[Java][CI] Failed to generate SBOM by CycloneDX #35086

kou · 2023-04-12T20:45:15Z

Describe the bug, including details regarding any error messages, version, and platform.

https://github.com/ursacomputing/crossbow/actions/runs/4675892709/jobs/8296102801#step:6:17292

[INFO] CycloneDX: Resolving Dependencies
Error: [ERROR] An error occurred attempting to read POM
org.codehaus.plexus.util.xml.pull.XmlPullParserException: UTF-8 BOM plus xml decl of ISO-8859-1 is incompatible (position: START_DOCUMENT seen <?xml version="1.0" encoding="ISO-8859-1"... @1:42) 
    at org.codehaus.plexus.util.xml.pull.MXParser.parseXmlDeclWithVersion (MXParser.java:3439)
    at org.codehaus.plexus.util.xml.pull.MXParser.parseXmlDecl (MXParser.java:3361)
    at org.codehaus.plexus.util.xml.pull.MXParser.parsePI (MXParser.java:3213)
    at org.codehaus.plexus.util.xml.pull.MXParser.parseProlog (MXParser.java:1828)
    at org.codehaus.plexus.util.xml.pull.MXParser.nextImpl (MXParser.java:1757)
    at org.codehaus.plexus.util.xml.pull.MXParser.next (MXParser.java:1375)
    at org.apache.maven.model.io.xpp3.MavenXpp3Reader.read (MavenXpp3Reader.java:3940)
    at org.apache.maven.model.io.xpp3.MavenXpp3Reader.read (MavenXpp3Reader.java:612)
    at org.apache.maven.model.io.xpp3.MavenXpp3Reader.read (MavenXpp3Reader.java:627)
    at org.cyclonedx.maven.BaseCycloneDxMojo.readPom (BaseCycloneDxMojo.java:759)
    at org.cyclonedx.maven.BaseCycloneDxMojo.readPom (BaseCycloneDxMojo.java:746)
    at org.cyclonedx.maven.BaseCycloneDxMojo.retrieveParentProject (BaseCycloneDxMojo.java:694)
    at org.cyclonedx.maven.BaseCycloneDxMojo.getClosestMetadata (BaseCycloneDxMojo.java:524)
    at org.cyclonedx.maven.BaseCycloneDxMojo.convert (BaseCycloneDxMojo.java:481)
    at org.cyclonedx.maven.CycloneDxMojo.execute (CycloneDxMojo.java:70)
    at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:126)
    at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute2 (MojoExecutor.java:342)
    at org.apache.maven.lifecycle.internal.MojoExecutor.doExecute (MojoExecutor.java:330)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:213)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:175)
    at org.apache.maven.lifecycle.internal.MojoExecutor.access$000 (MojoExecutor.java:76)
    at org.apache.maven.lifecycle.internal.MojoExecutor$1.run (MojoExecutor.java:163)
    at org.apache.maven.plugin.DefaultMojosExecutionStrategy.execute (DefaultMojosExecutionStrategy.java:39)
    at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:160)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:105)
    at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:73)
    at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:53)
    at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:118)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:261)
    at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:173)
    at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:101)
    at org.apache.maven.cli.MavenCli.execute (MavenCli.java:827)
    at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:272)
    at org.apache.maven.cli.MavenCli.main (MavenCli.java:195)
    at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke (Method.java:498)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:282)
    at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:225)
    at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:406)
    at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:347)
[INFO] CycloneDX: Creating BOM
[INFO] CycloneDX: Writing BOM (XML): /Users/runner/work/crossbow/crossbow/arrow/java/vector/target/bom.xml
[INFO] CycloneDX: Validating BOM (XML): /Users/runner/work/crossbow/crossbow/arrow/java/vector/target/bom.xml
[INFO] CycloneDX: Writing BOM (JSON): /Users/runner/work/crossbow/crossbow/arrow/java/vector/target/bom.json
[INFO] CycloneDX: Validating BOM (JSON): /Users/runner/work/crossbow/crossbow/arrow/java/vector/target/bom.json
Warning:  Unknown keyword additionalItems - you should define your own Meta Schema. If the keyword is irrelevant for validation, just use a NonValidationKeyword

Component(s)

Continuous Integration, Java

The text was updated successfully, but these errors were encountered:

kou · 2023-04-12T20:48:39Z

@dongjoon-hyun Could you take a look at this because you introduce this feature by #15267?

dongjoon-hyun · 2023-04-12T21:52:18Z

Hi, @kou . Did you change Apache Maven version or CycloneDX plugin version? There was a reported issue for that combinations.

In Apache Spark community, we used a fixed Maven version to avoid Apache Maven project regression.

https://github.com/apache/spark/blob/2931993e059f5d3741fc09438b7da88ccd8d4446/pom.xml#L116

<maven.version>3.8.7</maven.version>

kou · 2023-04-12T23:41:34Z

@dongjoon-hyun Thanks for taking a look at this! Sorry. I'm not familiar with Java but it seems that we didn't change Apache Maven version nor CycloneDX plugin version explicitly. You pinned CycloneDX plugin version in #15267. So CycloneDX plugin version may not be changed. But it seems that we don't pin Apache Maven's version explicitly. So Apache Maven version may be changed.

There was a reported issue for that combinations.

Could you share the URL of the report?

It may fix the "UTF-8 BOM plus xml decl of ISO-8859-1 is incompatible" error.

dongjoon-hyun · 2023-04-12T23:52:02Z

Thank you. I'll check more in Arrow repository.

The report came from Apache Hadoop community while Apache ORC, Apache Parquet, Apache Zookeeper, Apache Spark 3.4.0 RC7 (vote will finished tonight) published SBOM successfully.

Apache Hadoop: apache/hadoop@55254de
Apache ORC 1.7.8: https://repo1.maven.org/maven2/org/apache/orc/orc-core/1.7.8/orc-core-1.7.8-cyclonedx.json
Apache ORC 1.8.2: https://repo1.maven.org/maven2/org/apache/orc/orc-core/1.8.2/orc-core-1.8.2-cyclonedx.json
Apache ORC 1.8.3: https://repo1.maven.org/maven2/org/apache/orc/orc-core/1.8.3/orc-core-1.8.3-cyclonedx.json
Apache Parquet 1.13.0: https://repo1.maven.org/maven2/org/apache/parquet/parquet-common/1.13.0/parquet-common-1.13.0-cyclonedx.json
Apache Zookeeper 3.8.1: https://repo1.maven.org/maven2/org/apache/zookeeper/zookeeper/3.8.1/zookeeper-3.8.1-cyclonedx.json
Apache Spark 3.4.0 RC7: https://repository.apache.org/content/repositories/orgapachespark-1441/org/apache/spark/spark-core_2.12/3.4.0/spark-core_2.12-3.4.0-cyclonedx.json

dongjoon-hyun · 2023-04-13T00:00:20Z

BTW, from Spark community, we found that cyclonedx plugin 2.7.5 has some issues, but cyclones plugin 2.7.6 works fine.

I verified the reported Arrow build issue locally with the following command and verified that new latest plugin fixes it, @kou .

$ mvn clean package -DskipTests --pl vector --am

Let me make a PR.

dongjoon-hyun · 2023-04-13T00:02:31Z

Here is the PR.

GH-35086: Upgrade cyclonedx-maven-plugin to 2.7.6 #35094

kou · 2023-04-13T00:05:38Z

Thanks for the information!
Sorry... I'm trying 2.7.6 in #35092...

dongjoon-hyun · 2023-04-13T00:07:21Z

No problem at all. Thank you always. 👍🏻

It may fix the "UTF-8 BOM plus xml decl of ISO-8859-1 is incompatible" error.

### Rationale for this change CyctloneDX Maven plugin 2.7.3 doesn't work with recent Apache Maven. ### What changes are included in this PR? It may fix the "UTF-8 BOM plus xml decl of ISO-8859-1 is incompatible" error. ### Are these changes tested? Yes. ### Are there any user-facing changes? No. * Closes: #35086 Authored-by: Sutou Kouhei <kou@clear-code.com> Signed-off-by: Sutou Kouhei <kou@clear-code.com>

This PR aims to upgrade `cyclonedx-maven-plugin` from `2.7.3` to `2.7.6` to bring the latest bug fixes. - https://github.com/CycloneDX/cyclonedx-maven-plugin/releases/tag/cyclonedx-maven-plugin-2.7.6 - https://github.com/CycloneDX/cyclonedx-maven-plugin/releases/tag/cyclonedx-maven-plugin-2.7.5 - https://github.com/CycloneDX/cyclonedx-maven-plugin/releases/tag/cyclonedx-maven-plugin-2.7.4 Historically, there was some issue reports on the previous versions with the latest Maven. - apache/spark#40065 - apache/arrow#35086 Now, 2.7.6 is verified in Apache Spark, ORC, Arrow community as of today. - [ORC-1407: Upgrade cyclonedx-maven-plugin to 2.7.6](apache/orc#1463) - [SPARK-42382: Upgrade cyclonedx-maven-plugin to 2.7.6](apache/spark#40726) - [GH-35086: Upgrade CycloneDX Maven plugin version](apache/arrow#35092)

### Rationale for this change CyctloneDX Maven plugin 2.7.3 doesn't work with recent Apache Maven. ### What changes are included in this PR? It may fix the "UTF-8 BOM plus xml decl of ISO-8859-1 is incompatible" error. ### Are these changes tested? Yes. ### Are there any user-facing changes? No. * Closes: #35086 Authored-by: Sutou Kouhei <kou@clear-code.com> Signed-off-by: Sutou Kouhei <kou@clear-code.com>

…ache#35092) ### Rationale for this change CyctloneDX Maven plugin 2.7.3 doesn't work with recent Apache Maven. ### What changes are included in this PR? It may fix the "UTF-8 BOM plus xml decl of ISO-8859-1 is incompatible" error. ### Are these changes tested? Yes. ### Are there any user-facing changes? No. * Closes: apache#35086 Authored-by: Sutou Kouhei <kou@clear-code.com> Signed-off-by: Sutou Kouhei <kou@clear-code.com>

kou added the Type: bug label Apr 12, 2023

github-actions bot added Component: Continuous Integration Component: Java labels Apr 12, 2023

kou mentioned this issue Apr 12, 2023

GH-35018: [CI][Java][C++] Use ARROW_ZSTD_USE_SHARED=OFF for LLVM #35023

Merged

kou added the Priority: Blocker Marks a blocker for the release label Apr 12, 2023

kou changed the title ~~[Java][CI] Failed to generate BOM by CycloneDX~~ [Java][CI] Failed to generate SBOM by CycloneDX Apr 12, 2023

kou added a commit to kou/arrow that referenced this issue Apr 12, 2023

apacheGH-35086: [Java][CI] Upgrade CycloneDX Maven plugin version

b5124d1

It may fix the "UTF-8 BOM plus xml decl of ISO-8859-1 is incompatible" error.

github-actions bot mentioned this issue Apr 12, 2023

GH-35086: [Java][CI] Upgrade CycloneDX Maven plugin version #35092

Merged

github-actions bot assigned kou Apr 12, 2023

github-actions bot mentioned this issue Apr 13, 2023

GH-35086: Upgrade cyclonedx-maven-plugin to 2.7.6 #35094

Closed

kou added a commit to kou/arrow that referenced this issue Apr 13, 2023

apacheGH-35086: [Java][CI] Upgrade CycloneDX Maven plugin version

9acc1dd

It may fix the "UTF-8 BOM plus xml decl of ISO-8859-1 is incompatible" error.

kou closed this as completed in #35092 Apr 13, 2023

kou added this to the 12.0.0 milestone Apr 13, 2023

This was referenced Apr 13, 2023

ZOOKEEPER-4688: Upgrade cyclonedx-maven-plugin to 2.7.6 apache/zookeeper#1995

Closed

PARQUET-2275: Upgrade cyclonedx-maven-plugin to 2.7.6 apache/parquet-mr#1057

Merged

dongjoon-hyun mentioned this issue Apr 13, 2023

HIVE-27263: Upgrade cyclonedx-maven-plugin to 2.7.6 apache/hive#4235

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Java][CI] Failed to generate SBOM by CycloneDX #35086

[Java][CI] Failed to generate SBOM by CycloneDX #35086

kou commented Apr 12, 2023

kou commented Apr 12, 2023

dongjoon-hyun commented Apr 12, 2023 •

edited

kou commented Apr 12, 2023

dongjoon-hyun commented Apr 12, 2023

dongjoon-hyun commented Apr 13, 2023

dongjoon-hyun commented Apr 13, 2023

kou commented Apr 13, 2023

dongjoon-hyun commented Apr 13, 2023

[Java][CI] Failed to generate SBOM by CycloneDX #35086

[Java][CI] Failed to generate SBOM by CycloneDX #35086

Comments

kou commented Apr 12, 2023

Describe the bug, including details regarding any error messages, version, and platform.

Component(s)

kou commented Apr 12, 2023

dongjoon-hyun commented Apr 12, 2023 • edited

kou commented Apr 12, 2023

dongjoon-hyun commented Apr 12, 2023

dongjoon-hyun commented Apr 13, 2023

dongjoon-hyun commented Apr 13, 2023

kou commented Apr 13, 2023

dongjoon-hyun commented Apr 13, 2023

dongjoon-hyun commented Apr 12, 2023 •

edited