No Matches found when running Report

[Curtis F]

Running with our Gradle builds, the Jenkins plugin reports all of the OSS jars as "unknown".   The log shows "No Matches Found".  What is the plugin matching against?  Is it a "group" problem?

[INFO] Dependency{ group: com.fngn.jars, artifact: commons-fileupload-1.3, version: 1.0}
 ** No Match Found
[INFO] Dependency{ group: com.fngn.jars, artifact: freemarker-2.3.19, version: 1.0}
 ** No Match Found

[INFO] Dependency{ group: com.fngn.jars, artifact: spring-tx-3.2.11.RELEASE, version: 1.0}
 ** No Match Found
[INFO] Dependency{ group: com.fngn.jars, artifact: salesforce-enterprise, version: 1.0}
 ** No Match Found
[INFO] Dependency{ group: com.fngn.jars, artifact: spring-core-3.2.11.RELEASE, version: 1.0}
 ** No Match Found

[Kaj Kandler]

Curtis,
these are unusual Group/Artifact/Version IDs. You are right to suspect we are not matching those because of the group. How come you resolve them as such?

For example the group for
* fileupload is commons-fileupload - http://mvnrepository.com/artifact/commons-fileupload/commons-fileupload/1.3
* freemarker is org.freemarker - http://mvnrepository.com/artifact/org.freemarker/freemarker/2.3.19
* spring-tx and spring-core is org.springframework - http://mvnrepository.com/artifact/org.springframework/spring-tx/3.2.11.RELEASE

Also odd is that the artifacts include some sort of version, i.e. 3.2.11-RELEASE, but the version is declared as 1.0 for all of them.

Could you share a snippet of your gradle dependency declaration? May be we interpret something oddly

Kaj

[Curtis F]

Does Black Duck use Fingerprint/Hashes to identify the jars?   

[Kaj Kandler]

Curtis,

This free plugin uses the Maven GAV as the ID for a jar. We do not touch the jars here, to be super efficient. Maven/Gradle tells us it resolves an artifact with particular GAV and we look it up in our knowledgebase.

Kind regards, 

Kaj

P.S.: Our commercial products con do more sophisticated identification of files and jar though, involving techniques similar to finger prints and hashes.

[Curtis F]

Thanks for the reply.  I am going to look at evaluating your Hub and Artifactory plugin options.