gradle Daemon, 1 incompatible Daemon could not be reused, use --status for details
> Task :cyclonedxBom FAILED

FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':cyclonedxBom'.
> Could not resolve all dependencies for configuration ':app:debugAndroidTestCompileClasspath'.
   > The consumer was configured to find an API of a component, preferably optimized for Android, as well as attribute 'com.android.build.api.attributes.BuildTypeAttr' with value 'debug', attribute 'com.android.build.api.attributes.
AgpVersionAttr' with value '7.1.1'. However we cannot choose between the following variants of project :app:
       - Configuration ':app:debugApiElements' variant android-base-module-metadata declares an API of a component, as well as attribute 'com.android.build.api.attributes.AgpVersionAttr' with value '7.1.1', attribute 'com.android.bu
ild.api.attributes.BuildTypeAttr' with value 'debug':
           - Unmatched attributes:
               - Provides attribute 'artifactType' with value 'android-base-module-metadata' but the consumer didn't ask for it
               - Provides attribute 'com.android.build.gradle.internal.attributes.VariantAttr' with value 'debug' but the consumer didn't ask for it
               - Doesn't say anything about its target Java environment (preferred optimized for Android)
       - Configuration ':app:debugApiElements' variant android-feature-all-metadata declares an API of a component, as well as attribute 'com.android.build.api.attributes.AgpVersionAttr' with value '7.1.1', attribute 'com.android.bu
ild.api.attributes.BuildTypeAttr' with value 'debug':
           - Unmatched attributes:
               - Provides attribute 'artifactType' with value 'android-feature-all-metadata' but the consumer didn't ask for it
               - Provides attribute 'com.android.build.gradle.internal.attributes.VariantAttr' with value 'debug' but the consumer didn't ask for it
               - Doesn't say anything about its target Java environment (preferred optimized for Android)
       - Configuration ':app:debugApiElements' variant android-feature-res-ap_ declares an API of a component, as well as attribute 'com.android.build.api.attributes.AgpVersionAttr' with value '7.1.1', attribute 'com.android.build.a
pi.attributes.BuildTypeAttr' with value 'debug':
           - Unmatched attributes:
               - Provides attribute 'artifactType' with value 'android-feature-res-ap_' but the consumer didn't ask for it
               - Provides attribute 'com.android.build.gradle.internal.attributes.VariantAttr' with value 'debug' but the consumer didn't ask for it
               - Doesn't say anything about its target Java environment (preferred optimized for Android)
       - Configuration ':app:debugApiElements' variant android-feature-signing-config-data declares an API of a component, as well as attribute 'com.android.build.api.attributes.AgpVersionAttr' with value '7.1.1', attribute 'com.and
roid.build.api.attributes.BuildTypeAttr' with value 'debug':
           - Unmatched attributes:
               - Provides attribute 'artifactType' with value 'android-feature-signing-config-data' but the consumer didn't ask for it
               - Provides attribute 'com.android.build.gradle.internal.attributes.VariantAttr' with value 'debug' but the consumer didn't ask for it
               - Doesn't say anything about its target Java environment (preferred optimized for Android)
       - Configuration ':app:debugApiElements' variant android-feature-signing-config-versions declares an API of a component, as well as attribute 'com.android.build.api.attributes.AgpVersionAttr' with value '7.1.1', attribute 'com
.android.build.api.attributes.BuildTypeAttr' with value 'debug':
           - Unmatched attributes:
               - Provides attribute 'artifactType' with value 'android-feature-signing-config-versions' but the consumer didn't ask for it
               - Provides attribute 'com.android.build.gradle.internal.attributes.VariantAttr' with value 'debug' but the consumer didn't ask for it
               - Doesn't say anything about its target Java environment (preferred optimized for Android)
       - Configuration ':app:debugApiElements' variant android-java-res declares an API of a component, as well as attribute 'com.android.build.api.attributes.AgpVersionAttr' with value '7.1.1', attribute 'com.android.build.api.attr
ibutes.BuildTypeAttr' with value 'debug':
           - Unmatched attributes:
               - Provides attribute 'artifactType' with value 'android-java-res' but the consumer didn't ask for it
               - Provides attribute 'com.android.build.gradle.internal.attributes.VariantAttr' with value 'debug' but the consumer didn't ask for it
               - Doesn't say anything about its target Java environment (preferred optimized for Android)
       - Configuration ':app:debugApiElements' variant android-manifest-metadata declares an API of a component, as well as attribute 'com.android.build.api.attributes.AgpVersionAttr' with value '7.1.1', attribute 'com.android.build
.api.attributes.BuildTypeAttr' with value 'debug':
           - Unmatched attributes:
               - Provides attribute 'artifactType' with value 'android-manifest-metadata' but the consumer didn't ask for it
               - Provides attribute 'com.android.build.gradle.internal.attributes.VariantAttr' with value 'debug' but the consumer didn't ask for it
               - Doesn't say anything about its target Java environment (preferred optimized for Android)

* Try:
Run with --stacktrace option to get the stack trace. Run with --info or --debug option to get more log output. Run with --scan to get full insights.

* Get more help at https://help.gradle.org

Deprecated Gradle features were used in this build, making it incompatible with Gradle 8.0.

You can use '--warning-mode all' to show the individual deprecation warnings and determine if they come from your own scripts or plugins.

See https://docs.gradle.org/7.2/userguide/command_line_interface.html#sec:command_line_warnings

BUILD FAILED in 26s
1 actionable task: 1 executed

Here is the debug log.

[caketuzz]

Same for me, it would be nice if we could configure a variant build to run the boming process.

[nscuro]

I think I discovered a workaround. FWIW, it looks like Gradle / Android may have introduced more classpath configs in in versions >4 that cause these issues.

If you ignore the problematic configs, you'll get a (seemingly) complete SBOM:

// build.gradle

// Top-level build file where you can add configuration options common to all sub-projects/modules.
plugins {
    id 'com.android.application' version '7.1.2' apply false
    id 'com.android.library' version '7.1.2' apply false
    id 'org.cyclonedx.bom' version '1.5.0'
}

cyclonedxBom {
    skipConfigs += [
            "debugCompileClasspath",
            "debugAndroidTestCompileClasspath",
            "debugUnitTestCompileClasspath",
            "releaseUnitTestCompileClasspath",
            "debugUnitTestRuntimeClasspath",
            "releaseUnitTestRuntimeClasspath"
    ]
}

$ ./gradlew cyclonedxBom   

...

BUILD SUCCESSFUL in 774ms
1 actionable task: 1 executed

☝️ This is with the default "Blank Activity" project in Android Studio. The resulting SBOM is here: https://gist.github.com/nscuro/442bd29dbcb4b1b55d55c2d610465533

I don't know enough of Gradle or Android to understand why these classpaths are problematic. But they don't seem necessary for SBOM generation. For the time being, skipping them appears to be an OK-ish workaround.