Problem uploading BOM to OWASP Dependency Track

I was trying to use cdxgen to generate BOM and upload it to Dependency Track for analysis, but it doesn’t work. The project is created in Dependency Track (if it doesn’t exist) and the BOM file is uploaded, but the analysis fails. In the logs I can see errors like this:

dtrack-apiserver_1 | Caused by: org.datanucleus.exceptions.NucleusUserException: Attempt to store value "d3af366f679d75a6f5eb5e7575ae5b77879fdfcd3cd5ef5bdbb7fc79bdf771ddbd6da7f8d5fe3df7a7787bcf1ee9eef4" in column ""SHA_256"" that has maximum length of 64. Please correct your data!

As you can see, the database expects a maximum of 64 characters, but 96 are sent.

Digging a bit deeper in the code of cdxgen I saw that the component’s hashes are encoded in hexadecimal instead of adding directly the base64 hash (function addComponentHash).

let hash = Buffer.from(digest, "base64").toString("hex");

Is this being hex encoded for any particular reason?

Thanks.

[sgarciaquobis]

It’s working perfectly now. Thank you very much for the quick response and fix.

[sgarciaquobis]

No problem, happy to help.

It might not be the most elegant solution but this will return digest if it’s already in hex format, or empty string otherwise.

Buffer.from(digest, 'hex').toString('hex')