How to handle Azure Component Governance for ApplicationInsights Agent fat-jar distributions?

[matija-piskac-DECODE]

Hi folks,

we're building an app in AzureDevops with ApplicationInsights-Agent as a dependency. ApplicationInsights-Agent is distributed as a fat-jar, and since it is a maven dependency that doesn't list its sub-dependencies in a pom, our Component Governance doesn't pick those up.

What do you recommend we do to get a consumable list/pom/manifest of dependencies for Component Governance?

Summary

The issue

We can't track sub-dependencies in ApplicationInsights-Agent because of distribution style.

What we want to achieve

Have the AzureDevops ComponentGovernance pick up the dependencies, ideally in a way that doesn't need manual intervention and that remains up-to-date.

[trask]

hi @matija-piskac-DECODE, does this list of all of the agent dependencies help?

[matija-piskac-DECODE]

@trask this helps 👍

thank you for the quick response, and very sorry for my late reply