Started by upstream project "build-scripts/jobs/jdk17u/jdk17u-linux-arm-temurin" build number 412 originally caused by: Started by upstream project "build-scripts/openjdk17-pipeline" build number 1013 originally caused by: Started by user Adam Farley Running as SYSTEM Building remotely on jenkins-hetzner-worker (jsfsignX git-hg gpgsign worker master) in workspace /home/jenkins/workspace/sbom_validator_job [WS-CLEANUP] Deleting project workspace... [WS-CLEANUP] Deferred wipeout is used... The recommended git tool is: git No credentials specified Cloning the remote Git repository Cloning repository https://github.com/adoptium/temurin-build > git init /home/jenkins/workspace/sbom_validator_job/temurin-build # timeout=10 Fetching upstream changes from https://github.com/adoptium/temurin-build > git --version # timeout=10 > git --version # 'git version 2.43.0' > git fetch --tags --force --progress -- https://github.com/adoptium/temurin-build +refs/heads/*:refs/remotes/origin/* # timeout=10 > git config remote.origin.url https://github.com/adoptium/temurin-build # timeout=10 > git config --add remote.origin.fetch +refs/heads/*:refs/remotes/origin/* # timeout=10 Avoid second fetch > git rev-parse refs/remotes/origin/master^{commit} # timeout=10 Checking out Revision 9ca299c1548b68e0513feeb87b0a8bebf672fc5c (refs/remotes/origin/master) > git config core.sparsecheckout # timeout=10 > git checkout -f 9ca299c1548b68e0513feeb87b0a8bebf672fc5c # timeout=10 Commit message: "Skip generating checksum files for SBOM artifacts in Solaris build (#4334)" > git rev-list --no-walk 9ca299c1548b68e0513feeb87b0a8bebf672fc5c # timeout=10 Copied 2 artifacts from "build-scripts » jobs » jdk17u » jdk17u-linux-arm-temurin" build number 412 [sbom_validator_job] $ /bin/sh -xe /tmp/jenkins6864812208057450442.sh + ls /home/jenkins/workspace/sbom_validator_job/sboms OpenJDK17U-sbom_arm_linux_hotspot_2026-01-08-15-19.json OpenJDK17U-sbom_arm_linux_hotspot_2026-01-08-15-19-metadata.json + ls -1 /home/jenkins/workspace/sbom_validator_job/sboms/OpenJDK17U-sbom_arm_linux_hotspot_2026-01-08-15-19-metadata.json /home/jenkins/workspace/sbom_validator_job/sboms/OpenJDK17U-sbom_arm_linux_hotspot_2026-01-08-15-19.json + grep -v metadata + sh /home/jenkins/workspace/sbom_validator_job/temurin-build/tooling/validateSBOM.sh 17 /home/jenkins/workspace/sbom_validator_job/sboms/OpenJDK17U-sbom_arm_linux_hotspot_2026-01-08-15-19.json validateSBOM.sh: Setting up workspace directory /home/jenkins/workspace/sbom_validator_job/sbom_validation WARNING: validateSBOM.sh: SOURCE_TAG does not use a valid upstream tag structure. INFO: validateSBOM.sh: Build is presumed to be a personal or dev build. INFO: validateSBOM.sh: SCM and SHA checks will be skipped. validateSBOM.sh: Downloading CycloneDX CLI binary ... validateSBOM.sh: Downloaded CycloneDX CLI binary to 'cyclonedx-linux-x64' validateSBOM.sh: SBOM validation start. validateSBOM.sh: Running general SBOM validation from https://github.com/CycloneDX/cyclonedx-cli validateSBOM.sh: Running cyclonedx-linux-x64 ... Command: "/home/jenkins/workspace/sbom_validator_job/sbom_validation/cyclonedx-linux-x64" validate --input-file "/home/jenkins/workspace/sbom_validator_job/sboms/OpenJDK17U-sbom_arm_linux_hotspot_2026-01-08-15-19.json" --input-format json BOM validated successfully. validateSBOM.sh: Passed CycloneDX validation check. validateSBOM.sh: Running command: sh validateSBOMcontent.sh "/home/jenkins/workspace/sbom_validator_job/sboms/OpenJDK17U-sbom_arm_linux_hotspot_2026-01-08-15-19.json" "17" "" /home/jenkins/workspace/sbom_validator_job/sboms/OpenJDK17U-sbom_arm_linux_hotspot_2026-01-08-15-19.json /home/jenkins/workspace/sbom_validator_job/sboms/OpenJDK17U-sbom_arm_linux_hotspot_2026-01-08-15-19.json BOOTJDK is 17.0.17+10 NOTE: ALSA version not 1.1.8 (SBOM has 1.1.6) - ignoring because ALSA version is determined by devkit now FREETYPE is 2.13.3 Checking for JDK source SHA validity... WARNING: curl check failed to validate the sha against this URL: https://github.com/adoptium/jdk17u/commit/fbc65347f141032cd37ba699f6659299ffc262bc Double-checking against the github api. SBOM SHA is a valid repository commit: https://api.github.com/repos/adoptium/jdk17u/commits/fbc65347f141032cd37ba699f6659299ffc262bc The SCM_REF argument was set to an empty string; skipping SHA check. validateSBOMcontent.sh: PASSED SBOM validation complete. validateSBOM.sh: SBOM validation complete. [WS-CLEANUP] Deleting project workspace... [WS-CLEANUP] Deferred wipeout is used... [WS-CLEANUP] done Finished: SUCCESS