Refactor vulnerability-analyzer to use Protobuf schemas

[nscuro]

This PR refactors the vulnerability-analyzer service to use the Protobuf schemas introduced in #337.

Important notes

1. Redpanda Console can deserialize Protobuf messages, and display them in a human-readable way¹, publishing Protobuf messages via Redpanda Console is currently not supported²
2. xk6-kafka currently does not support Protobuf³

How to test

Ideally, everything should just continue to work as before.
But anyway, here's how this can be verified:

1. Checkout this branch and install all modules
   • This will also generate Java classes from the Protobuf schemas

git checkout issue-244-2
./mvnw clean install -DskipTests

2. Launch Postgres and Redpanda as usual

docker compose up -d

3. Start the vulnerability-analyzer service

cd vulnerability-analyzer
../mvnw quarkus:dev

4. In a separate terminal, navigate to the API server repo, and checkout the branch of the companion PR⁴

cd hyades-apiserver
git fetch
git checkout protobuf

5. Build the API server JAR

clean package -Pembedded-jetty -Penhance -DskipTests -Dlogback.configuration.file=src/main/docker/logback.xml

6. Launch the API server

SYSTEM_REQUIREMENT_CHECK_ENABLED=false java -Xmx1g -XX:+UseParallelGC -jar target/dependency-track-apiserver.jar

At this point, you can either proceed with manual, or automatic testing.

For manual:

• Launch a frontend container

docker run --rm -e "API_BASE_URL=http://localhost:8080" -p 8081:8080 dependencytrack/frontend:snapshot

• In a browser, navigate to http://localhost:8081, and upload a BOM to a project
• Check the logs of both API server and vulnerability-analyzer for any errors

For automatic:

• Prepare a directory with >= 1 SBOMs in CycloneDX JSON format; Ensure they all end in .cdx.json
• Use dtbench to setup the admin account, create as many projects as you wish, upload BOMs to them, and wait for the processing of every BOM to complete:

docker run -it --rm -v "/path/to/boms:/work:ro" ghcr.io/nscuro/dtbench:latest \
  -url http://host.docker.internal:8080 -pass admin123 \
  -boms /work -count <NUMBER_OF_PROJECTS> \
  -wait -wait-timeout 15m \

Footnotes

1. https://docs.redpanda.com/docs/manage/console/protobuf/ ↩

2. https://github.com/redpanda-data/console/issues/370 ↩

3. https://github.com/mostafa/xk6-kafka/issues/71 ↩

4. https://github.com/DependencyTrack/hyades-apiserver/pull/32 ↩

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

81.2% Coverage
2.3% Duplication