Dependencycheck: Download 403 error?

[djravine]

As of last night we start getting Jenkins pipeline failures.
Is there a problem with the download for dependency check?

403 Error: https://dl.bintray.com/jeremy-long/owasp/dependency-check-6.0.1-release.zip

We also changed the version incase it was an error just with that version, and that didn't work either. 😢

java.io.IOException: Server returned HTTP response code: 403 for URL: https://dl.bintray.com/jeremy-long/owasp/dependency-check-6.0.1-release.zip
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1900)
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1498)
    at sun.net.www.protocol.http.HttpURLConnection.getHeaderField(HttpURLConnection.java:3061)
    at java.net.URLConnection.getHeaderFieldLong(URLConnection.java:629)
    at java.net.URLConnection.getContentLengthLong(URLConnection.java:501)
    at java.net.URLConnection.getContentLength(URLConnection.java:485)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getContentLength(HttpsURLConnectionImpl.java:412)
    at org.jvnet.robust_http_client.RetryableHttpStream.<init>(RetryableHttpStream.java:90)
Caused: java.io.IOException: Server returned HTTP response code: 403 for URL: https://dl.bintray.com/jeremy-long/owasp/dependency-check-6.0.1-release.zip
    at sun.reflect.GeneratedConstructorAccessor588.newInstance(Unknown Source)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
    at sun.net.www.protocol.http.HttpURLConnection$10.run(HttpURLConnection.java:1950)
    at sun.net.www.protocol.http.HttpURLConnection$10.run(HttpURLConnection.java:1945)
    at java.security.AccessController.doPrivileged(Native Method)
    at sun.net.www.protocol.http.HttpURLConnection.getChainedException(HttpURLConnection.java:1944)
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1514)
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1498)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:268)
    at org.jvnet.robust_http_client.RetryableHttpStream.getStream(RetryableHttpStream.java:98)
    at org.jvnet.robust_http_client.RetryableHttpStream.<init>(RetryableHttpStream.java:91)
    at org.jvnet.robust_http_client.RetryableHttpStream.<init>(RetryableHttpStream.java:74)
    at hudson.ProxyConfiguration.getInputStream(ProxyConfiguration.java:330)
    at hudson.FilePath.installIfNecessaryFrom(FilePath.java:924)

[djravine]

Looks like this due to moving of the release archives which has not been update in the Jenkins Plugin.

LINK: https://github.com/jeremylong/DependencyCheck/releases/tag/v6.0.2

The project is migrating from hosting the release archives on Bin tray and moving them to Github under the assets for each release
Please update any automation you have to point to the new location.

[Reamer]

Is there a place where we can find old releases?

[jeremylong]

Bintray has the older version - however, because of the rate limit you will have to wait until after the first of the month.

[junpuf]

I had the same issue using the dependency-check pip package.

$ dependency-check
Downloading 'https://bintray.com/artifact/download/jeremy-long/owasp/dependency-check-5.2.4-release.zip'...
...
...
urllib.error.HTTPError: HTTP Error 403: Forbidden

[VolhaRS]

I have the same issues, try to get dependency-check-6.0.2-release.zip:

A few days ago this version was downloaded without problems.

[Reamer]

@VolhaRS for release 6.0.2 you can use the GitHub releases https://github.com/jeremylong/DependencyCheck/releases

[jeremylong]

5.3.2 and 6.x are now both available via the github release. Additionally, the rate limiting on bintray has been lifted (for now).