Try harder to catalog maven cache

[prabhu]

Fixes #504

@theold190 could you kindly test with this PR branch?

[theold190]

@prabhu I have just tested the code from PR branch.

Now SBOM file contains more components. The ones mentioned in #504 were also included in a result sbom file. So detection of the jar files seems to be improved. Thanks!

Though when I have uploaded SBOM file to Dependency tracker, it failed to provide extra information (ex. latest version, available vulnerabilities) for those newly added components.

I have compared how "guava" is reported in other project (where we could see additional info). Here are some details.

	Guava (-t java)	Guava (-t maven-cache)
Component name	guava	org.google.guava
Version	31.1-jre	23.0.0
Namespace / group / vendor	com.google.guava	p2.osgi.bundle.com.google.guava
Package URL (PURL)	pkg:maven/com.google.guava/guava@31.1-jre?type=jar	pkg:maven/p2.osgi.bundle.com.google.guava/com.google.guava@23.0.0?type=jar

I guess that is due to PURL information collected by parsing name/path of .jar file instead of using info from .pom/META-INF/.jar.

[prabhu]

@theold190 Let me investigate. I think it must match the id from this file.

https://repo1.maven.org/maven2/com/google/guava/guava/23.0/guava-23.0.pom

[prabhu]

@theold190, do you have any docs on p2 osgi bundle / p2artifacts.xml? It appears like it has its own namespace which is quite different from the linked guava poms. A sample app with the same plugins from your pom.xml might help.

[theold190]

@prabhu now we are comming to the area where my knowledge are quite limited. So I can't really create an example app that would use an OSGI bundle.

Though here are some details I managed to find:

• https://en.wikipedia.org/wiki/OSGi#Bundles - a bit about the OSGI and OSGI bundle itselt
• https://stackoverflow.com/a/20260459 - short info on what differ OSGI bundle and a JAR file
• Cyclonedx sbom for tycho dependencies cyclonedx-maven-plugin#137 (comment) - gives a very good input on how OSGI bundles could be created/converted from JAR files

As I see, JAR packages mentioned before have same SHA as from maven.org. So JAR files themselves are not manipulated/changed. And I would also expect to get same results as from https://repo1.maven.org/maven2/com/google/guava/guava/23.0/guava-23.0.pom

[prabhu]

@theold190, let me read the referenced thread and links! This is super-cool information.

[prabhu]

@theold190, I have improved the logic to make the group match the value from the maven plugin in maven-cache mode. So you will see the groups such as p2.osgi.bundle, p2.eclipse.plugin. In addition, the qualifier would be set to osgi-bundle, eclipse-plugin. I feel this is the best compromise for this.

[theold190]

I see. I can confirm that in results I can see now p2.osgi.bundle group. So now at least SBOM file list those components. That is an improvement.

Unfortunately in Dependency tracker it still doesn't show additional info. And I am not sure Dependency tracker developers would add special handling of ps.osgi.bundle and similar (DependencyTrack/dependency-track#244)

[prabhu]

@theold190 Thank you for the confirmation. I will merge this PR since the jars are no longer missed. For Dependency Track and Maven plugin threads, I will watch them closely and make cdxgen compatible with what gets agreed upon.

As an interim, I can add an alias on the upcoming dep-scan project to support p2 and osgi apps.