Handle "unable to find release history" error

[mscottford]

The java agent will sometimes fail to find history for a package such as:

❯ /usr/local/bin/freshli-agent-java retrieve-release-history pkg:maven/net.jcip/jcip-annotations
Unable to find release history for pkg:maven/net.jcip/jcip-annotations.

This needs to be handled without causing a failure. A warning should be written to the logs though, to indicate that history could not be found for the package.

[mscottford]

This issue has me thinking that it might be a good idea to standardize the status/exit codes that are used by the language agents. For example, -10 could mean "unable to find release history", while -1 could just mean "unhandled or unexpected error" or something like that.

[edwinkortman]

This issue has me thinking that it might be a good idea to standardize the status/exit codes that are used by the language agents. For example, -10 could mean "unable to find release history", while -1 could just mean "unhandled or unexpected error" or something like that.

Yeah, smart! I like that idea. Saves us from having to read the output to see what's up. I'll add a ticket for this later.

[edwinkortman]

I've added a branch to our fixture repository that has this specific page. It's proving difficult to replicate because I'm not getting the package into the BoM. I have yet to find out why, but here's some information I want to keep:

exe/freshli --loglevel=Debug analyze --branch=jcip-annotations --latest-only https://github.com/corgibytes/freshli-fixture-java-test

Running analyze on the jcip-annotations branch for latest only gives me this BoM:

{
  "bomFormat" : "CycloneDX",
  "specVersion" : "1.4",
  "serialNumber" : "urn:uuid:a97e32af-533c-4408-b632-42d39db4a025",
  "version" : 1,
  "metadata" : {
    "timestamp" : "2022-10-26T13:05:29Z",
    "tools" : [
      {
        "vendor" : "OWASP Foundation",
        "name" : "CycloneDX Maven plugin",
        "version" : "2.7.1",
        "hashes" : [
          {
            "alg" : "MD5",
            "content" : "538c878ebf89b372876e247d056a3fc5"
          },
          {
            "alg" : "SHA-1",
            "content" : "4561e50edb47e12a03712b1afce9b20cba32fd28"
          },
          {
            "alg" : "SHA-256",
            "content" : "f0ea7b3bcf5c7ba649b8d9807e805385330501881677d47333aebce8305ef4d4"
          },
          {
            "alg" : "SHA-512",
            "content" : "a35400ca6411692ae8964fe7030eaba2a83a2fa50e2883def3054191283c3b48e2dcdd68bf80f5a0ede3898cc6b7cb7b998aacd2c1e969320053c43b6ab8d873"
          },
          {
            "alg" : "SHA-384",
            "content" : "75c0c03a03c69e82ad1f7b942d6d733da8261c4058174355d6b24ebd88cee34180f2e8484d2b0fedaf459078bdf6e927"
          },
          {
            "alg" : "SHA3-384",
            "content" : "98cd312d4dfc104a0a66d65023d0aade423f08951f2a9e0215e703f0c81c4f274d8e11a2db1abc30a558b820d65860c4"
          },
          {
            "alg" : "SHA3-256",
            "content" : "0c5fd65013128de457b049a824c4ad11212d668b503613ce19a54d545e5cf82d"
          },
          {
            "alg" : "SHA3-512",
            "content" : "72ea0ed8faa3cc4493db96d0223094842e7153890b091ff364040ad3ad89363157fc9d1bd852262124aec83134f0c19aa4fd0fa482031d38a76d74dfd36b7964"
          }
        ]
      }
    ],
    "component" : {
      "group" : "com.corgibytes.freshli.fixture.java.maven",
      "name" : "version-range",
      "version" : "1",
      "licenses" : [ ],
      "purl" : "pkg:maven/com.corgibytes.freshli.fixture.java.maven/version-range@1?type=jar",
      "type" : "library",
      "bom-ref" : "pkg:maven/com.corgibytes.freshli.fixture.java.maven/version-range@1?type=jar"
    }
  },
  "components" : [
    {
      "group" : "commons-io",
      "name" : "commons-io",
      "version" : "2.11.0",
      "scope" : "optional",
      "purl" : "pkg:maven/commons-io/commons-io@2.11.0?type=jar",
      "type" : "library",
      "bom-ref" : "pkg:maven/commons-io/commons-io@2.11.0?type=jar"
    }
  ]
}

Both packages are then filtered out because they don't have any hashes. Investigating why the hashes aren't generated.

[mscottford]

Oh, no! I was using the presence of the hashes to determine whether or not a "component" was a sub-module in a multi-module Maven project. Looks like we might need a different way of doing that.