[2.1.1/Maven plugin] Build failure due to connection error - Unable to connect to 'https://api.nodesecurity.io/check'

While switching from 1.4.5 to 2.1.1 the analysis fails due a connection error at https://api.nodesecurity.io/check (the page does not seem to exist right now)

Is this value somehow hard-coded or can it be disabled to prevent this error from happening?

The Jenkins log contains

...
16:35:08 [INFO] Skipping NVD check since last check was within 4 hours.
16:35:08 [INFO] Check for updates complete (1 ms)
16:35:08 [INFO] Analysis Started
16:35:09 [INFO] Finished Archive Analyzer (0 seconds)
16:35:09 [INFO] Launching: [bundle-audit, check, --verbose] from /tmp/dctemp70811fe0-91d5-464f-b26d-a6cc9cf61ff6
16:35:09 [ERROR] Exception occurred initializing Ruby Bundle Audit Analyzer.
16:35:09 [INFO] Finished File Name Analyzer (0 seconds)
16:35:11 [INFO] Finished Jar Analyzer (2 seconds)
16:35:22 [INFO] Finished Central Analyzer (11 seconds)

and fails with

16:35:26 [ERROR] Failed to execute goal org.owasp:dependency-check-maven:2.1.1:check (default) on project 365FarmNet: One or more exceptions occurred during dependency-check analysis: One or more exceptions occurred during dependency-check analysis
16:35:26 [ERROR] Exception from bundle-audit process: java.io.IOException: Cannot run program "bundle-audit" (in directory "/tmp/dctemp70811fe0-91d5-464f-b26d-a6cc9cf61ff6"): error=2, No such file or directory. Disabling Ruby Bundle Audit Analyzer
16:35:26 [ERROR] Unable to connect to 'https://api.nodesecurity.io/check' - the Java trust store does not contain a trusted root for the cert.  Please see https://github.com/jeremylong/InstallCert for one method of updating the trusted certificates.
16:35:26 [ERROR] -> [Help 1]

Since the problem is related to a broken link it has nothing to do with any certs.

Here’s my Maven config:

<profile>
			<id>owasp</id>
			<build>
				<defaultGoal>dependency-check:check</defaultGoal>
				<plugins>
					<plugin>
						<groupId>org.owasp</groupId>
						<artifactId>dependency-check-maven</artifactId>
						<version>2.1.1</version>
						<executions>
							<execution>
								<goals>
									<goal>check</goal>
								</goals>
							</execution>
						</executions>
					</plugin>
					<plugin>
						<groupId>org.apache.maven.plugins</groupId>
						<artifactId>maven-surefire-plugin</artifactId>
						<configuration>
							<skipTests>true</skipTests>
						</configuration>
					</plugin>
				</plugins>
			</build>
		</profile>

[ottlinger]

Thanks for your hints - it made the builds go green again 😃

Would it make sense to file a PR to print the current configuration concerning the analyzers when the build starts? Without your help I wouldn’t have known which analyzers to disable.

WDYT?

Thanks again for your help.

[jeremylong]

You likely want to do the following:

<configuration>
    <nspAnalyzerEnabled>false</nspAnalyzerEnabled>
    <nodeAnalyzerEnabled>false</nodeAnalyzerEnabled>
    <rubygemsAnalyzerEnabled>false</rubygemsAnalyzerEnabled>
    <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
    <bundleAuditAnalyzerEnabled>false</bundleAuditAnalyzerEnabled>
</configuration>