oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2025-11-17 16:33:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

Check maven central as well for licenses in parents poms for nested jars (#2302)

Browse Source 
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org>
This commit is contained in:
Colm O hEigeartaigh 2023-11-08 18:26:12 +00:00 committed by GitHub
parent 220655743b
commit bae5a2e741
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
syft/pkg/cataloger/java/archive_parser.go
View File

@ -444,7 +444,7 @@ func (j *archiveParser) discoverPkgsFromAllMavenFiles(parentPkg *pkg.Package) ([
pomProject = proj pomProject = proj
} }
pkgFromPom := newPackageFromMavenData(propertiesObj, pomProject, parentPkg, j.location) pkgFromPom := newPackageFromMavenData(propertiesObj, pomProject, parentPkg, j.location, j.cfg)
if pkgFromPom != nil { if pkgFromPom != nil {
pkgs = append(pkgs, *pkgFromPom) pkgs = append(pkgs, *pkgFromPom)
} }
@ -635,7 +635,7 @@ func pomProjectByParentPath(archivePath string, location file.Location, extractP
// newPackageFromMavenData processes a single Maven POM properties for a given parent package, returning all listed Java packages found and // newPackageFromMavenData processes a single Maven POM properties for a given parent package, returning all listed Java packages found and
// associating each discovered package to the given parent package. Note the pom.xml is optional, the pom.properties is not. // associating each discovered package to the given parent package. Note the pom.xml is optional, the pom.properties is not.
func newPackageFromMavenData(pomProperties pkg.JavaPomProperties, parsedPomProject *parsedPomProject, parentPkg *pkg.Package, location file.Location) *pkg.Package { func newPackageFromMavenData(pomProperties pkg.JavaPomProperties, parsedPomProject *parsedPomProject, parentPkg *pkg.Package, location file.Location, cfg Config) *pkg.Package {
// keep the artifact name within the virtual path if this package does not match the parent package // keep the artifact name within the virtual path if this package does not match the parent package
vPathSuffix := "" vPathSuffix := ""
groupID := "" groupID := ""
@ -660,6 +660,9 @@ func newPackageFromMavenData(pomProperties pkg.JavaPomProperties, parsedPomProje
var pkgPomProject *pkg.JavaPomProject var pkgPomProject *pkg.JavaPomProject
licenses := make([]pkg.License, 0) licenses := make([]pkg.License, 0)
if parsedPomProject != nil { if parsedPomProject != nil {
if cfg.UseNetwork {
findPomLicenses(parsedPomProject, cfg)
}
pkgPomProject = parsedPomProject.JavaPomProject pkgPomProject = parsedPomProject.JavaPomProject
licenses = append(licenses, parsedPomProject.Licenses...) licenses = append(licenses, parsedPomProject.Licenses...)
} }

2
syft/pkg/cataloger/java/archive_parser_test.go
View File

@ -1089,7 +1089,7 @@ func Test_newPackageFromMavenData(t *testing.T) {
} }
test.expectedParent.Locations = locations test.expectedParent.Locations = locations
actualPackage := newPackageFromMavenData(test.props, test.project, test.parent, file.NewLocation(virtualPath)) actualPackage := newPackageFromMavenData(test.props, test.project, test.parent, file.NewLocation(virtualPath), Config{})
if test.expectedPackage == nil { if test.expectedPackage == nil {
require.Nil(t, actualPackage) require.Nil(t, actualPackage)
} else { } else {