OWASP Dependency Check fails while accessing not found URL from Azure CI

See original GitHub issue

Hi,

The plugin in Azure CI throws the below exception. It seems the dependency-check.bat file it’s trying to access the URL (https://raw.githubusercontent.com/Retirejs/retire.js/master/repository/jsrepository.json;) which is not found.

Please do the need full urgently as it’s failing many Azure CI Builds suddenly in Production.

Logs: [ERROR] Failed to initialize the RetireJS repo org.owasp.dependencycheck.data.update.exception.UpdateException: Failed to initialize the RetireJS repo at org.owasp.dependencycheck.data.update.RetireJSDataSource.initializeRetireJsRepo(RetireJSDataSource.java:140) at org.owasp.dependencycheck.data.update.RetireJSDataSource.update(RetireJSDataSource.java:89) at org.owasp.dependencycheck.Engine.doUpdates(Engine.java:875) at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase(Engine.java:680) at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:606) at org.owasp.dependencycheck.App.runScan(App.java:256) at org.owasp.dependencycheck.App.run(App.java:188) at org.owasp.dependencycheck.App.main(App.java:83) Caused by: org.owasp.dependencycheck.utils.DownloadFailedException: Download failed, unable to copy 'https://raw.githubusercontent.com/Retirejs/retire.js/master/repository/jsrepository.json' to 'D:\Agents\Tst\MyAgent\_work\_tool\owasp-dependency-check\6.4.0\x64\dependency-check\data\jsrepository.json'; Error downloading file https://raw.githubusercontent.com/Retirejs/retire.js/master/repository/jsrepository.json; unable to connect. at org.owasp.dependencycheck.utils.Downloader.fetchFile(Downloader.java:135) at org.owasp.dependencycheck.utils.Downloader.fetchFile(Downloader.java:74) at org.owasp.dependencycheck.data.update.RetireJSDataSource.initializeRetireJsRepo(RetireJSDataSource.java:138) ... 7 common frames omitted Caused by: org.owasp.dependencycheck.utils.DownloadFailedException: Error downloading file https://raw.githubusercontent.com/Retirejs/retire.js/master/repository/jsrepository.json; unable to connect. at org.owasp.dependencycheck.utils.HttpResourceConnection.obtainConnection(HttpResourceConnection.java:267) at org.owasp.dependencycheck.utils.HttpResourceConnection.fetch(HttpResourceConnection.java:163) at org.owasp.dependencycheck.utils.Downloader.fetchFile(Downloader.java:130) ... 9 common frames omitted Caused by: java.net.SocketTimeoutException: Connect timed out at java.base/sun.nio.ch.NioSocketImpl.timedFinishConnect(NioSocketImpl.java:546) at java.base/sun.nio.ch.NioSocketImpl.connect(NioSocketImpl.java:597) at java.base/java.net.Socket.connect(Socket.java:648) at java.base/sun.net.NetworkClient.doConnect(NetworkClient.java:177) at java.base/sun.net.www.http.HttpClient.openServer(HttpClient.java:474) at java.base/sun.net.www.http.HttpClient.openServer(HttpClient.java:569) at java.base/sun.net.www.protocol.https.HttpsClient.<init>(HttpsClient.java:265) at java.base/sun.net.www.protocol.https.HttpsClient.New(HttpsClient.java:372) at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(AbstractDelegateHttpsURLConnection.java:177) at java.base/sun.net.www.protocol.http.HttpURLConnection.plainConnect0(HttpURLConnection.java:1194) at java.base/sun.net.www.protocol.http.HttpURLConnection.plainConnect(HttpURLConnection.java:1082) at java.base/sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:163) at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:142) at org.owasp.dependencycheck.utils.HttpResourceConnection.obtainConnection(HttpResourceConnection.java:206) ... 11 common frames omitted [INFO] Begin database defrag [INFO] End database defrag (2672 ms) [WARN] Unable to update 1 or more Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities. [ERROR] Unable to continue dependency-check analysis. [ERROR] One or more fatal errors occurred [ERROR] Failed to initialize the RetireJS repo [ERROR] No documents exist

Issue Analytics

  • State:closed
  • Created 2 years ago
  • Comments:5 (2 by maintainers)

github_iconTop GitHub Comments

1reaction
jeremylongcommented, Dec 13, 2021

@nhumblot feel free to submit a PR!

1reaction
aikebahcommented, Nov 15, 2021

@nhumblot I think such a message could be beneficial yes. But would propose to do the change under a new feature-request issue rather than using this issue.

Read more comments on GitHub >

github_iconTop Results From Across the Web

OWASP Dependency-Check
Dependency -Check is a Software Composition Analysis (SCA) tool suite that identifies project dependencies and checks if there are any known, ...
Read more >
Sec in your DevOps: Adding the OWASP Dependency Check ...
Go to `Manage Jenkins > Manage Plugins > Available` and filter for the OWASP Dependency-Check plugin to get started.
Read more >
azure-devops owasp plugin doesn't find dependencies
When I run mvn verify locally, against a java project. Owasp returns quite the list of found vulnerabilities. However when I do the...
Read more >
Container Scanning - GitLab Docs
When downloading, you always receive the most-recent artifact. If dependency scan is enabled, a Dependency Scanning report artifact is also created.
Read more >
Pipeline caching - Azure - Microsoft Learn
Improve pipeline performance by caching files, like dependencies, ... This could result in the task failing when this "file" doesn't exist.
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found