-
Notifications
You must be signed in to change notification settings - Fork 25
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Downloading installer tries to download a non existing tag #96
Comments
Not sure if anyone is still interested in this issue, but we've been encountering it for the last few days, but it has since gone away again - most frustrating! The code may have changed since the issue was originally created, as I can see that at the following line, if the version is set to its default, 'latest', then it uses a different URL to what is cited when this issue was created: azuredevops/src/Tasks/dependency-check-build-task/dependency-check-build-task.ts Line 284 in ec3d0e5
It is instead https://api.github.com/repos/jeremylong/DependencyCheck/releases/latest, which I've confirmed does indeed exist, and following the code through it should be able to successfully locate the asset with content-type == 'application/zip' :azuredevops/src/Tasks/dependency-check-build-task/dependency-check-build-task.ts Line 288 in ec3d0e5
It's hard to tell as there's not a lot of error handling, but you'd assume that the code is successfully retrieving something from that URL, it just can't locate the correct asset. Given it occurs sporadically, I did wonder also whether it may be hitting some kind of GitHub API rate limit, but then I'd probably expect a different error i.e. the HttpClient wouldn't receive a 200 OK back in that case, but given there's no code explicitly checking the HTTP status code of the response, I don't know if the HttpClient being used throws an error for a non-200 response, or whether this is actually something that should be being explicitly checked - or at least logged?
Anyway, a bit more information for if/when this occurs again in the future. |
Encountering this issue pretty frequently of late, I've done some more digging. It looks like the client used here doesn't throw for non-200 status codes:
Which tracks with what's coming back from the API when a non-existent version tag is requested: Rate limiting seems to make some amount of sense I think? Given the intermittent nature and the fact that it will work and then not work for the exact same pipeline for seemingly no reason. |
Does anyone of you still have this issue? If so I'll look into it - otherwise I'll close this issue. |
I'm getting intermittent failures with the dependency check extension from the Visual Studio Marketplace in the Azure DevOps pipeline. Here is the output: Starting: Run dependency security checks Task : OWASP Dependency Check Starting Dependency Check... |
Will take another look at this once we get the new pipeline for our build up and running. |
Today the downloader fails with the following error.
When analyzing the code it seems that it tries to download
https://api.github.com/repos/jeremylong/DependencyCheck/releases/tags/vlatest
but that tag "vlatest" doesn't exist.The text was updated successfully, but these errors were encountered: