Skip to content

Fix check bom http error reporting - #237

Open
gernot-h wants to merge 3 commits into
mainfrom
fix-check_bom-HTTP-error-reporting
Open

Fix check bom http error reporting#237
gernot-h wants to merge 3 commits into
mainfrom
fix-check_bom-HTTP-error-reporting

Conversation

@gernot-h

Copy link
Copy Markdown
Collaborator

As reported by @rfuentess in #227, the current HTTP response evaluation in "bom check" was wrong leading to incomplete error output on e.g. HTTP 403:

Loading SBOM file /home/gernot/checkout/capycli/tests/fixtures/sbom_with_sw360.json
  4 components  read from SBOM
  Not found colorama, 0.4.6, 9a2373710bd44769a2560dd31280901d
  Error retrieving release data: 
  python, 3.8, 05c30bf89a512463260b57e84d99b38f

This PR fixes it as suggested by Raul so errors are printed as intended:

Loading SBOM file /home/gernot/checkout/capycli/tests/fixtures/sbom_with_sw360.json
  4 components  read from SBOM
  Not found colorama, 0.4.6, 9a2373710bd44769a2560dd31280901d
  Error retrieving release data: 
  python, 3.8, 05c30bf89a512463260b57e84d99b38f
  Status Code: 403

While SW360 usually doesn't answer with HTTP 403 (to my knowledge), we should still be prepared for it - and the fix will also help reporting a HTTP token which gets invalid while CaPyCli runs (resulting in HTTP 401) which is probably what Raul observed.

The initial tests used HTTP 500 errors which would lead to multiple
urllib3 retries and long timeouts, so use 403 (forbidden) instead. Also
fix some responses so we don't run into unrelated errors and remove two
unneeded responses.
@gernot-h
gernot-h marked this pull request as draft July 29, 2026 10:33
The current code tries to assure HTTP response objects are valid before
trying to print them, but due to the HTTP requests API, error responses
are considered False so they were not printed.

Thanks to Raul Fuentes for reporting.

Fixes #227
@gernot-h
gernot-h force-pushed the fix-check_bom-HTTP-error-reporting branch from 0a9ea0b to e36d96e Compare July 29, 2026 10:36
Same as in 543bd2d, requests.Response objects are considered "False"
for HTTP errors, so we must not check for True. And there's no need for
the other else paths as the first "if" already tells us that we have
swex.response so there can't be another error case.
@gernot-h
gernot-h force-pushed the fix-check_bom-HTTP-error-reporting branch from e36d96e to f08d637 Compare July 29, 2026 10:45
@gernot-h
gernot-h marked this pull request as ready for review July 29, 2026 10:45
@gernot-h

Copy link
Copy Markdown
Collaborator Author

Claude Opus identified a comparable problem in create_project.py which should now also be fixed.

if swex.response:
print_red(" " + str(swex.response.status_code) + ": " + swex.response.text)
sys.exit(ResultCode.RESULT_ERROR_ACCESSING_SW360)
if swex.details:

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why has this code been removed?
response.text is one possible problem description.
SW360s real description is in swex.details["error"] and swex.details["message"]

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the current control flow from https://github.com/sw360/capycli/blob/v2.11.1/capycli/project/create_project.py#L139:

            if swex.response is None:  # 1
                ...
                sys.exit(...)
            if swex.response.status_code == requests.codes["unauthorized"]:  # 2
                ...
                sys.exit(...)
            if swex.response.status_code == requests.codes["forbidden"]:  # 3
                ...
                sys.exit(...)
            if swex.response:  # 4
                ...
                sys.exit(...)
            if swex.details:  # 5
                ...
                sys.exit(...)

            print_red("  Unknown error ...)  # 6
            sys.exit(...)

Now as in the other error described by Raul, # 4 will never be triggered as .response will evaluate to False for any HTTP error. So we would need to replace # 4 by if swex.response is not None which is what I did first. But then# 4 is the exact opposite of # 1, so mypy shouted at me that neither # 5 nor # 6 are reachable.

Or in other words: # 1 is already the "general error" part which is called when we have no valid .response, so we don't need # 6.

And looking into https://github.com/sw360/sw360python/blob/master/sw360/sw360error.py, swex.details is only populated when we have a valid .response, so # 4 will already cover that case, so we also don't need # 5.

Or do I overlook something?

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The patch is also somewhat confusing, but what I actually did was removing # 5 and # 6 and making the code from # 4 the fall-back if other if's don't mach.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants