Skip to content

jf audit fails with Gradle and org.gradle.parallel=true #3252

@tduchateau-pro

Description

@tduchateau-pro

Describe the bug

When executing the following command: jf audit --gradle --fixable-only --min-severity High, the generateDepTrees Gradle task fails.

Current behavior

Here are the full log:

[INFO] JFrog CLI version: jf version 2.85.0
[INFO] Configuring Gradle properties for JFrog
[INFO] Running JFrog Audit (Fixable only, Min Severity: High)
[INFO] JFrog Audit returned non-zero exit code. Checking for build failures...
14:19:07 [Info] Calculating Gradle dependencies...
14:19:07 [Info] Running gradle deps tree command: ./gradlew clean generateDepTrees -I /tmp/jfrog.cli.temp.-1764944347-3151300615/gradledeptree.init -q -Dorg.gradle.configuration-cache=false -Dcom.jfrog.depsTreeOutputFile=/tmp/jfrog.cli.temp.-1764944347-3151300615/gradledeptree.out -Dcom.jfrog.includeAllBuildFiles=true
14:20:39 [Info] Performing scans on 1 targets:
[
  {
    "target": "/builds/**********/my-project",
    "technology": "gradle"
  }
]
14:20:39 [Info] Not entitled for JAS, skipping advance security scans...
14:20:39 [Info] Trace ID for JFrog Platform logs: f324b2c82a420cbe
14:20:39 [Error] target '/builds/**********/my-project [gradle]' errors:
failed to generate SBOM for /builds/**********/my-project: failed to build dependency tree: failed while building 'gradle' dependency tree: error running gradle-dep-tree: exit status 1
Downloading https://services.gradle.org/distributions/gradle-9.1.0-bin.zip
............10%.............20%.............30%.............40%.............50%............60%.............70%.............80%.............90%.............100%
FAILURE: Build failed with an exception.
* What went wrong:
Execution failed for task ':generateDepTrees'.
> Resolution of the configuration ':bdd:compileClasspath' was attempted without an exclusive lock. This is unsafe and not allowed.
* Try:
> For more information, please refer to https://docs.gradle.org/9.1.0/userguide/viewing_debugging_dependencies.html#sub:resolving-unsafe-configuration-resolution-errors in the Gradle documentation.
> Run with --stacktrace option to get the stack trace.
> Run with --info or --debug option to get more log output.
> Run with --scan to generate a Build Scan (Powered by Develocity).
> Get more help at https://help.gradle.org/.
BUILD FAILED in 1m 31s

Reproduction steps

  1. Init a gradle project (v9.2.1)
  2. Install the latest JFrog CLI (v2.85.0)
  3. In the gradle.properties file of the Gradle projet, add:
org.gradle.parallel=true
  1. Run jf audit --gradle --fixable-only --min-severity High

Current workaround: disable parallel execution for the jf audit using an env var:audit:

export GRADLE_OPTS="-Dorg.gradle.parallel=false"
jf audit --gradle --fixable-only --min-severity High

Expected behavior

No errors when executing the Gradle task :-)

JFrog CLI version

2.85.0

Operating system type and version

eclipse-temurin:25.0.1_8-jdk-alpine Docker image

JFrog Artifactory version

No response

JFrog Xray version

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions