nav[aria-label="Primary Navigation"] { padding: 0; & ul { list-style: none; width: 100%; display: flex; flex-direction: row; justify-content: start; align-items: start; gap: 30px; padding: 0; & li { margin: 0; } & ul li { list-style: none; } } }

Download of bitbucket-dependency-scanner:0.1.4 terminates with unexpected EOF

Paul S

Specific error message:

Status: Downloaded newer image for bitbucketpipelines/bitbucket-dependency-scanner:0.1.4

time="2024-11-19T16:21:25Z" level=error msg="error waiting for container: unexpected EOF"

<span><span>I tried multiple times. Think these would fail with the memory limit error as well.<br><br>Then tried 0.1.3 and it worked (sort of - it then fails of course.):<br><br></span></span>

Status: Downloaded newer image for bitbucketpipelines/bitbucket-dependency-scanner:0.1.3

WARNING: New version available: atlassian/bitbucket-dependency-scanner '0.1.3' to '0.1.4'

<span><span>Tied 0.1.4 again and this time it <em>seemed</em> to get further, yet still didn't complete. Tried adding 'DEBUG: "true"' and then every run would fail "</span></span><span>Container 'docker' exceeded&nbsp;</span><a href="https://support.atlassian.com/bitbucket-cloud/docs/databases-and-service-containers/#Service-memory-limits" rel="noopener nofollow noreferrer" target="_blank">memory limit</a><span>."<br>And no log file to be had.<br><br>Trying with 0.1.2 which eventually also failed with an EOF error following a docker exceeded memory limit error.</span>

[ERROR] NodeAuditAnalyzer failed on /opt/atlassian/pipelines/agent/build/package-lock.json

[WARN] An error occurred while analyzing '/opt/atlassian/pipelines/agent/build/package-lock.json' (Node Audit Analyzer).

[INFO] Finished Node Audit Analyzer (0 seconds)

[WARN] The Yarn Audit Analyzer has been disabled. Yarn executable was not found.

time="2024-11-19T21:41:41Z" level=error msg="error waiting for container: unexpected EOF"

Finally got a log file with the following error at the end:

2024-11-20 16:19:26,129 org.owasp.dependencycheck.App:216 ERROR - Could not perform Node Audit analysis. Invalid payload submitted to Node Audit API. 2024-11-20 16:19:26,129 org.owasp.dependencycheck.App:217 DEBUG - unexpected error org.owasp.dependencycheck.analyzer.exception.SearchException: Could not perform Node Audit analysis. Invalid payload submitted to Node Audit API. at org.owasp.dependencycheck.data.nodeaudit.NodeAuditSearch.submitPackage(NodeAuditSearch.java:209) at org.owasp.dependencycheck.data.nodeaudit.NodeAuditSearch.submitPackage(NodeAuditSearch.java:133) at org.owasp.dependencycheck.analyzer.NodeAuditAnalyzer.analyzePackage(NodeAuditAnalyzer.java:189) at org.owasp.dependencycheck.analyzer.NodeAuditAnalyzer.analyzeDependency(NodeAuditAnalyzer.java:146) at org.owasp.dependencycheck.analyzer.AbstractAnalyzer.analyze(AbstractAnalyzer.java:131) at org.owasp.dependencycheck.AnalysisTask.call(AnalysisTask.java:88) at org.owasp.dependencycheck.AnalysisTask.call(AnalysisTask.java:37) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642) at java.base/java.lang.Thread.run(Thread.java:1570) 2024-11-20 16:19:26,130 org.owasp.dependencycheck.utils.Settings:890 DEBUG - Deleting ALL temporary files from `/tmp/dctemp0ba92bc5-01f2-458d-a6f0-bbb48e95f856` 2024-11-20 16:19:26,134 org.owasp.dependencycheck.App:90 DEBUG - Exit code: 14<br><br>

Today trying again with 1.0.2 it keeps failing (exceeded memory limit):

WARNING: New version available: atlassian/bitbucket-dependency-scanner '0.1.2' to '0.1.4'

INFO: Writing Dependency Scanner verbose logging information to ./dependency-check-report-73.log

DEBUG: dependency-check generated command: 

/usr/share/dependency-check/bin/dependency-check.sh --enableExperimental --format=JSON --prettyPrint --scan=. --nvdApiKey=$NVDAPIKEY --out=. --format=HTML --log=./dependency-check-report-73.log

[INFO] Checking for updates

[INFO] NVD API has 10,756 records in this update

[INFO] Downloaded 10,000/10,756 (93%)

Accepted answers

All comments

Oleksandr Kyrdan

Hi @Paul S

Thank you for your question!

Could you check and provide a screenshot of the Metrics tab for the build step, please?

You could try to increase a build step memory to solve the memory limit issue, please, check this good answer.

Also, you could follow the guide with details on how memory is allocated in Pipelines Databases and service containers documentation.

Best regards,
Oleksandr Kyrdan

Paul S

There is no Metrics tab

I've already tried bumping memory up, although I haven't configured the docker service 'per step' atm

Paul S

So tried some more options:

options:
services:
docker:
memory: 40960
clone:
depth: full
caches:
    - docker
    - node

- step: &bb-audit
    name: Dependency Scanner
services:
      - docker
size: 8x
caches:
      - docker
      - node
script:
      - npm install --legacy-peer-deps
      - pipe: atlassian/bitbucket-dependency-scanner:0.1.2
variables:
NVD_API_KEY: $NVDAPIKEY
EXTRA_ARGS:
            - "--format=HTML"
            - "--nvdApiDelay=20000"
            - "--nvdMaxRetryCount=10"
    artifacts:
      - dependency-check-report-*.log
      - dependency-check-report.json
      - dependency-check-report.html

Now it timed out after 2 hours!

Oleksandr Kyrdan

Hi @Paul S

Thanks for sharing this.

Looks like the issue on the NVD API side.
Dependency checker tries to update NVD databases before the scanner execution.

We are investigating this unexpected behaviour and will try to find a solution to prevent this.

Best regards,
Oleksandr Kyrdan

Oleksandr Kyrdan

Hi @Paul S

Happy to know that the issue was solved.

The new version of the pipe is released:

- pipe: atlassian/bitbucket-dependency-scanner:0.2.0
variables:
NVD_API_KEY: $NVD_API_KEY
UPDATE_NVD_CACHE: 'true'

Best regards,
Oleksandr Kyrdan

Welcome!

It looks like you're new here. Sign in or register to get started.

Quick Links

Find more posts tagged with

cloud

bitbucket

bitbucket-cloud

bitbucket-pipelines

vulnerability

cve

owasp

pipes