cdxgen
cdxgen copied to clipboard
No trace logs for under the hood executions
I am trying to generate SBOM on Maven project. It however hangs on mvnw org.cyclonedx:cyclonedx-maven-plugin:2.8.0:makeAggregateBom -DoutputName=bom -DincludeTestScope=true
for ~1h then reverting to mvnw dependency:tree -DoutputFile=/tmp/cdxmvn-8qMLXx/mvn-tree.txt
which hangs too with no output.
Is there a flag or something that will show the problem why execution takes so long, because manual exections of these commands on target dir finishes in a couple of minutes.
Finished with
14:57:15 Testing the wrapper script by invoking wrapper:wrapper task
14:57:17 Executing '/u01/jenkins/workspace/project/mvnw org.cyclonedx:cyclonedx-maven-plugin:2.8.0:makeAggregateBom -DoutputName=bom -DincludeTestScope=true' in /u01/jenkins/workspace/project
15:43:17 Fallback to executing /u01/jenkins/workspace/project/mvnw dependency:tree -DoutputFile=/tmp/cdxmvn-8qMLXx/mvn-tree.txt
16:28:56
16:28:56 Resolve the above maven error. This could be due to the following:
16:28:56
16:28:56 1. Java version requirement: cdxgen container image bundles Java 21 with maven 3.9 which might be incompatible. Try running cdxgen with the unofficial JDK11-based image `ghcr.io/appthreat/cdxgen-java:v10`.
16:28:56 2. Private dependencies cannot be downloaded: Check if any additional arguments must be passed to maven and set them via MVN_ARGS environment variable.
16:28:56 3. Check if all required environment variables including any maven profile arguments are passed correctly to this tool.
16:28:56
Running analysis with /u01/jenkins/workspace/squashfs-root/AppRun --trace-warnings -r -o project-sbom.json