Skip to content

Gradle provider silently returns empty SBOM instead of error when Gradle evaluation fails #361

Description

@a-oren

What happened?

When gradle dependencies or gradle properties fails for a manifest file (e.g., due to unresolvable version catalog references like libs.io.quarkus.quarkus.hibernate.orm), the Java client silently produces an empty SBOM with no error.

Please provide runtime information.

Base commit: 07abddb (build(deps): bump com.diffplug.spotless:spotless-maven-plugin from 3.3.0 to 3.4.0 (#353))

Relevant log output

java -jar ~/work/trustify-da-java-client/target/trustify-da-java-client-0.0.14-SNAPSHOT-cli.jar stack build.gradle
{
  "scanned" : {
    "total" : 0,
    "direct" : 0,
    "transitive" : 0
  },
  "providers" : {
    "rhtpa" : {
      "status" : {
        "ok" : true,
        "name" : "rhtpa",
        "code" : 200,
        "message" : "OK",
        "warnings" : { }
      },
      "sources" : { }
    }
  }
}

How can this issue be reproduced?

Running the Java client against a build.gradle that uses version catalog notation without a configured catalog. example file

java -jar trustify-da-java-client-cli.jar stack /path/to/build.gradle
Expected: An error message indicating the Gradle command failed.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions