[JIRA] (JENKINS-59869) OWASP Dependency-Check Plugin v5.2.2 declarative pipeline java not recognized

[email protected] (JIRA) Mon, 21 Oct 2019 07:34:25 -0700

Title: Message Title

Terry van der Griend created an issue

Issue Type:	Bug
Assignee:	Unassigned
Components:	dependency-check-jenkins-plugin
Created:	2019-10-21 14:32
Environment:	Windows 2012 Server, Jenkins 2.190.1, Maven 3.6.0, JDK 11.0.1
Priority:	Major
Reporter:	Terry van der Griend

When upgrading the Dependency Check Plugin from version 4 to 5.2.2, we found the following problem.

We are using declarative pipeline scripts to run the Dependency Check Plugin. Formerly with version 4 we could use this setup for running the dependency check.

 
                                                                pipeline {
    agent {
        label 'master'
    }
    environment {
        JAVA_HOME = tool 'jdk-11.0.1'
        mvnHome = tool 'apache-maven-3.6.0'
        PATH = "${JAVA_HOME}\\bin;${mvnHome}\\bin;${env.PATH}"
    }
    stages {
        stage('Build sources') {
            steps {
                bat 'mvn clean verify -DskipTests'
            }
        }
        stage('Analyze dependencies') {
            dependencyCheckAnalyzer(outdir: 'Dependency-Check',
                        suppressionFile: 'owasp-suppressions.xml',
                        scanpath: '',
                        datadir: '',
                        hintsFile: '',
                        zipExtensions: '',
                        isAutoupdateDisabled: true,
                        skipOnScmChange: false,
                        skipOnUpstreamChange: false,
                        includeHtmlReports: true,
                        includeVulnReports: true,
                        includeJsonReports: false,
                        includeCsvReports: false)
            }
        }
    }
} 
                                                            

This would run fine and reports were generated. So now with version 5.2.2 we have adjusted our pipeline script to be complaint with the new plugin.

 
                                                                pipeline {
    agent {
        label 'master'
    }
    environment {
        JAVA_HOME = tool 'jdk-11.0.1'
        mvnHome = tool 'apache-maven-3.6.0'
        PATH = "${JAVA_HOME}\\bin;${mvnHome}\\bin;${env.PATH}"
    }
    stages {
        stage('Build sources') {
            steps {
                bat 'mvn clean verify -DskipTests'
            }
        }
        stage('Analyze dependencies') {
            steps {
                dependencyCheck(additionalArguments: '''
                    -d D:/OWASP/dependency-check-data
                    --noupdate
                    --suppression backend/owasp-suppressions.xml
                    -o Dependency-Check''',
                    odcInstallation: 'dependency-check-5.2.2')
            }
        }
    }
}
 
                                                            

When we run the pipeline with the script mentioned above, we get the following error.
[DependencyCheck] 'java' is not recognized as an internal or external command,
[DependencyCheck] operable program or batch file.
Which makes us suspect that the environment variable aren't passed properly.

Add Comment

This message was sent by Atlassian Jira

--
You received this message because you are subscribed to the Google Groups "Jenkins Issues" group.
To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-issues/JIRA.202611.1571668367000.12214.1571668380109%40Atlassian.JIRA.

[JIRA] (JENKINS-59869) OWASP Dependency-Check Plugin v5.2.2 declarative pipeline java not recognized

Reply via email to