Skip to main content

Troubleshooting

This page helps you resolve common issues related to GitHub integration, dependency and Software Bill of Materials (SBOM) generation, and data synchronization in DigiCert​​®​​ Software Trust Manager.

If you encounter an error, find it in this document to understand what caused it and how to resolve it.

Integration and authorization issues

These errors occur during installation, setup, or authorization of the Software Trust Manager GitHub app.

Request timed out

Error

Request timed out
Your request took too long to complete.

Cause

The request to GitHub or Software Trust Manager didn’t finish within the expected time. Common causes:

  • Temporary network connectivity issues

  • A slow or interrupted connection to GitHub

  • A slow or interrupted connection to GitHub

Solution

  1. Refresh the page when your connection is stable.

  2. Retry the GitHub integration flow.

  3. If the issue persists:

    1. Try your unique onboarding link, or

    2. Contact your administrator or DigiCert Support if the problem continues.

Service not supported

Error

Service not supported
This integration is limited to GitHub Organization accounts.

GitHub Enterprise and personal GitHub accounts are not supported.

Cause

The Software Trust Manager GitHub app is restricted to GitHub Organization accounts. The error appears if you attempt to integrate:

  • A personal GitHub account, or

  • A GitHub Enterprise account that isn’t configured as a supported organization

Solution

  • Confirm that you’re signing in with a GitHub Organization account.

  • Switch to an organization that owns the repositories you want to integrate.

  • If you believe your organization should be supported, contact your administrator or DigiCert Support.

Insufficient permissions

Error

Insufficient permissions
You do not have permission to install GitHub apps for this organization.

Cause

Your GitHub user account doesn’t have permission to install or authorize GitHub apps for the selected organization. This typically means you aren’t an organization owner or have insufficient admin privileges.

Solution

  1. Contact your GitHub organization administrator.

  2. Ask them to either:

    1. Grant you permission to install GitHub apps, or

    2. Install the DigiCert Software Trust Manager GitHub app on your behalf.

  3. After permissions are updated or the app is installed, restart the integration flow.

Page not found (404)

Error

404
Page not found

Cause

The page you attempted to access is no longer available or the URL is invalid.

This can occur if:

  • The integration session expired

  • A bookmarked or copied URL is outdated

  • The onboarding flow was interrupted

Solution

  1. Try your unique onboarding link.

  2. If the issue persists, return to a known page in Software Trust Manager.

  3. Restart the GitHub integration from the Release security tab or Get started on the dashboard.

  4. If the issue persists, contact your administrator or DigiCert Support if the issue persists.

GitHub integration could not be completed (502 Bad gateway)

Error

GitHub integration could not be completed
Error code: 502 Bad gateway

Cause

This error indicates a temporary communication failure between DigiCert Software Trust Manager and GitHub during the integration process.

Common causes include:

  • A service interruption or network issue

  • The onboarding session timing out

  • The browser session being interrupted or refreshed

  • The integration flow being abandoned and later resumed without the correct link

ヒント

During the first step of configuring the Software Trust Manager GitHub app, you’re prompted to copy and save a unique onboarding URL. This URL is required to resume or retry the integration if the session is interrupted.

Solution

  1. Find the Unique onboarding URL you copied during the initial integration step. This link allows you to resume the GitHub integration from where it stopped.

  2. Open the onboarding URL in a new browser tab.

  3. Retry the integration steps and finish the remaining configuration.

  4. If you didn’t save the onboarding URL, you must restart the GitHub integration from the beginning in Software Trust Manager.

  5. If the error persists after retrying, contact DigiCert Support and provide the error code (502 Bad gateway) for assistance.

Dependency and SBOM issues

These issues occur when generating or analyzing dependency and SBOM data.

No dependency lockfile found

Problem

Your project doesn’t contain a dependency lockfile, or SBOM results appear incomplete or inconsistent.

Cause

Without a dependency lockfile, dependency versions are resolved dynamically. Transitive dependencies may change between builds, resulting in:

  • Non-reproducible builds

  • Inconsistent dependency trees

  • Inaccurate or non-deterministic SBOM output

Solution

Create and maintain a dependency lockfile for your project.

Using a lockfile:

  • Locks dependencies to fixed, reproducible versions

  • Prevents unexpected changes from transitive updates

  • Stabilizes builds

  • Enables deterministic SBOM generation

  • Improves audit accuracy and compliance reporting

Commit the lockfile to version control and review changes before merging updates.

SBOM generation fails for a Java Gradle project

Problem

SBOM generation fails or produces incomplete results for a Gradle-based Java project.

Cause

A Gradle dependency lockfile hasn’t been generated. SBOM tools rely on fully resolved dependency data. Without a lockfile:

  • Dependency resolution may be incomplete

  • Transitive dependencies may be missing

  • Version selection may be non-deterministic

  • SBOM output may fail or be inaccurate

Solution

Generate a Gradle dependency lockfile before attempting SBOM generation.

  1. Enable dependency locking In build.gradle:

    dependencyLocking {
    lockAllConfigurations()
}

  2. Enable a single lockfile per project in settings.gradle:

    enableFeaturePreview("ONE_LOCKFILE_PER_PROJECT")

  3. To generate the lockfile, run:

    gradle dependencies --write-locks

    ヒント

    This creates a gradle.lockfile containing all resolved dependencies and their exact versions.

  4. To commit the lockfile, add the following file to version control:

    gradle.lockfile

    ヒント

    The lockfile must be committed to ensure reproducible builds and consistent SBOM results across environments.

  5. To update dependencies safely:

    gradle dependencies --write-locks
git diff gradle.lockfile

    ヒント

    Review all changes before merging.

    This prevents accidental version upgrades and ensures:

    • A complete dependency tree

    • No missing transitive dependencies

    • Reproducible SBOM output

Data synchronization and visibility delays

These issues occur when data changes aren’t immediately visible due to background processing.

Connected organization data is incomplete

Problem

After connecting an organization, not all data is visible.

Cause

Initial data synchronization is still in progress.

Solution

Wait at least 3 minutes, then refresh the application.

Repository changes aren’t reflected

Problem

A repository was added, removed, or updated, but changes aren’t visible.

Cause

Repository updates are processed asynchronously.

Solution

Wait at least 8 minutes, then refresh and check again.

Action results aren’t visible (install, uninstall, release, removal)

Problem

You performed an action, but progress or results aren’t visible.

Cause

Background processing may still be in progress.

Solution

Wait at least 8 minutes, then check again.

Code analysis results are missing or outdated

Problem

Code analysis data doesn’t appear or appears outdated.

Cause

Code analysis results refresh on a scheduled interval.

Solution

  1. Check again approximately 10 minutes past the next hour

    Examples: 01:10, 02:10, 03:10

  2. If results are still missing after one hour, contact DigiCert Support.

SBOM data is missing or outdated

Problem

SBOM information isn’t visible or appears outdated.

Cause

SBOM data refreshes periodically on a scheduled interval.

Solution

  1. Check again approximately 20 minutes past the next hour

    Examples: 01:20, 02:20, 03:20

  2. If data hasn’t updated after one hour, contact DigiCert Support.

Webhook-related issue persists

Problem

A webhook-related issue remains unresolved.

Cause

Webhook delivery retries are handled automatically in the background.

Solution

  1. Wait up to 6 hours. Most webhook issues resolve automatically during retry attempts.

  2. If the issue persists after 6 hours, contact support and provide:

    1. Repository name

    2. Timestamp of the original event

    3. Any related error messages

このセクションの内容: