oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2025-11-17 16:33:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

append java nested package names to the virtual path

Browse Source 
Signed-off-by: Alex Goodman <alex.goodman@anchore.com>
This commit is contained in:
Alex Goodman 2020-10-29 13:52:34 -04:00
parent fc991bc62e
commit ab45be98b8
No known key found for this signature in database
GPG Key ID: 5CB45AE22BAB7EA7
5 changed files with 13 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
schema/json/schema.json
View File

@ -194,38 +194,19 @@
"implementationTitle": {
"type": "string"
},
"implementationVendor": {
"type": "string"
},
"implementationVersion": {
"type": "string"
},
"manifestVersion": {
"type": "string"
},
"name": {
"type": "string"
},
"specificationTitle": {
"type": "string"
},
"specificationVendor": {
"type": "string"
},
"specificationVersion": {
"type": "string"
}
},
"required": [
"extraFields",
"implementationTitle",
"implementationVendor",
"implementationVersion",
"manifestVersion",
"name",
"specificationTitle",
"specificationVendor",
"specificationVersion"
"manifestVersion"
],
"type": "object"
},

8
syft/cataloger/java/archive_parser.go
View File

@ -177,6 +177,12 @@ func (j *archiveParser) discoverPkgsFromPomProperties(parentPkg *pkg.Package) ([
if propsObj.Version != "" && propsObj.ArtifactID != "" {
// TODO: if there is no parentPkg (no java manifest) one of these poms could be the parent. We should discover the right parent and attach the correct info accordingly to each discovered package
// keep the artifact name within the virtual path if this package does not match the parent package
vPathSuffix := ""
if !strings.HasPrefix(propsObj.ArtifactID, parentPkg.Name) {
vPathSuffix += ":" + propsObj.ArtifactID
}
// discovered props = new package
p := pkg.Package{
Name: propsObj.ArtifactID,
@ -185,7 +191,7 @@ func (j *archiveParser) discoverPkgsFromPomProperties(parentPkg *pkg.Package) ([
Type: pkg.JavaPkg,
MetadataType: pkg.JavaMetadataType,
Metadata: pkg.JavaMetadata{
VirtualPath: j.virtualPath,
VirtualPath: j.virtualPath + vPathSuffix,
PomProperties: propsObj,
Parent: parentPkg,
},

4
syft/cataloger/java/archive_parser_test.go
View File

@ -236,7 +236,9 @@ func TestParseJar(t *testing.T) {
Type: pkg.JavaPkg,
MetadataType: pkg.JavaMetadataType,
Metadata: pkg.JavaMetadata{
VirtualPath: "test-fixtures/java-builds/packages/example-java-app-maven-0.1.0.jar",
// ensure that nested packages with different names than that of the parent are appended as
// a suffix on the virtual path
VirtualPath: "test-fixtures/java-builds/packages/example-java-app-maven-0.1.0.jar:joda-time",
PomProperties: &pkg.PomProperties{
Path: "META-INF/maven/joda-time/joda-time/pom.properties",
GroupID: "joda-time",

6
syft/cataloger/java/java_manifest.go
View File

@ -72,12 +72,6 @@ func parseJavaManifest(reader io.Reader) (*pkg.JavaManifest, error) {
manifest.Sections = sections[1:]
}
// clean select fields
if strings.Trim(manifest.ImplVersion, " ") != "" {
// transform versions with dates attached to just versions (e.g. "1.3 2244 October 5 2008" --> "1.3")
manifest.ImplVersion = strings.Split(manifest.ImplVersion, " ")[0]
}
return &manifest, nil
}

3
syft/cataloger/java/java_manifest_test.go
View File

@ -62,10 +62,11 @@ func TestParseJavaManifest(t *testing.T) {
},
},
{
// regression test, we should always keep the full version
fixture: "test-fixtures/manifest/version-with-date",
expected: pkg.JavaManifest{
ManifestVersion: "1.0",
ImplVersion: "1.3", // ensure the date is stripped off during processing
ImplVersion: "1.3 2244 October 5 2005",
},
},
}