Command-Line configuration for findings parameters

[dschettl]

My goal is to do my first step in direction for increasing security. So I check every project via command-line for bad libs.

I want to set my findings thresholds via "-D"-parameters in the command-line.
If I configure this section in my pom, all works fine. If there are bad libs, the build breaks:
<findingThresholds> <critical>0</critical> <high>0</high> <medium>100</medium> <low>100</low> </findingThresholds>

But If i set this values via command-line and delete the values from the pom, the build is not breaking:
mvn io.github.pmckeown:dependency-track-maven-plugin:findings -Ddependency-track.failOnError=true -Ddependency-track.findingthresholds.critical=0 -Ddependency-track.findingThresholds.high=0 -Ddependency-track.findingThresholds.medium=100 -Ddependency-track.findingThresholds.low=100

Is this a bug? What's my mistake?

By the way: The same behavior in all check-goals ...

Thanks for helping ...
Denis

[pmckeown]

Hi Denis, thanks for raising this but you can't set the value of nested properties in maven. So the finding thresholds are not settable in this way.

This Stackoverflow answer explains what you are experiencign and provides a way to get round it using custom system properties to override the plugin configuration.

https://stackoverflow.com/questions/40023283/how-to-define-complex-maven-properties-in-the-comand-line