partial java comparison with extra metadata

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

test/inline-compare/utils/inline.py

@@ -1,4 +1,5 @@
 import os
+import re
 import json
 import collections
 
@@ -66,22 +67,27 @@ class InlineScan:
             elif pkg_type in ("java-jpi", "java-hpi"):
                 pkg_type = "java-?pi"
 
+            # this would usually be "package" but this would not be able to account for duplicate dependencies in
+            # nested jars of the same name. Fallback to the package name if there is no given location
+            name = entry["location"]
+
+            # replace fields with "N/A" with None
+            for k, v in dict(entry).items():
+                if v in ("", "N/A"):
+                    entry[k] = None
+
+            extra = {}
+            # extra = dict(entry)
+            # extra.pop('type')
+            # extra.pop('maven-version')
+            # extra.pop("origin")  # don't include origin as syft does not compact several fields into 1
+
             pkg = utils.package.Package(
-                name=entry["package"],
+                name=name,
                 type=pkg_type,
             )
             packages.add(pkg)
 
-            extra = dict(entry)
-            extra.pop('type')
-            extra.pop('maven-version')
-            for k, v in dict(extra).items():
-                if v in ("", "N/A"):
-                    extra[k] = None
-
-            # temp temp temp
-            extra.pop("location")
-
             metadata[pkg.type][pkg] = utils.package.Metadata(
                 version=entry["maven-version"],
                 extra=tuple(sorted(extra.items())),

test/inline-compare/utils/package.py

@@ -144,13 +144,3 @@ class Analysis:
             float(len(self.overlapping_packages) + len(self.similar_missing_packages))
             / float(len(self.inline_data.packages))
         ) * 100.0
-
-    @property
-    def quality_gate_score(self):
-        """
-        The result of the analysis in the form of an aggregated percentage; it is up to the caller to use this value
-        and enforce a quality gate.
-        """
-        return (
-            self.percent_overlapping_packages + self.percent_overlapping_metadata
-        ) / 2.0

test/inline-compare/utils/syft.py

@@ -46,50 +46,41 @@ class Syft:
             elif pkg_type in ("apk",):
                 pkg_type = "apkg"
 
+            name = entry["name"]
+            version = entry["version"]
+
+            if "java" in pkg_type:
+                # lets match what inline scan expects to output
+
+                # specVersion = dig(entry, "metadata", "manifest", "specificationVersion") or None
+                # implVersion = dig(entry, "metadata", "manifest", "implementationVersion") or None
+                virtualPath = dig(entry, "metadata", "virtualPath")
+
+                # package = dig(entry, "metadata", "pomProperties", "artifactId")
+                # if not package:
+                #     package = "%s-%s" % (dig(entry, "name"), dig(entry, "version"))
+                #
+                # extra = {
+                #     "implementation-version": implVersion,
+                #     "specification-version": specVersion,
+                #     "location": virtualPath,
+                #     "package": package,
+                # }
+
+                # we need to use the virtual path instead of the name to account for nested dependencies with the same
+                # package name (but potentially different metadata)
+                name = virtualPath
+
+            elif pkg_type == "apkg":
+                version = entry["version"].split("-")[0]
+
             pkg = utils.package.Package(
-                name=entry["name"],
+                name=name,
                 type=pkg_type,
             )
 
             packages.add(pkg)
 
-            if "java" in pkg_type:
-                # lets match what inline scan expects to output
-
-                path = dig(entry, "locations", 0, "path")
-                specVendor = dig(entry, "metadata", "manifest", "specificationVendor")
-                implVendor = dig(entry, "metadata", "manifest", "implementationVendor")
-
-                specVersion = dig(entry, "metadata", "manifest", "specificationVersion") or None
-                implVersion = dig(entry, "metadata", "manifest", "implementationVersion") or None
-
-                extra = {
-                    "implementation-version": implVersion,
-                    "specification-version": specVersion,
-                    "origin": dig(entry, "metadata", "pomProperties", "groupId"),
-                    "location": path,
-                    "package": dig(entry, "metadata", "pomProperties", "artifactId"),
-                }
-
-                if dig(entry, "metadata", "parentPackage"):
-                    extra['origin'] = dig(entry, "metadata", "pomProperties", "groupId")
-                else:
-                    # this is a nested package...
-                    if specVendor:
-                        extra['origin'] = specVendor
-                    elif implVendor:
-                        extra['origin'] = implVendor
-
-                pomPath = dig(entry, "metadata", "pomProperties", "Path")
-                if path and pomPath:
-                   extra["location"] = "%s:%s" % (path, pomPath),
-
-                # temp temp temp
-                extra.pop("location")
-
-            elif pkg_type == "apkg":
-                entry["version"] = entry["version"].split("-")[0]
-
-            metadata[pkg.type][pkg] = utils.package.Metadata(version=entry["version"], extra=tuple(sorted(extra.items())))
+            metadata[pkg.type][pkg] = utils.package.Metadata(version=version, extra=tuple(sorted(extra.items())))
 
         return utils.package.Info(packages=frozenset(packages), metadata=metadata)