Precondition
Describe the bug
We are successfully authenticating to the OSS Index using the CLI tool but those same credentials do not work for the Maven and Gradle plugins. We arerunning scans in Gitlab CI/CD jobs in the following way:
CLI
.owaspdc.scan.cli:
script:
- check_node_duplicate_dependencies
- dependency-check
--noupdate
--enableExperimental
--disableNodeAuditCache
--nodeAuditSkipDevDependencies
--nodePackageSkipDevDependencies
--ossIndexRemoteErrorWarnOnly true
--format JSON
--format HTML
--suppression suppression.xml
--exclude $EXCLUDE
--scan .
--ossIndexUsername $OSS_USERNAME
--ossIndexPassword $OSS_API_TOKEN
Maven
.owaspdc.scan.maven:
script:
- maven_check_versions
- ./mvnw org.owasp:dependency-check-maven:check -DdataDirectory=$DATA_DIR -DossIndexUsername=$OSS_USERNAME -DossIndexPassword=$OSS_API_TOKEN
Gradle
.owaspdc.scan.gradle:
script:
- *owaspdc-setup
- gradle_check_versions
- ./gradlew dependencyCheckAggregate -Ddata.directory=$DATA_DIR -Danalyzers.ossIndex.username=$OSS_USERNAME -Danalyzers.ossIndex.password=$OSS_API_TOKEN
As you can see, all three jobs use the same credentials, but the Maven and Gradle plugins are not able to authenticate.
Version of dependency-check used
The problem occurs using version 12.1.3 of the Gradle and Maven plugins
Log file
When reporting errors, 99% of the time log file output is required. Please post the log file as a gist and provide a link in the new issue.
To Reproduce
Steps to reproduce the behavior:
- Go to '...'
- Click on '....'
- Scroll down to '....'
- See error
Expected behavior
A clear and concise description of what you expected to happen.
Additional context
Add any other context about the problem here.
Precondition
Describe the bug
We are successfully authenticating to the OSS Index using the CLI tool but those same credentials do not work for the Maven and Gradle plugins. We arerunning scans in Gitlab CI/CD jobs in the following way:
CLI
Maven
Gradle
As you can see, all three jobs use the same credentials, but the Maven and Gradle plugins are not able to authenticate.
Version of dependency-check used
The problem occurs using version 12.1.3 of the Gradle and Maven plugins
Log file
When reporting errors, 99% of the time log file output is required. Please post the log file as a gist and provide a link in the new issue.
To Reproduce
Steps to reproduce the behavior:
Expected behavior
A clear and concise description of what you expected to happen.
Additional context
Add any other context about the problem here.