https://bz.apache.org/bugzilla/show_bug.cgi?id=70273
Bug ID: 70273
Summary: CycloneDX-Antlib: NullPointerException caused by
evicted modules
Product: Ant
Version: 1.10.14
Hardware: PC
Status: NEW
Severity: normal
Priority: P2
Component: CycloneDX Antlib
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
Created attachment 40225
--> https://bz.apache.org/bugzilla/attachment.cgi?id=40225&action=edit
Contains the ivy.xml file and build.xml to help with reproducing the issue.
### Problem description
When trying to generate a SBOM file for a project that depends on:
<dependency org="com.squareup.okhttp3" name="okhttp" rev="4.12.0"/>
a NullPointerException occurs.
The failing line is:
at
org.apache.ant.cyclonedx.IvyModuleComponentResolver.toComponent(IvyModuleComponentResolver.java:263)
The corresponding source code is:
ModuleRevisionId mrid = md.getModuleRevisionId();
(the ModuleDescriptor 'md' is null)
### End-user analysis
Tracing the ModuleDescriptor back to the source leads to:
org.apache.ant.cyclonedx.IvyModuleComponentResolver#appendDependencies
which does
deps.add(d.getDescriptor());
but d.getDescriptor() returns null.
I found 2 ModuleRevisionIds for which the ModuleDescriptor is null:
- org.jetbrains.kotlin#kotlin-stdlib-common;1.8.21
- org.jetbrains.kotlin#kotlin-stdlib-jdk8;1.9.10
This matches the list of modules evicted during ivy resolution exactly:
:: resolution report :: resolve 359ms :: artifacts dl 44ms
:: evicted modules:
org.jetbrains.kotlin#kotlin-stdlib-jdk8;1.9.10 by
[org.jetbrains.kotlin#kotlin-stdlib-jdk8;1.8.21] in [default]
org.jetbrains.kotlin#kotlin-stdlib-common;1.8.21 by
[org.jetbrains.kotlin#kotlin-stdlib-common;1.9.10] in [default]
Investigating the .pom files, I can see:
com.squareup.okhttp3#okhttp;4.12.0
depends on com.squareup.okio#okio;3.6.0
depends on org.jetbrains.kotlin#kotlin-stdlib-jdk8;1.8.21
com.squareup.okio#okio;3.6.0
depends on com.squareup.okio#okio-jvm;3.6.0
depends on org.jetbrains.kotlin#kotlin-stdlib-jdk8;1.9.10
Notably, the behaviour of <ivy:dependencytree/> is correct, only showing the
not-evicted revision in the tree.
### Attempted Fix
I patched 'appendDependencies' to skip ModuleDescriptors which are null.
The resulting SBOM contains the correct/expected revisions:
org.jetbrains.kotlin#kotlin-stdlib-jdk8;1.8.21
org.jetbrains.kotlin#kotlin-stdlib-common;1.9.10
However, this seems like a hack (fixing the symptom). I suspect issue sits
further "upstream".
--
You are receiving this mail because:
You are the assignee for the bug.
