Can't use dependency-check plugin in Azure Devops due to large pom size

[martijndebruijn]

Our builds with the lates version of the owasp-dependency plugin are failing due to a Azure specific issue with large pom files.

The latest version of Solr which is used by the plugin has a very large pom (https://repo1.maven.org/maven2/org/apache/lucene/lucene-solr-grandparent/8.11.3/lucene-solr-grandparent-8.11.3.pom) of 529Kb which is hitting the max pom size of Azure Devops.

[maven/v1/org/apache/lucene/lucene-solr-grandparent/8.11.3/lucene-solr-grandparent-8.11.3.pom,](https://pkgs.dev.azure.com/BeFrank/_packaging/befrank-libraries/maven/v1/org/apache/lucene/lucene-solr-grandparent/8.11.3/lucene-solr-grandparent-8.11.3.pom,) status: 400 Bad Request - pom.xml file is too large; the limit is 524288 bytes

Does anyone know a workaround for this problem?

[jeremylong]

This project does not support AzureDevOps. I would post the issue here: https://github.com/dependency-check/azuredevops

[cmardini]

I think if dependency-check pom line 120 can move to lucene-core 9.11.1 (from 8.11.3) that will remove the dependency on lucene-solr-grandparent completely. Of course, it may or may not be "just that simple".

Azure DevOps Maven Artifact Feeds seem to have a pom file size limit (currently at 524288 bytes).

[cmardini]

I think if dependency-check pom line 120 can move to lucene-core 9.11.1 (from 8.11.3) that will remove the dependency on lucene-solr-grandparent completely. Of course, it may or may not be "just that simple".

Azure DevOps Maven Artifact Feeds seem to have a pom file size limit (currently at 524288 bytes).

and
lucene-analyzers-common --> lucene-analysis-common

and I see that lucene 8.X is still having new releases alongside 9.X releases... so possibly not straightforward.

[cmardini]

fyi: For myself, I got the large POM issue resolved in Azure Artifacts. I'm not sure if it applies globally or just to my feed.

[martijndebruijn]

fyi: For myself, I got the large POM issue resolved in Azure Artifacts. I'm not sure if it applies globally or just to my feed.

How?

[cmardini]

fyi: For myself, I got the large POM issue resolved in Azure Artifacts. I'm not sure if it applies globally or just to my feed.

How?

I used an internal process.

Externally, my suggestion would be to start here: https://developercommunity.visualstudio.com/AzureDevOps/report

My description was something like:

Description of Issue: The maven dependency-check plugin version 10.0.3, which is used to find vulnerabilities/CVEs at development/build-time, requires org.apache.lucene:lucene-solr-grandparent:pom:8.11.3 (https://repo.maven.apache.org/maven2/org/apache/lucene/lucene-solr-grandparent/8.11.3), which has a POM file that’s 542261 bytes. When we try to fetch it using Azure Artifacts, we get the following error:

[INFO] --- dependency-check:10.0.3:check (default) @ gkcc ---
Downloading from central: https://pkgs.dev.azure.com/.../maven/v1/org/apache/lucene/lucene-solr-grandparent/8.11.3/lucene-solr-grandparent-8.11.3.pom
...
[ERROR] Failed to execute goal org.owasp:dependency-check-maven:10.0.3:check (default) on project gkcc: Execution default of goal org.owasp:dependency-check-maven:10.0.3:check failed: Plugin org.owasp:dependency-check-maven:10.0.3 or one of its dependencies could not be resolved: Failed to collect dependencies at org.owasp:dependency-check-maven:jar:10.0.3 -> org.owasp:dependency-check-core:jar:10.0.3 -> org.apache.lucene:lucene-core:jar:8.11.3: Failed to read artifact descriptor for org.apache.lucene:lucene-core:jar:8.11.3: The following artifacts could not be resolved: org.apache.lucene:lucene-solr-grandparent:pom:8.11.3 (absent): Could not transfer artifact org.apache.lucene:lucene-solr-grandparent:pom:8.11.3 from/to central (https://pkgs.dev.azure.com/.../maven/v1): status code: 400, reason phrase: Bad Request - pom.xml file is too large; the limit is 524288 bytes (DevOps Activity ID: BD18AC76-...) (400) -> [Help 1]

and

% curl https://redacted:[email protected]/.../maven/v1/org/apache/lucene/lucene-solr-grandparent/8.11.3/lucene-solr-grandparent-8.11.3.pom     
{"$id":"1","innerException":null,"message":"pom.xml file is too large; the limit is 524288 bytes","typeName":"Microsoft.VisualStudio.Services.Maven.Server.Exceptions.MavenPomSizeLimitExceededException, Microsoft.VisualStudio.Services.Maven.Server","typeKey":"MavenPomSizeLimitExceededException","errorCode":0,"eventId":3000}

[martijndebruijn]

Thanks. I've created an issue with Microsoft: https://developercommunity.visualstudio.com/t/pomxml-file-is-too-large;-the-limit-is-/10725600