Mailing-List: contact builds-help@apache.org; run by ezmlm
Precedence: bulk
Reply-To: builds@apache.org
Subject: Re: OWAS Dependency Check
To: builds@apache.org
References: <CAMopvkPhHvTwTRMBh7A04P744dGo3Ek0Y2GSiguJJMYq77+3_A@mail.gmail.com>
 <861aaa00-934f-bddd-3334-7ce5e308ba47@t-online.de>
 <CAMopvkPjoFGeS80CSXvDvmrhPXQEmFC2rNcbpjzJkSAcZeTqvA@mail.gmail.com>
From: Tilman Hausherr <THausherr@t-online.de>
Message-ID: <31f3b282-4b01-28d4-9aa9-513ded82cebe@t-online.de>
Date: Wed, 18 Oct 2017 17:57:41 +0200
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.4.0
MIME-Version: 1.0
In-Reply-To: <CAMopvkPjoFGeS80CSXvDvmrhPXQEmFC2rNcbpjzJkSAcZeTqvA@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Content-Language: en-US
archived-at: Wed, 18 Oct 2017 15:57:50 -0000

Am 18.10.2017 um 15:32 schrieb Lukasz Lenart:
> 2017-10-13 17:46 GMT+02:00 Tilman Hausherr <THausherr@t-online.de>:
>> We use it for PDFBox in all builds as a maven plugin. The current version
>> 2.1.1 is over-sensitive compared to 2.1.0. The developer told me that this
>> will be fixed in 3.0.
> Do you fail a build when the plugin finds something?

Yes:

                     <plugin>
                         <groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
                         <version>2.1.0</version>
                         <configuration>
<failBuildOnAnyVulnerability>true</failBuildOnAnyVulnerability>
                         </configuration>
                         <executions>
                             <execution>
                                 <goals>
                                     <goal>check</goal>
                                 </goals>
                             </execution>
                         </executions>
                     </plugin>

Tilman