Skip to content

Commit e338846

Browse files
soul2zimatesoul2zimate
authored
Merge branch 'main' into TC-3969
2 parents 102edec + bbe8c17 commit e338846

File tree

37 files changed

+2494
-2507
lines changed

37 files changed

+2494
-2507
lines changed

‎src/main/java/io/github/guacsec/trustifyda/providers/BaseJavaProvider.java‎

Lines changed: 8 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,7 @@
2323
import io.github.guacsec.trustifyda.tools.Ecosystem;
2424
import java.nio.file.Path;
2525
import java.util.Arrays;
26-
import java.util.Map;
2726
import java.util.Objects;
28-
import java.util.TreeMap;
2927

3028
public abstract class BaseJavaProvider extends Provider {
3129

@@ -45,10 +43,10 @@ void parseDependencyTree(String src, int srcDepth, String[] lines, Sbom sbom, St
4543
int targetDepth = getDepth(target);
4644
while (targetDepth > srcDepth && index < lines.length) {
4745
if (targetDepth == srcDepth + 1) {
48-
PackageURL from = parseDep(src);
49-
PackageURL to = parseDep(target);
50-
if (dependencyIsNotTestScope(from) && dependencyIsNotTestScope(to)) {
51-
sbom.addDependency(from, to, scope);
46+
DependencyAggregator from = parseDep(src);
47+
DependencyAggregator to = parseDep(target);
48+
if (!from.isTestDependency() && !to.isTestDependency()) {
49+
sbom.addDependency(from.toPurl(), to.toPurl(), scope);
5250
}
5351
} else {
5452
String[] modifiedLines = Arrays.copyOfRange(lines, index, lines.length);
@@ -64,13 +62,7 @@ void parseDependencyTree(String src, int srcDepth, String[] lines, Sbom sbom, St
6462
}
6563
}
6664

67-
static boolean dependencyIsNotTestScope(PackageURL artifact) {
68-
return (Objects.nonNull(artifact.getQualifiers())
69-
&& !artifact.getQualifiers().get("scope").equals("test"))
70-
|| Objects.isNull(artifact.getQualifiers());
71-
}
72-
73-
PackageURL parseDep(String dep) {
65+
DependencyAggregator parseDep(String dep) {
7466
// root package
7567
DependencyAggregator dependencyAggregator = new DependencyAggregator();
7668
// in case line in dependency tree text starts with a letter ( for root artifact).
@@ -81,7 +73,7 @@ PackageURL parseDep(String dep) {
8173
dependencyAggregator.artifactId = parts[1];
8274
dependencyAggregator.version = parts[3];
8375

84-
return dependencyAggregator.toPurl();
76+
return dependencyAggregator;
8577
}
8678
int firstDash = dep.indexOf("-");
8779
String dependency = dep.substring(++firstDash).trim();
@@ -137,7 +129,7 @@ else if (parts.length == 6) {
137129
Integer.min(parts[parts.length - 1].indexOf(""), parts[parts.length - 1].indexOf("-"));
138130
dependencyAggregator.scope = parts[parts.length - 1].substring(0, endOfLine).trim();
139131
}
140-
return dependencyAggregator.toPurl();
132+
return dependencyAggregator;
141133
}
142134

143135
int getDepth(String line) {
@@ -185,12 +177,7 @@ boolean isTestDependency() {
185177
PackageURL toPurl() {
186178
try {
187179
return new PackageURL(
188-
Ecosystem.Type.MAVEN.getType(),
189-
groupId,
190-
artifactId,
191-
version,
192-
this.scope.equals("*") ? null : new TreeMap<>(Map.of("scope", this.scope)),
193-
null);
180+
Ecosystem.Type.MAVEN.getType(), groupId, artifactId, version, null, null);
194181
} catch (MalformedPackageURLException e) {
195182
throw new IllegalArgumentException("Unable to parse PackageURL", e);
196183
}

‎src/main/java/io/github/guacsec/trustifyda/providers/GradleProvider.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -307,7 +307,7 @@ private Sbom buildSbomFromTextFormat(
307307
Sbom sbom = SbomFactory.newInstance(Sbom.BelongingCondition.PURL, "sensitive");
308308
String root = getRoot(textFormatFile, propertiesMap);
309309

310-
PackageURL rootPurl = parseDep(root);
310+
PackageURL rootPurl = parseDep(root).toPurl();
311311
sbom.addRoot(rootPurl, readLicenseFromManifest());
312312

313313
List<String> runtimeConfig = extractLines(textFormatFile, RUNTIME_CLASSPATH);

‎src/main/java/io/github/guacsec/trustifyda/providers/JavaMavenProvider.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -177,7 +177,7 @@ private Sbom buildSbomFromTextFormat(Path textFormatFile) throws IOException {
177177
sbom.setCoordinateBasedMatching();
178178
List<String> lines = Files.readAllLines(textFormatFile);
179179
var root = lines.get(0);
180-
var rootPurl = parseDep(root);
180+
var rootPurl = parseDep(root).toPurl();
181181
sbom.addRoot(rootPurl, readLicenseFromManifest());
182182
lines.remove(0);
183183
String[] array = new String[lines.size()];

‎src/test/resources/tst_manifests/gradle-groovy/deps_with_duplicate_different_versions/expected_component_sbom.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
"name" : "log4j",
2222
"version" : "1.2.17",
2323
"scope":"required",
24-
"purl" : "pkg:maven/log4j/log4j@1.2.17?scope=compile"
24+
"purl" : "pkg:maven/log4j/log4j@1.2.17"
2525
}
2626
],
2727
"dependencies" : [

‎src/test/resources/tst_manifests/gradle-groovy/deps_with_duplicate_different_versions/expected_stack_sbom.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
"name" : "log4j",
2222
"version" : "1.2.17",
2323
"scope":"required",
24-
"purl" : "pkg:maven/log4j/log4j@1.2.17?scope=compile"
24+
"purl" : "pkg:maven/log4j/log4j@1.2.17"
2525
}
2626
],
2727
"dependencies" : [

‎src/test/resources/tst_manifests/gradle-groovy/deps_with_duplicate_no_version/expected_component_sbom.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
"name" : "log4j",
2222
"version" : "1.2.17",
2323
"scope":"required",
24-
"purl" : "pkg:maven/log4j/log4j@1.2.17?scope=compile"
24+
"purl" : "pkg:maven/log4j/log4j@1.2.17"
2525
}
2626
],
2727
"dependencies" : [

‎src/test/resources/tst_manifests/gradle-groovy/deps_with_duplicate_no_version/expected_stack_sbom.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
"name" : "log4j",
2222
"version" : "1.2.17",
2323
"scope":"required",
24-
"purl" : "pkg:maven/log4j/log4j@1.2.17?scope=compile"
24+
"purl" : "pkg:maven/log4j/log4j@1.2.17"
2525
}
2626
],
2727
"dependencies" : [

‎src/test/resources/tst_manifests/gradle-groovy/deps_with_ignore_full_specification/expected_component_sbom.json‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
"name" : "quarkus-hibernate-orm",
2121
"version" : "2.13.5.Final",
2222
"scope" : "required",
23-
"purl" : "pkg:maven/io.quarkus/quarkus-hibernate-orm@2.13.5.Final?scope=compile"
23+
"purl" : "pkg:maven/io.quarkus/quarkus-hibernate-orm@2.13.5.Final"
2424
},
2525
{
2626
"type" : "library",
@@ -29,7 +29,7 @@
2929
"name" : "quarkus-agroal",
3030
"version" : "2.13.5.Final",
3131
"scope" : "required",
32-
"purl" : "pkg:maven/io.quarkus/quarkus-agroal@2.13.5.Final?scope=compile"
32+
"purl" : "pkg:maven/io.quarkus/quarkus-agroal@2.13.5.Final"
3333
},
3434
{
3535
"type" : "library",
@@ -38,7 +38,7 @@
3838
"name" : "quarkus-resteasy",
3939
"version" : "2.13.7.Final",
4040
"scope" : "required",
41-
"purl" : "pkg:maven/io.quarkus/quarkus-resteasy@2.13.7.Final?scope=compile"
41+
"purl" : "pkg:maven/io.quarkus/quarkus-resteasy@2.13.7.Final"
4242
},
4343
{
4444
"type" : "library",
@@ -47,7 +47,7 @@
4747
"name" : "quarkus-resteasy-jackson",
4848
"version" : "2.13.5.Final",
4949
"scope" : "required",
50-
"purl" : "pkg:maven/io.quarkus/quarkus-resteasy-jackson@2.13.5.Final?scope=compile"
50+
"purl" : "pkg:maven/io.quarkus/quarkus-resteasy-jackson@2.13.5.Final"
5151
},
5252
{
5353
"type" : "library",
@@ -56,7 +56,7 @@
5656
"name" : "quarkus-jdbc-postgresql",
5757
"version" : "2.13.5.Final",
5858
"scope" : "required",
59-
"purl" : "pkg:maven/io.quarkus/quarkus-jdbc-postgresql@2.13.5.Final?scope=compile"
59+
"purl" : "pkg:maven/io.quarkus/quarkus-jdbc-postgresql@2.13.5.Final"
6060
},
6161
{
6262
"type" : "library",
@@ -65,7 +65,7 @@
6565
"name" : "quarkus-vertx-http",
6666
"version" : "2.13.7.Final",
6767
"scope" : "required",
68-
"purl" : "pkg:maven/io.quarkus/quarkus-vertx-http@2.13.7.Final?scope=compile"
68+
"purl" : "pkg:maven/io.quarkus/quarkus-vertx-http@2.13.7.Final"
6969
},
7070
{
7171
"type" : "library",
@@ -74,7 +74,7 @@
7474
"name" : "quarkus-kubernetes-service-binding",
7575
"version" : "2.13.5.Final",
7676
"scope" : "required",
77-
"purl" : "pkg:maven/io.quarkus/quarkus-kubernetes-service-binding@2.13.5.Final?scope=compile"
77+
"purl" : "pkg:maven/io.quarkus/quarkus-kubernetes-service-binding@2.13.5.Final"
7878
},
7979
{
8080
"type" : "library",
@@ -83,7 +83,7 @@
8383
"name" : "quarkus-container-image-docker",
8484
"version" : "2.13.5.Final",
8585
"scope" : "required",
86-
"purl" : "pkg:maven/io.quarkus/quarkus-container-image-docker@2.13.5.Final?scope=compile"
86+
"purl" : "pkg:maven/io.quarkus/quarkus-container-image-docker@2.13.5.Final"
8787
},
8888
{
8989
"type" : "library",
@@ -92,7 +92,7 @@
9292
"name" : "jakarta.validation-api",
9393
"version" : "2.0.2",
9494
"scope" : "required",
95-
"purl" : "pkg:maven/jakarta.validation/jakarta.validation-api@2.0.2?scope=compile"
95+
"purl" : "pkg:maven/jakarta.validation/jakarta.validation-api@2.0.2"
9696
},
9797
{
9898
"type" : "library",
@@ -101,7 +101,7 @@
101101
"name" : "quarkus-resteasy-multipart",
102102
"version" : "2.13.7.Final",
103103
"scope" : "required",
104-
"purl" : "pkg:maven/io.quarkus/quarkus-resteasy-multipart@2.13.7.Final?scope=compile"
104+
"purl" : "pkg:maven/io.quarkus/quarkus-resteasy-multipart@2.13.7.Final"
105105
},
106106
{
107107
"type" : "library",
@@ -110,7 +110,7 @@
110110
"name" : "quarkus-hibernate-orm-deployment",
111111
"version" : "2.0.2.Final",
112112
"scope" : "required",
113-
"purl" : "pkg:maven/io.quarkus/quarkus-hibernate-orm-deployment@2.0.2.Final?scope=compile"
113+
"purl" : "pkg:maven/io.quarkus/quarkus-hibernate-orm-deployment@2.0.2.Final"
114114
}
115115
],
116116
"dependencies" : [

0 commit comments

Comments
 (0)