Fallback on 'cdx' or 'bom' JSON files for Java BOM

[nekhtan]

Updated the fallback lookup of BOM files to find JSON files that either contain "bom" or "cdx" in their filename.

Linked to #1126

[prabhu]

Thank you so much! Did the fix work as per your needs?

[nekhtan]

Thank you so much! Did the fix work as per your needs?

Actually, no, I opened the PR too soon :(

The filter seems a bit too wide: I have SBOM test files that match the new pattern and they are taken into account. The resulting SBOM is way too large and does not represent the reality (aggregates the project's BOM and the BOMs from tests).

[prabhu]

@nekhtan, may be use --exclude to exclude those test directories? Or how about

bomJsonFiles = getAllFiles(path, "target/**/*{cdx,bom}*.json", options);

[nekhtan]

Alright I struggled a bit with the exclude but it finally does the job: --exclude=./**/src/test/**/*.json

Note that:

• ./**/src/test/** is not enough
• **/src/test/**/*.json has a weird behavior as it adds my CLI executable to the pattern and it's resolved as ["**C:/dev/PortableGit/src/test/**/*.json"] 😮

[prabhu]

Could you test the exclude a bit more and contribute to the docs as well in a separate PR?

[nekhtan]

I went all the way up to this line and it's still broken...
BUT if I use the absolute path of the node executable it works as expected, so I really don't get it 🙄

Broken when using node directly:

> node /c/<path>/cdxgen/bin/cdxgen.js --no-recurse --exclude="**/src/test/**/*.json" 

process.argv [
  ...,
  '--exclude=**C:/dev/PortableGit/src/test/**/*.json'
]

Working when using node from the result of which node:

> C:/<path>/bin/node /c/<path>/cdxgen/bin/cdxgen.js --no-recurse --exclude="**/src/test/**/*.json"

process.argv [
  ...,
  '--exclude=**/src/test/**/*.json'
]

[prabhu]

ok, let's look into the exclude issue separately. Do we need the target prefix as suggested in the earlier comment?

[nekhtan]

For my own need, it seems to work just fine with the exclusion, so as far as I'm concerned the PR is ok.

Regarding the general behaviour, I dont think it would be wise to replace the current pattern with a completely different one: it might break for other people, don't you think? The one you suggested doesn't break the current behavior, it just extends it, right?

[prabhu]

It's a good point, although we can never be sure with opensource, since every change could break something somewhere. I think we can add the target prefix, since that code shouldn't pick up any other sbom file. Could you kindly make this change?

[prabhu]

Thank you!