check_bom.py: Not reliable when printing SW360Error details

[rfuentess]

check_bom.py: Not reliable when printing SW360Error details

Summary

Python version: 3.11.2

At check_bom.py (_find_by_id()) If SW360Error is raised with error codes other than not_found they are not being displayed at the terminal.

Details

Seen while I was working without proper tokens and trying to figure what was happening.

At the class SW360Error(IOError) we have the following definition for its member Response:

self.response: Optional[Response] = response

and the relevant lines at _find_by_id() at _find_by_id() :

            except SW360Error as swex:
                if swex.response is None:
                    print_red("  Unknown error: " + swex.message)
                elif swex.response.status_code == requests.codes['not_found']:
                    print_yellow(
                        "  Not found " + component.name +
                        ", " + version + ", " + sw360id)
                    break

                # only report other errors if this is the third attempt
                if step >= 2:
                    print(Fore.LIGHTRED_EX + "  Error retrieving release data: ")
                    print(
                        "  " + component.name + ", " + version +
                        ", " + sw360id)
                    if swex.response:
                        print("  Status Code: " + str(swex.response.status_code))
                    if swex.message:
                        print("    Message: " + swex.message)
                    print(Style.RESET_ALL)

At least with python 3.11.2 we should be using if swex.response is not None: instead of if swex.response.

PoC

I did a dirty PoC for verifying it. But I admit that maybe I'm not populating properly the Response object.

from sw360 import SW360Error
from requests import Response

try:
    msg = ""
    r = Response()
    r.status_code = 401
    print(f"Test 1: Response: {r} - message: {msg}")
    raise SW360Error(r, message=msg)
except SW360Error as swex:
    if swex.response:
        print("  Status Code: " + str(swex.response.status_code))
    if swex.message:
            print("    Message: " + swex.message)

try:
    msg = "Pika! Pika!"
    r = Response()
    r.status_code = 401
    print(f"Test 2: Response: {r} - message: {msg}")
    raise SW360Error(r, message=msg)
except SW360Error as swex:
    if swex.response:
        print("  Status Code: " + str(swex.response.status_code))
    if swex.message:
            print("    Message: " + swex.message)

try:
    msg = "Pika! Pika!"
    r = Response()
    r.status_code = 401
    print(f"Test 3: Response: {r} - message: {msg} (AND `if not None`)")
    raise SW360Error(r, message=msg)
except SW360Error as swex:
    if swex.response is not None:
        print("  Status Code: " + str(swex.response.status_code))
    if swex.message:
        print("    Message: " + swex.message)


try:
    msg = ""
    r = None
    print(f"Test 4: Response: {r} - message: {msg} (original if)")
    raise SW360Error(r, message=msg)
except SW360Error as swex:
    if swex.response is not None:
        print("  Status Code: " + str(swex.response.status_code))
    if swex.message:
        print("    Message: " + swex.message)        

try:
    msg = ""
    r = None
    print(f"Test 5: Response: {r} - message: {msg} (AND `if not None`)")
    raise SW360Error(r, message=msg)
except SW360Error as swex:
    if swex.response is not None:
        print("  Status Code: " + str(swex.response.status_code))
    if swex.message:
        print("    Message: " + swex.message)        

Output:

Test 1: Response: <Response [401]> - message: 
Test 2: Response: <Response [401]> - message: Pika! Pika!
    Message: Pika! Pika!
Test 3: Response: <Response [401]> - message: Pika! Pika! (AND `if not None`)
  Status Code: 401
    Message: Pika! Pika!
Test 4: Response: None - message:  (original if)
Test 5: Response: None - message:  (AND `if not None`)

[tngraf]

Sorry, I don't get the problem:

1. If we get the release without error, there is no output ==> correct
2. The most common error is "not_found". This is displayed, the loop gets aborted and we return None ==> correct
3. If there is no swex.response, then either message="login_api needs to be called first" or
   message="No release id provided!" .. and this IS displayed
4. There can be some strange network error ... and these errors should only get displayed if this is the third attempt.

[rfuentess]

4. There can be some strange network error ... and these errors should only get displayed if this is the third attempt.

Sorry, memory is fuzzy after the holidays. I'm pretty sure I was under the fourth scenario. Mostly due credentials issues . I was getting the error but not message was being displayed.

The reason that the credentials issues hit at that point is that I was testing some ideas and I missed the call to login() 😅

[gernot-h]

@rfuentess, can you reproduce the issue? It sounds like this should be easy by just injecting wrong credentials?

[rfuentess]

@rfuentess, can you reproduce the issue? It sounds like this should be easy by just injecting wrong credentials?

Tested over commit 4e45bb1:

...
CaPyCli, 2.11.1 - Map a given SBOM to data on SW360

Loading SBOM file bom.filteredv2.mapped.cdx.bom.json
  Checking access to SW360...
  You are not authorized!

Relevant lines are:

• map_bom.py:

        print_text("  Checking access to SW360...")
        if not self.login(token=args.sw360_token, url=args.sw360_url, oauth2=args.oauth2):
            print_red("ERROR: login failed!")
            sys.exit(ResultCode.RESULT_AUTH_ERROR)

• And the relevant lines for self.login() :

        try:
            result = self.client.login_api(sw360_api_token)
        except SW360Error as swex:
            if (swex.response is not None) and (swex.response.status_code == requests.codes["unauthorized"]):
                print_red("  You are not authorized!")
                sys.exit(ResultCode.RESULT_AUTH_ERROR)
            else:
                print_red("  Error authorizing user: " + repr(swex))
                sys.exit(ResultCode.RESULT_AUTH_ERROR)

However, this one is already using swex.response is not None to confirm the status_code is valid.

PoC

I did a dirty check doing the following changes to the self.login():

        except SW360Error as swex:
            if swex.response:   # Breaking the if into two lines and removing `not None`
                if swex.response.status_code == requests.codes["unauthorized"]:
                    print_red("  You are not authorized!")
                else:
                    print_red("  You are not authorized! (Unknown code)")
                sys.exit(ResultCode.RESULT_AUTH_ERROR)
            else:
                print_red("  Error authorizing user: " + repr(swex))
                sys.exit(ResultCode.RESULT_AUTH_ERROR)

and this was the output:

...
CaPyCli, 2.11.1 - Map a given SBOM to data on SW360

Loading SBOM file sbom.filteredv2.mapped.cdx.bom.json
  Checking access to SW360...
  Error authorizing user: SW360Error('Unable to login')

[gernot-h]

I tried to reproduce your scenario (working without proper tokens) using latest main (https://github.com/sw360/capycli/tree/9aa3d28ef89abd45c97e0503e8ca62bf38a42eda/capycli) and don't see a problem:

> poetry run capycli bom check -i debian-bom.cdx.json -u https://sw360.siemens.com -oa -t "token_of_another_sw360_instance"

CaPyCli, 2.11.1 - Check that all releases in the SBOM exist on target SW360 instance.

Loading SBOM file /home/gernot/checkout/distro-clearing-debian/2026-07-27T06-59-40_bom-3-download.cdx.json
  Analyzing token...
  Token will expire on 2026-10-06 15:52:20
  You are not authorized!

[gernot-h]

I also looked into the multiple PoCs you provided, but I don't really get what you get and what you expect. Can you please provide one PoC, letting us know what happens and what you would expect?

[gernot-h]

Ah, I think I get it now. You say that due to the API of requests.Response our if swex.response doesn't do what it should:

from requests import Response
r = Response(); r.status_code = 401
if r:  # HTTP errors make a Response object to evaluate as False
    print("r is True")
else:
    print("r is False")  

So the code in our if swex.response: in

capycli/capycli/bom/check_bom.py

Line 69 in 9aa3d28

if swex.response:

will NOT be run if the API returns any HTTP error besides 404 (which is handled separately). However, the problem is usually not triggered by wrong tokens as those will already be catched by CheckBom.login.

[rfuentess]

@gernot-h ,

yes, exactly. That is why I was unable to provide a better PoC as the login creds are checked before.

[gernot-h]

I think the bug can be triggered only by either your token getting invalid while CaPyCli runs or if SW360 returns another error, e.g. 403 forbidden, which it usually doesn't do for releases as far as I know. Nevertheless, I agree it should be fixed, will create a PR as soon as I have time.