A valid very large SBOM not processing vulnerabilities with postgres and apiserver errors

[nigellh]

Hi

Apologies I cannot share the SBOM with you, but I am trying to track down what is causing the following errors.

The SBOM as 12k+ components and is validated and loads. After some time there are no vulnerabilities listed. I look at the logs and I have the following:

postgresql first

postgres-1   | 2025-01-06 16:23:07.331 UTC [124384] ERROR:  null value in column "NAME" of relation "COMPONENT" violates not-null constraint
postgres-1   | 2025-01-06 16:23:07.331 UTC [124384] DETAIL:  Failing row contains (99520, null, null, null, null, null, LIBRARY, null, null, null, null, null, null, null, null, f, null, NOASSERTION, null, null, null, null, null, null, 50, null, null, null, null, null, null, null, null, null, null, null, {"name":"debian"}, null, 2d0a0f78-ee99-41e5-9f74-2fd262ae82a6, null).
postgres-1   | 2025-01-06 16:23:07.331 UTC [124384] STATEMENT:  INSERT INTO "COMPONENT" ("AUTHOR","BLAKE2B_256","BLAKE2B_384","BLAKE2B_512","BLAKE3","CLASSIFIER","COPYRIGHT","CPE","DESCRIPTION","DIRECT_DEPENDENCIES","EXTENSION","EXTERNAL_REFERENCES","FILENAME","GROUP","INTERNAL","LAST_RISKSCORE","LICENSE","LICENSE_EXPRESSION","LICENSE_URL","MD5","NAME","TEXT","PARENT_COMPONENT_ID","PROJECT_ID","PUBLISHER","PURL","PURLCOORDINATES","LICENSE_ID","SHA1","SHA_256","SHA_384","SHA3_256","SHA3_384","SHA3_512","SHA_512","SUPPLIER","SWIDTAGID","UUID","VERSION") VALUES ($1,$2,$3,$4,$5,$6,$7,$8,$9,$10,$11,$12,$13,$14,$15,$16,$17,$18,$19,$20,$21,$22,$23,$24,$25,$26,$27,$28,$29,$30,$31,$32,$33,$34,$35,$36,$37,$38,$39)
postgres-1   |  RETURNING "ID"
postgres-1   | 2025-01-06 16:23:07.337 UTC [124384] ERROR:  current transaction is aborted, commands ignored until end of transaction block
postgres-1   | 2025-01-06 16:23:07.337 UTC [124384] STATEMENT:  SELECT 1 FROM "PROJECT" "A0" WHERE "A0"."ID" = $1

This then feeds into the apiserver:

apiserver-1  | 2025-01-06 16:14:48,239 INFO [ProjectResource] Project Astra_SaaS created by nhopper
apiserver-1  | 2025-01-06 16:17:55,232 INFO [BomUploadProcessingTask] Processing CycloneDX BOM uploaded to project: 442d9950-a9fc-47f7-9149-e8d27f14816b
apiserver-1  | 2025-01-06 16:19:00,573 WARN [ModelConverter] Unable to parse PackageURL: pkg:deb/debian/@
apiserver-1  | 2025-01-06 16:23:07,333 ERROR [Persist] Insert of object "org.dependencytrack.model.Component@25d90c0b" using statement "INSERT INTO "COMPONENT" ("AUTHOR","BLAKE2B_256","BLAKE2B_384","BLAKE2B_512","BLAKE3","CLASSIFIER","COPYRIGHT","CPE","DESCRIPTION","DIRECT_DEPENDENCIES","EXTENSION","EXTERNAL_REFERENCES","FILENAME","GROUP","INTERNAL","LAST_RISKSCORE","LICENSE","LICENSE_EXPRESSION","LICENSE_URL","MD5","NAME","TEXT","PARENT_COMPONENT_ID","PROJECT_ID","PUBLISHER","PURL","PURLCOORDINATES","LICENSE_ID","SHA1","SHA_256","SHA_384","SHA3_256","SHA3_384","SHA3_512","SHA_512","SUPPLIER","SWIDTAGID","UUID","VERSION") VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)" failed : ERROR: null value in column "NAME" of relation "COMPONENT" violates not-null constraint
apiserver-1  |   Detail: Failing row contains (99520, null, null, null, null, null, LIBRARY, null, null, null, null, null, null, null, null, f, null, NOASSERTION, null, null, null, null, null, null, 50, null, null, null, null, null, null, null, null, null, null, null, {"name":"debian"}, null, 2d0a0f78-ee99-41e5-9f74-2fd262ae82a6, null).
apiserver-1  | 2025-01-06 16:23:07,336 ERROR [BomUploadProcessingTask] Error while processing bom
apiserver-1  | javax.jdo.JDODataStoreException: Insert of object "org.dependencytrack.model.Component@25d90c0b" using statement "INSERT INTO "COMPONENT" ("AUTHOR","BLAKE2B_256","BLAKE2B_384","BLAKE2B_512","BLAKE3","CLASSIFIER","COPYRIGHT","CPE","DESCRIPTION","DIRECT_DEPENDENCIES","EXTENSION","EXTERNAL_REFERENCES","FILENAME","GROUP","INTERNAL","LAST_RISKSCORE","LICENSE","LICENSE_EXPRESSION","LICENSE_URL","MD5","NAME","TEXT","PARENT_COMPONENT_ID","PROJECT_ID","PUBLISHER","PURL","PURLCOORDINATES","LICENSE_ID","SHA1","SHA_256","SHA_384","SHA3_256","SHA3_384","SHA3_512","SHA_512","SUPPLIER","SWIDTAGID","UUID","VERSION") VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)" failed : ERROR: null value in column "NAME" of relation "COMPONENT" violates not-null constraint
apiserver-1  |   Detail: Failing row contains (99520, null, null, null, null, null, LIBRARY, null, null, null, null, null, null, null, null, f, null, NOASSERTION, null, null, null, null, null, null, 50, null, null, null, null, null, null, null, null, null, null, null, {"name":"debian"}, null, 2d0a0f78-ee99-41e5-9f74-2fd262ae82a6, null).
apiserver-1  |  at org.datanucleus.api.jdo.JDOAdapter.getJDOExceptionForNucleusException(JDOAdapter.java:605)
apiserver-1  |  at org.datanucleus.api.jdo.JDOPersistenceManager.jdoMakePersistent(JDOPersistenceManager.java:702)
apiserver-1  |  at org.datanucleus.api.jdo.JDOPersistenceManager.makePersistent(JDOPersistenceManager.java:722)
apiserver-1  |  at alpine.persistence.AbstractAlpineQueryManager.persist(AbstractAlpineQueryManager.java:427)
apiserver-1  |  at org.dependencytrack.persistence.ComponentQueryManager.createComponent(ComponentQueryManager.java:348)
apiserver-1  |  at org.dependencytrack.persistence.QueryManager.createComponent(QueryManager.java:565)
apiserver-1  |  at org.dependencytrack.tasks.BomUploadProcessingTask.processComponent(BomUploadProcessingTask.java:252)
apiserver-1  |  at org.dependencytrack.tasks.BomUploadProcessingTask.inform(BomUploadProcessingTask.java:178)
apiserver-1  |  at org.dependencytrack.tasks.BomUploadProcessingTaskV2.inform(BomUploadProcessingTaskV2.java:151)
apiserver-1  |  at alpine.event.framework.BaseEventService.lambda$publish$0(BaseEventService.java:110)
apiserver-1  |  at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
apiserver-1  |  at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
apiserver-1  |  at java.base/java.lang.Thread.run(Unknown Source)
apiserver-1  | Caused by: org.postgresql.util.PSQLException: ERROR: null value in column "NAME" of relation "COMPONENT" violates not-null constraint
apiserver-1  |   Detail: Failing row contains (99520, null, null, null, null, null, LIBRARY, null, null, null, null, null, null, null, null, f, null, NOASSERTION, null, null, null, null, null, null, 50, null, null, null, null, null, null, null, null, null, null, null, {"name":"debian"}, null, 2d0a0f78-ee99-41e5-9f74-2fd262ae82a6, null).
apiserver-1  |  at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:2725)
apiserver-1  |  at org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExecutorImpl.java:2412)
apiserver-1  |  at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:371)
apiserver-1  |  at org.postgresql.jdbc.PgStatement.executeInternal(PgStatement.java:502)
apiserver-1  |  at org.postgresql.jdbc.PgStatement.execute(PgStatement.java:419)
apiserver-1  |  at org.postgresql.jdbc.PgPreparedStatement.executeWithFlags(PgPreparedStatement.java:194)
apiserver-1  |  at org.postgresql.jdbc.PgPreparedStatement.executeUpdate(PgPreparedStatement.java:155)
apiserver-1  |  at com.zaxxer.hikari.pool.ProxyPreparedStatement.executeUpdate(ProxyPreparedStatement.java:61)
apiserver-1  |  at com.zaxxer.hikari.pool.HikariProxyPreparedStatement.executeUpdate(HikariProxyPreparedStatement.java)
apiserver-1  |  at org.datanucleus.store.rdbms.SQLController.doExecuteStatementUpdate(SQLController.java:463)
apiserver-1  |  at org.datanucleus.store.rdbms.SQLController.executeStatementUpdateDeferRowCountCheckForBatching(SQLController.java:413)
apiserver-1  |  at org.datanucleus.store.rdbms.request.InsertRequest.execute(InsertRequest.java:532)
apiserver-1  |  at org.datanucleus.store.rdbms.RDBMSPersistenceHandler.insertObjectInTable(RDBMSPersistenceHandler.java:235)
apiserver-1  |  at org.datanucleus.store.rdbms.RDBMSPersistenceHandler.insertObject(RDBMSPersistenceHandler.java:211)
apiserver-1  |  at org.datanucleus.state.StateManagerImpl.internalMakePersistent(StateManagerImpl.java:4614)
apiserver-1  |  at org.datanucleus.state.StateManagerImpl.makePersistent(StateManagerImpl.java:4591)
apiserver-1  |  at org.datanucleus.ExecutionContextImpl.persistObjectInternal(ExecutionContextImpl.java:2076)
apiserver-1  |  at org.datanucleus.ExecutionContext.persistObjectInternal(ExecutionContext.java:320)
apiserver-1  |  at org.datanucleus.ExecutionContextImpl.persistObjectWork(ExecutionContextImpl.java:1924)
apiserver-1  |  at org.datanucleus.ExecutionContextImpl.persistObject(ExecutionContextImpl.java:1785)
apiserver-1  |  at org.datanucleus.api.jdo.JDOPersistenceManager.jdoMakePersistent(JDOPersistenceManager.java:697)
apiserver-1  |  ... 11 common frames omitted
apiserver-1  | 2025-01-06 16:23:07,338 WARN [Retrieve] Search for object with id "org.dependencytrack.model.Project:50" using statement "SELECT 1 FROM "PROJECT" "A0" WHERE "A0"."ID" = ?" failed : ERROR: current transaction is aborted, commands ignored until end of transaction block
apiserver-1  | 2025-01-06 16:23:07,338 WARN [General] ExecutionContext closed with active transaction, so rolling back the active transaction
apiserver-1  | 2025-01-06 16:23:07,387 ERROR [LoggableUncaughtExceptionHandler] An unknown error occurred in an asynchronous event or notification thread
apiserver-1  | javax.jdo.JDODataStoreException: Search for object with id "org.dependencytrack.model.Project:50" using statement "SELECT 1 FROM "PROJECT" "A0" WHERE "A0"."ID" = ?" failed : ERROR: current transaction is aborted, commands ignored until end of transaction block
apiserver-1  |  at org.datanucleus.api.jdo.JDOAdapter.getJDOExceptionForNucleusException(JDOAdapter.java:605)
apiserver-1  |  at org.datanucleus.api.jdo.JDOPersistenceManager.getObjectById(JDOPersistenceManager.java:1726)
apiserver-1  |  at alpine.persistence.AbstractAlpineQueryManager.detach(AbstractAlpineQueryManager.java:498)
apiserver-1  |  at org.dependencytrack.tasks.BomUploadProcessingTask.inform(BomUploadProcessingTask.java:230)
apiserver-1  |  at org.dependencytrack.tasks.BomUploadProcessingTaskV2.inform(BomUploadProcessingTaskV2.java:151)
apiserver-1  |  at alpine.event.framework.BaseEventService.lambda$publish$0(BaseEventService.java:110)
apiserver-1  |  at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
apiserver-1  |  at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
apiserver-1  |  at java.base/java.lang.Thread.run(Unknown Source)
apiserver-1  | Caused by: org.postgresql.util.PSQLException: ERROR: current transaction is aborted, commands ignored until end of transaction block
apiserver-1  |  at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:2725)
apiserver-1  |  at org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExecutorImpl.java:2412)
apiserver-1  |  at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:371)
apiserver-1  |  at org.postgresql.jdbc.PgStatement.executeInternal(PgStatement.java:502)
apiserver-1  |  at org.postgresql.jdbc.PgStatement.execute(PgStatement.java:419)
apiserver-1  |  at org.postgresql.jdbc.PgPreparedStatement.executeWithFlags(PgPreparedStatement.java:194)
apiserver-1  |  at org.postgresql.jdbc.PgPreparedStatement.executeQuery(PgPreparedStatement.java:137)
apiserver-1  |  at com.zaxxer.hikari.pool.ProxyPreparedStatement.executeQuery(ProxyPreparedStatement.java:52)
apiserver-1  |  at com.zaxxer.hikari.pool.HikariProxyPreparedStatement.executeQuery(HikariProxyPreparedStatement.java)
apiserver-1  |  at org.datanucleus.store.rdbms.SQLController.executeStatementQuery(SQLController.java:584)
apiserver-1  |  at org.datanucleus.store.rdbms.request.LocateRequest.execute(LocateRequest.java:290)
apiserver-1  |  at org.datanucleus.store.rdbms.RDBMSPersistenceHandler.locateObject(RDBMSPersistenceHandler.java:747)
apiserver-1  |  at org.datanucleus.state.StateManagerImpl.locate(StateManagerImpl.java:1302)
apiserver-1  |  at org.datanucleus.state.StateManagerImpl.validate(StateManagerImpl.java:5613)
apiserver-1  |  at org.datanucleus.ExecutionContextImpl.findObject(ExecutionContextImpl.java:3538)
apiserver-1  |  at org.datanucleus.ExecutionContextImpl.findObject(ExecutionContextImpl.java:2999)
apiserver-1  |  at org.datanucleus.api.jdo.JDOPersistenceManager.getObjectById(JDOPersistenceManager.java:1721)
apiserver-1  |  ... 7 common frames omitted
apiserver-1  | Caused by: org.postgresql.util.PSQLException: ERROR: null value in column "NAME" of relation "COMPONENT" violates not-null constraint
apiserver-1  |   Detail: Failing row contains (99520, null, null, null, null, null, LIBRARY, null, null, null, null, null, null, null, null, f, null, NOASSERTION, null, null, null, null, null, null, 50, null, null, null, null, null, null, null, null, null, null, null, {"name":"debian"}, null, 2d0a0f78-ee99-41e5-9f74-2fd262ae82a6, null).
apiserver-1  |  at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:2725)
apiserver-1  |  at org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExecutorImpl.java:2412)
apiserver-1  |  at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:371)
apiserver-1  |  at org.postgresql.jdbc.PgStatement.executeInternal(PgStatement.java:502)
apiserver-1  |  at org.postgresql.jdbc.PgStatement.execute(PgStatement.java:419)
apiserver-1  |  at org.postgresql.jdbc.PgPreparedStatement.executeWithFlags(PgPreparedStatement.java:194)
apiserver-1  |  at org.postgresql.jdbc.PgPreparedStatement.executeUpdate(PgPreparedStatement.java:155)
apiserver-1  |  at com.zaxxer.hikari.pool.ProxyPreparedStatement.executeUpdate(ProxyPreparedStatement.java:61)
apiserver-1  |  at com.zaxxer.hikari.pool.HikariProxyPreparedStatement.executeUpdate(HikariProxyPreparedStatement.java)
apiserver-1  |  at org.datanucleus.store.rdbms.SQLController.doExecuteStatementUpdate(SQLController.java:463)
apiserver-1  |  at org.datanucleus.store.rdbms.SQLController.executeStatementUpdateDeferRowCountCheckForBatching(SQLController.java:413)
apiserver-1  |  at org.datanucleus.store.rdbms.request.InsertRequest.execute(InsertRequest.java:532)
apiserver-1  |  at org.datanucleus.store.rdbms.RDBMSPersistenceHandler.insertObjectInTable(RDBMSPersistenceHandler.java:235)
apiserver-1  |  at org.datanucleus.store.rdbms.RDBMSPersistenceHandler.insertObject(RDBMSPersistenceHandler.java:211)
apiserver-1  |  at org.datanucleus.state.StateManagerImpl.internalMakePersistent(StateManagerImpl.java:4614)
apiserver-1  |  at org.datanucleus.state.StateManagerImpl.makePersistent(StateManagerImpl.java:4591)
apiserver-1  |  at org.datanucleus.ExecutionContextImpl.persistObjectInternal(ExecutionContextImpl.java:2076)
apiserver-1  |  at org.datanucleus.ExecutionContext.persistObjectInternal(ExecutionContext.java:320)
apiserver-1  |  at org.datanucleus.ExecutionContextImpl.persistObjectWork(ExecutionContextImpl.java:1924)
apiserver-1  |  at org.datanucleus.ExecutionContextImpl.persistObject(ExecutionContextImpl.java:1785)
apiserver-1  |  at org.datanucleus.api.jdo.JDOPersistenceManager.jdoMakePersistent(JDOPersistenceManager.java:697)
apiserver-1  |  at org.datanucleus.api.jdo.JDOPersistenceManager.makePersistent(JDOPersistenceManager.java:722)
apiserver-1  |  at alpine.persistence.AbstractAlpineQueryManager.persist(AbstractAlpineQueryManager.java:427)
apiserver-1  |  at org.dependencytrack.persistence.ComponentQueryManager.createComponent(ComponentQueryManager.java:348)
apiserver-1  |  at org.dependencytrack.persistence.QueryManager.createComponent(QueryManager.java:565)
apiserver-1  |  at org.dependencytrack.tasks.BomUploadProcessingTask.processComponent(BomUploadProcessingTask.java:252)
apiserver-1  |  at org.dependencytrack.tasks.BomUploadProcessingTask.inform(BomUploadProcessingTask.java:178)
apiserver-1  |  ... 5 common frames omitted

At the moment I'm not sure I have enough information to narrow it down so any help gratefully received.

[nscuro]

Please try upgrading to v4.12 or later.

The two issues at play here are:

1. At least one of the components in your BOM has a blank name (i.e. "name": ""). Dependency-Track before v4.12 trimmed component names to null, but the database schema does not allow for NULL component names (null value in column "NAME" of relation "COMPONENT" violates not-null constraint). Since v4.12, we explicitly set such component names to -.
2. Due to the issue above, a database transaction failed to commit, but was not rolled back. All following persistence operations within the same context failed because there was still a transaction open that failed but not rolled back (current transaction is aborted, commands ignored until end of transaction block). Since v4.12, the entire import is a single database transaction, and that will be correctly rolled back in case of a failure.

[nscuro]

The schema validation passes because name being a required field is not sufficiently enforced by the schema: CycloneDX/specification#461

[nigellh]

Excuse my language, but darn it!!!! I thought that we had fixed this AND I had checked for it. Previously I know DT refused these entries on import. What is worse, I thought it was one of the things I checked for when I edited saw there were problems.

I even saw an error on processing the purl in the logs but thought it was related to another SBOM. Just to confirm this is what is in the SBOM

    {
      "type": "library",
      "bom-ref": "pkg:deb/debian/@",
      "supplier": {
        "name": "debian"
      },
      "name": "",
      "version": "",
      "licenses": [
        {
          "license": {
            "name": "NOASSERTION"
          }
        }
      ],
      "purl": "pkg:deb/debian/@",
      "properties": [
        {
          "name": "Relationship Completeness",
          "value": "Unknown"
        }
      ]
    },

Apologies for troubling you and it fixed it!