Bom scan does not generate a report

post by Fabio_Victorian on Feb 26

Description:

We have a centralized CI pipeline (Azure DevOps) setup that runs across our solutions. As part of the CI process, we perform a Sonatype scan using the NexusIqPipelineTask. The task uses, on the scanTargets property, the path for the SBOM file that is produced earlier during the process.

Problem:

• The SBOM file is successfully generated and contains the expected dependency information.
• However, the NexusIqPipelineTask step generates an empty report and no components are identified.

Observed Behavior:

• SBOM file exists and appears correct (we can see the expected dependencies).
• NexusIQ report is empty; no components or vulnerabilities are identified.

post by fcoene on Mar 11

Afaik, this is not supported via the nexus-iq-cli yet, you need to call the API directly:

https://help.sonatype.com/en/third-party-scan-rest-api.html

post by jzora on Mar 11

Hi, Fabio!

Since you have Lifecycle, you’re a Sonatype customer, which means you’re entitled to support from our Support team. An empty report is definitely something they can help you with; if you haven’t resolved the issue yet, I’d suggest opening a support ticket.

post by Fabio_Victorian on Mar 11

Thanks both, this has since been solved by using the latest version of the nexus task.