Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix dependencies concealed during BOM creation, aligning more closely with the dependency graph #256

Merged
merged 9 commits into from
Feb 10, 2023
Merged

Fix dependencies concealed during BOM creation, aligning more closely with the dependency graph #256

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
60a4da8
Fix concealed test and runtime dependencies
Dec 1, 2022
b974bd5
Prune any extraneous component entries
Dec 1, 2022
57dd226
Fix test dependencies referenced as compile scope and skip excluded t…
Dec 2, 2022
ebdbaf0
Fix those dependencies which are lost when their version has not been…
knrc Feb 8, 2023
3963068
Reduce chattiness of log messages
knrc Feb 8, 2023
56857a8
PR review changes: info->debug logs and conceal/obscure->hidden
knrc Feb 9, 2023
6172d1b
fix exclude and validate
hboutemy Feb 10, 2023
0719e51
rename trustification to bom-dependencies and reduce executions
hboutemy Feb 10, 2023
ec8a7ba
Merge pull request #1 from hboutemy/trustification_pr
knrc Feb 10, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
297 changes: 248 additions & 49 deletions src/main/java/org/cyclonedx/maven/BaseCycloneDxMojo.java
View file
Open in desktop

Large diffs are not rendered by default.

43 changes: 20 additions & 23 deletions src/main/java/org/cyclonedx/maven/CycloneDxAggregateMojo.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,34 +163,31 @@ protected boolean analyze(final Set<Component> components, final Set<Dependency>
componentRefs.add(projectBomComponent.getBomRef());

for (final Artifact artifact : mavenProject.getArtifacts()) {
if (shouldInclude(artifact)) {
final Component component = convert(artifact);

// ensure that only one component with the same bom-ref exists in the BOM
if (!componentRefs.contains(component.getBomRef())) {
Component.Scope componentScope = null;
for (String projectId : dependencyAnalysisMap.keySet()) {
ProjectDependencyAnalysis dependencyAnalysis = dependencyAnalysisMap.get(projectId);
Component.Scope currentProjectScope = getComponentScope(component, artifact, dependencyAnalysis);
// Set scope to required if the component is used in any project
if (Component.Scope.REQUIRED.equals(currentProjectScope)) {
componentScope = currentProjectScope;
break;
} else if (componentScope == null && currentProjectScope != null) {
// Set optional or excluded scope
componentScope = currentProjectScope;
}
final Component component = convert(artifact);

// ensure that only one component with the same bom-ref exists in the BOM
if (!componentRefs.contains(component.getBomRef())) {
Component.Scope componentScope = null;
for (ProjectDependencyAnalysis dependencyAnalysis : dependencyAnalysisMap.values()) {
Component.Scope currentProjectScope = getComponentScope(component, artifact, dependencyAnalysis);
// Set scope to required if the component is used in any project
if (Component.Scope.REQUIRED.equals(currentProjectScope)) {
componentScope = currentProjectScope;
break;
} else if (componentScope == null && currentProjectScope != null) {
// Set optional or excluded scope
componentScope = currentProjectScope;
}
component.setScope(componentScope);
componentRefs.add(component.getBomRef());
components.add(component);

projectComponentRefs.add(component.getBomRef());
}
component.setScope(componentScope);
componentRefs.add(component.getBomRef());
components.add(component);

projectComponentRefs.add(component.getBomRef());
}
}
if (schemaVersion().getVersion() >= 1.2) {
projectDependencies.addAll(buildDependencyGraph(componentRefs, mavenProject));
projectDependencies.addAll(buildDependencyGraph(mavenProject));
dependencies.addAll(projectDependencies);
}
}
Expand Down
16 changes: 7 additions & 9 deletions src/main/java/org/cyclonedx/maven/CycloneDxMojo.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,19 +99,17 @@ protected boolean analyze(final Set<Component> components, final Set<Dependency>
componentRefs.add(bomComponent.getBomRef());

for (final Artifact artifact : getProject().getArtifacts()) {
if (shouldInclude(artifact)) {
final Component component = convert(artifact);
// ensure that only one component with the same bom-ref exists in the BOM
if (!componentRefs.contains(component.getBomRef())) {
component.setScope(getComponentScope(component, artifact, dependencyAnalysis));
componentRefs.add(component.getBomRef());
components.add(component);
}
final Component component = convert(artifact);
// ensure that only one component with the same bom-ref exists in the BOM
if (!componentRefs.contains(component.getBomRef())) {
component.setScope(getComponentScope(component, artifact, dependencyAnalysis));
componentRefs.add(component.getBomRef());
components.add(component);
}
}
}
if (schemaVersion().getVersion() >= 1.2) {
dependencies.addAll(buildDependencyGraph(componentRefs, null));
dependencies.addAll(buildDependencyGraph(null));
}
return true;
}
Expand Down
14 changes: 6 additions & 8 deletions src/main/java/org/cyclonedx/maven/CycloneDxPackageMojo.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,17 +66,15 @@ protected boolean analyze(Set<Component> components, Set<Dependency> dependencie
}
getLog().info("Analyzing " + mavenProject.getArtifactId());
for (final Artifact artifact : mavenProject.getArtifacts()) {
if (shouldInclude(artifact)) {
final Component component = convert(artifact);
// ensure that only one component with the same bom-ref exists in the BOM
if (!componentRefs.contains(component.getBomRef())) {
componentRefs.add(component.getBomRef());
components.add(component);
}
final Component component = convert(artifact);
// ensure that only one component with the same bom-ref exists in the BOM
if (!componentRefs.contains(component.getBomRef())) {
componentRefs.add(component.getBomRef());
components.add(component);
}
}
if (schemaVersion().getVersion() >= 1.2) {
dependencies.addAll(buildDependencyGraph(componentRefs, mavenProject));
dependencies.addAll(buildDependencyGraph(mavenProject));
}
}
return true;
Expand Down
13 changes: 11 additions & 2 deletions src/main/java/org/cyclonedx/maven/DefaultModelConverter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,15 @@ public class DefaultModelConverter implements ModelConverter {
public DefaultModelConverter() {
}

public String generatePackageUrl(Artifact artifact) {
public String generatePackageUrl(final Artifact artifact) {
return generatePackageUrl(artifact, true);
}

public String generateVersionlessPackageUrl(final Artifact artifact) {
return generatePackageUrl(artifact, false);
}

private String generatePackageUrl(final Artifact artifact, final boolean includeVersion) {
TreeMap<String, String> qualifiers = null;
if (artifact.getType() != null || artifact.getClassifier() != null) {
qualifiers = new TreeMap<>();
Expand All @@ -91,7 +99,8 @@ public String generatePackageUrl(Artifact artifact) {
qualifiers.put("classifier", artifact.getClassifier());
}
}
return generatePackageUrl(artifact.getGroupId(), artifact.getArtifactId(), artifact.getBaseVersion(), qualifiers, null);
final String version = includeVersion ? artifact.getBaseVersion() : null;
return generatePackageUrl(artifact.getGroupId(), artifact.getArtifactId(), version, qualifiers, null);
}

private String generatePackageUrl(String groupId, String artifactId, String version, TreeMap<String, String> qualifiers, String subpath) {
Expand Down
2 changes: 2 additions & 0 deletions src/main/java/org/cyclonedx/maven/ModelConverter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,8 @@
public interface ModelConverter {
String generatePackageUrl(Artifact artifact);

String generateVersionlessPackageUrl(final Artifact artifact);

/**
* Converts a Maven artifact (dependency or transitive dependency) into a
* CycloneDX component.
Expand Down