Merge branch 'main' into snyk-upgrade-949d7688f07f27edc7a4a751ca68b538

Author: ruromero

.github/workflows/integration.yml

@@ -0,0 +1,20 @@
+---
+name: Integration
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  call-shared:
+    uses: trustification/exhort-integration-tests/.github/workflows/integration.yml@main
+    with:
+      language: java
+      repo-url: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
+      commit-sha: ${{ github.event.pull_request.head.sha || github.sha }}

.github/workflows/pr.yml

@@ -14,11 +14,11 @@ jobs:
       checks: write
       pull-requests: write
     env:
-      MAIN_JAVA_VER: 11
+      MAIN_JAVA_VER: 17
       RUN_PYTHON_BIN: ${{ vars.RUN_PYTHON_BIN }}
     strategy:
       matrix:
-        java: [11, 17, 21]
+        java: [17, 21]
     steps:
     - name: Checkout sources
       uses: actions/checkout@v3

.github/workflows/release.yml

@@ -31,11 +31,11 @@ jobs:
           fetch-depth: 0
 
 
-      - name: Setup Java 11
-        uses: actions/setup-java@v3
+      - name: Setup Java 17
+        uses: actions/setup-java@v4
         with:
           distribution: temurin
-          java-version: 11
+          java-version: 17
           cache: maven
 
       - name: create ssh agent

.github/workflows/stage.yml

@@ -25,11 +25,11 @@ jobs:
       - name: Checkout sources
         uses: actions/checkout@v3
 
-      - name: Setup Java 11
-        uses: actions/setup-java@v3
+      - name: Setup Java 17
+        uses: actions/setup-java@v4
         with:
           distribution: temurin
-          java-version: 11
+          java-version: 17
           cache: maven
 
       - name: Get pom specs

.gitignore

@@ -41,8 +41,12 @@ dependency-reduced-pom.xml
 # Node
 node_modules
 
+# Python virtual envs
+.venv
+
 # project stuff
 http_requests
 json_responses
 **/.DS_Store
 .idea/
+

pom.xml

@@ -16,7 +16,7 @@
     <code.coverage.threshold>81%</code.coverage.threshold>
     <mutation.coverage.threshold>50</mutation.coverage.threshold>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-    <maven.compiler.release>11</maven.compiler.release>
+    <maven.compiler.release>17</maven.compiler.release>
     <!-- Dependencies -->
     <exhort-api.version>1.0.6</exhort-api.version>
     <jackson.version>2.19.1</jackson.version>
@@ -30,7 +30,7 @@
     <mockito.version>5.17.0</mockito.version>
     <!-- Plugins -->
     <maven-clean-plugin.version>3.2.0</maven-clean-plugin.version>
-    <maven-compiler-plugin.version>3.11.0</maven-compiler-plugin.version>
+    <maven-compiler-plugin.version>3.12.1</maven-compiler-plugin.version>
     <maven-dependency-plugin.version>3.6.0</maven-dependency-plugin.version>
     <maven-deploy-plugin.version>3.1.1</maven-deploy-plugin.version>
     <maven-enforcer-plugin.version>3.3.0</maven-enforcer-plugin.version>

src/main/java/com/redhat/exhort/cli/App.java

@@ -25,12 +25,14 @@
 import com.redhat.exhort.Api;
 import com.redhat.exhort.api.v4.AnalysisReport;
 import com.redhat.exhort.api.v4.ProviderReport;
-import com.redhat.exhort.api.v4.Source;
+import com.redhat.exhort.api.v4.SourceSummary;
 import com.redhat.exhort.impl.ExhortApi;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
+import java.util.HashMap;
+import java.util.Map;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.ExecutionException;
 
@@ -161,7 +163,8 @@ private static CompletableFuture<String> executeComponentAnalysis(
     Api api = new ExhortApi();
     CompletableFuture<AnalysisReport> analysis = api.componentAnalysis(filePath);
     if (outputFormat.equals(OutputFormat.SUMMARY)) {
-      analysis = analysis.thenApply(App::extractSummary);
+      var summary = analysis.thenApply(App::extractSummary);
+      return summary.thenApply(App::toJsonString);
     }
     return analysis.thenApply(App::toJsonString);
   }
@@ -174,9 +177,8 @@ private static String toJsonString(Object obj) {
     }
   }
 
-  private static AnalysisReport extractSummary(AnalysisReport report) {
-    AnalysisReport summary = new AnalysisReport();
-    summary.setScanned(report.getScanned());
+  private static Map<String, SourceSummary> extractSummary(AnalysisReport report) {
+    Map<String, SourceSummary> summary = new HashMap<>();
     if (report.getProviders() == null) {
       return summary;
     }
@@ -194,12 +196,11 @@ private static AnalysisReport extractSummary(AnalysisReport report) {
                     .entrySet()
                     .forEach(
                         sourceEntry -> {
-                          var source = new Source();
-                          source.setSummary(sourceEntry.getValue().getSummary());
-                          provider.putSourcesItem(sourceEntry.getKey(), source);
+                          if (sourceEntry.getValue().getSummary() != null) {
+                            summary.put(sourceEntry.getKey(), sourceEntry.getValue().getSummary());
+                          }
                         });
               }
-              summary.putProvidersItem(entry.getKey(), provider);
             });
     return summary;
   }

src/main/java/com/redhat/exhort/providers/GoModulesProvider.java

@@ -17,6 +17,9 @@
 
 import static com.redhat.exhort.impl.ExhortApi.debugLoggingIsNeeded;
 
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import com.github.packageurl.MalformedPackageURLException;
 import com.github.packageurl.PackageURL;
 import com.redhat.exhort.Api;
@@ -68,7 +71,7 @@ public String getMainModuleVersion() {
   public GoModulesProvider(Path manifest) {
     super(Type.GOLANG, manifest);
     this.goExecutable = Operations.getExecutable("go", "version");
-    this.goEnvironmentVariableForPurl = getQualifiers(true);
+    this.goEnvironmentVariableForPurl = getQualifiers();
     this.mainModuleVersion = getDefaultMainModuleVersion();
   }
 
@@ -137,7 +140,7 @@ Sbom getDependenciesSbom(Path manifestPath, boolean buildTree) throws IOExceptio
     boolean matchManifestVersions =
         Environment.getBoolean(Provider.PROP_MATCH_MANIFEST_VERSIONS, false);
     if (matchManifestVersions) {
-      String[] goModGraphLines = goModulesResult.split(System.lineSeparator());
+      String[] goModGraphLines = goModulesResult.split(Operations.GENERIC_LINE_SEPARATOR);
       performManifestVersionsCheck(goModGraphLines, manifestPath);
     }
     if (!buildTree) {
@@ -151,7 +154,7 @@ Sbom getDependenciesSbom(Path manifestPath, boolean buildTree) throws IOExceptio
   private void performManifestVersionsCheck(String[] goModGraphLines, Path manifestPath) {
     try {
       String goModLines = Files.readString(manifestPath);
-      String[] lines = goModLines.split(System.lineSeparator());
+      String[] lines = goModLines.split(Operations.GENERIC_LINE_SEPARATOR);
       String root = getParentVertex(goModGraphLines[0]);
       List<String> comparisonLines =
           Arrays.stream(goModGraphLines)
@@ -270,7 +273,8 @@ private Sbom buildSbomFromGraph(
     // iterate over go mod graph line by line and create map , with each entry to contain module as
     // a key , and
     // value of list of that module' dependencies.
-    List<String> linesList = Arrays.asList(goModulesResult.split(System.lineSeparator()));
+    List<String> linesList =
+        Arrays.asList(goModulesResult.split(Operations.GENERIC_LINE_SEPARATOR));
 
     int startingIndex = 0;
     for (String line : linesList) {
@@ -324,7 +328,7 @@ private Map<String, List<String>> getFinalPackagesVersionsForModule(
     String finalVersionsForAllModules =
         Operations.runProcessGetOutput(manifestPath.getParent(), "go", "list", "-m", "all");
     Map<String, String> finalModulesVersions =
-        Arrays.stream(finalVersionsForAllModules.split(System.lineSeparator()))
+        Arrays.stream(finalVersionsForAllModules.split(Operations.GENERIC_LINE_SEPARATOR))
             .filter(string -> string.trim().split(" ").length == 2)
             .collect(
                 Collectors.toMap(
@@ -378,26 +382,38 @@ private static List<String> collectAllDirectDependencies(List<String> targetLine
         .collect(Collectors.toList());
   }
 
-  private TreeMap<String, String> getQualifiers(boolean includeOsAndArch) {
-    if (includeOsAndArch) {
-      String goEnvironmentVariables = Operations.runProcessGetOutput(null, goExecutable, "env");
-      String hostArch =
-          getEnvironmentVariable(goEnvironmentVariables, GO_HOST_ARCHITECTURE_ENV_NAME);
-      String hostOS =
-          getEnvironmentVariable(goEnvironmentVariables, GO_HOST_OPERATION_SYSTEM_ENV_NAME);
-      return new TreeMap<>(Map.of("type", "module", "goos", hostOS, "goarch", hostArch));
+  private TreeMap<String, String> getQualifiers() {
+    var goEnvironmentVariables = getGoEnvironmentVariables();
+    var qualifiers = new TreeMap<String, String>();
+    qualifiers.put("type", "module");
+    if (goEnvironmentVariables.containsKey(GO_HOST_ARCHITECTURE_ENV_NAME)) {
+      qualifiers.put("goarch", goEnvironmentVariables.get(GO_HOST_ARCHITECTURE_ENV_NAME));
+    }
+    if (goEnvironmentVariables.containsKey(GO_HOST_OPERATION_SYSTEM_ENV_NAME)) {
+      qualifiers.put("goos", goEnvironmentVariables.get(GO_HOST_OPERATION_SYSTEM_ENV_NAME));
     }
 
-    return new TreeMap<>(Map.of("type", "module"));
+    return qualifiers;
   }
 
-  private static String getEnvironmentVariable(String goEnvironmentVariables, String envName) {
-    int i = goEnvironmentVariables.indexOf(String.format("%s=", envName));
-    int beginIndex = i + String.format("%s=", envName).length();
-    int endOfLineIndex =
-        goEnvironmentVariables.substring(beginIndex).indexOf(System.lineSeparator());
-    String envValue = goEnvironmentVariables.substring(beginIndex).substring(0, endOfLineIndex);
-    return envValue.replaceAll("\"", "");
+  private Map<String, String> getGoEnvironmentVariables() {
+    String goEnvironmentVariables =
+        Operations.runProcessGetOutput(null, goExecutable, "env", "--json");
+    JsonNode tree;
+    try {
+      tree = new ObjectMapper().readTree(goEnvironmentVariables);
+    } catch (JsonProcessingException e) {
+      throw new RuntimeException("Failed to parse go environment variables: " + e.getMessage());
+    }
+    var envMap = new HashMap<String, String>();
+    tree.fields()
+        .forEachRemaining(
+            entry -> {
+              String key = entry.getKey();
+              String value = entry.getValue().asText();
+              envMap.put(key, value);
+            });
+    return envMap;
   }
 
   private String buildGoModulesDependencies(Path manifestPath) {
@@ -417,7 +433,7 @@ private String buildGoModulesDependencies(Path manifestPath) {
   }
 
   private Sbom buildSbomFromList(String golangDeps, List<PackageURL> ignoredDeps) {
-    String[] allModulesFlat = golangDeps.split(System.lineSeparator());
+    String[] allModulesFlat = golangDeps.split(Operations.GENERIC_LINE_SEPARATOR);
     String parentVertex = getParentVertex(allModulesFlat[0]);
     PackageURL root = toPurl(parentVertex, "@", this.goEnvironmentVariableForPurl);
     // Get only direct dependencies of root package/module, and that's it.

src/main/java/com/redhat/exhort/providers/JavaMavenProvider.java

@@ -54,7 +54,7 @@ public final class JavaMavenProvider extends BaseJavaProvider {
   private static final String PROP_JAVA_HOME = "JAVA_HOME";
   private static final Logger log = LoggersFactory.getLogger(JavaMavenProvider.class.getName());
   private final String mvnExecutable;
-  private static final String MVN = "mvn";
+  private static final String MVN = Operations.isWindows() ? "mvn.cmd" : "mvn";
   private static final String ARG_VERSION = "-v";
 
   public JavaMavenProvider(Path manifest) {
@@ -65,7 +65,8 @@ public JavaMavenProvider(Path manifest) {
 
   @Override
   public Content provideStack() throws IOException {
-    var mvnCleanCmd = new String[] {mvnExecutable, "clean", "-f", manifest.toString()};
+    var mvnCleanCmd =
+        new String[] {mvnExecutable, "clean", "-f", manifest.toString(), "--batch-mode", "-q"};
     var mvnEnvs = getMvnExecEnvs();
     // execute the clean command
     Operations.runProcess(manifest.getParent(), mvnCleanCmd, mvnEnvs);
@@ -82,6 +83,8 @@ public Content provideStack() throws IOException {
             add(String.format("-DoutputFile=%s", tmpFile.toString()));
             add("-f");
             add(manifest.toString());
+            add("--batch-mode");
+            add("-q");
           }
         };
     // if we have dependencies marked as ignored, exclude them from the tree command
@@ -136,7 +139,9 @@ private Content generateSbomFromEffectivePom() throws IOException {
           "help:effective-pom",
           String.format("-Doutput=%s", tmpEffPom.toString()),
           "-f",
-          manifest.toString()
+          manifest.toString(),
+          "--batch-mode",
+          "-q"
         };
     // execute the effective pom command
     Operations.runProcess(manifest.getParent(), mvnEffPomCmd, getMvnExecEnvs());
@@ -372,13 +377,13 @@ public int hashCode() {
   private String selectMvnRuntime(final Path manifestPath) {
     boolean preferWrapper = Operations.getWrapperPreference(MVN);
     if (preferWrapper) {
-      String wrapperName = isWindows() ? "mvnw.cmd" : "mvnw";
+      String wrapperName = Operations.isWindows() ? "mvnw.cmd" : "mvnw";
       String mvnw = traverseForMvnw(wrapperName, manifestPath.toString());
       if (mvnw != null) {
         try {
           // verify maven wrapper is accessible
           Operations.runProcess(manifest.getParent(), mvnw, ARG_VERSION);
-          log.fine("using maven wrapper from : " + mvnw);
+          log.fine(String.format("using maven wrapper from : %s", mvnw));
           return mvnw;
         } catch (Exception e) {
           log.warning(
@@ -388,7 +393,7 @@ private String selectMvnRuntime(final Path manifestPath) {
     }
     // If maven wrapper is not requested or not accessible, fall back to use mvn
     String mvn = Operations.getExecutable(MVN, ARG_VERSION);
-    log.fine("using mvn executable from : " + mvn);
+    log.fine(String.format("using mvn executable from : %s", mvn));
     return mvn;
   }
 
@@ -423,13 +428,9 @@ public static String traverseForMvnw(
   public static String normalizePath(String thePath) {
     Path normalized = Paths.get(thePath).toAbsolutePath().normalize();
     String result = normalized.toString();
-    if (isWindows()) {
+    if (Operations.isWindows()) {
       result = result.toLowerCase();
     }
     return result;
   }
-
-  private static boolean isWindows() {
-    return System.getProperty("os.name").toLowerCase().contains("win");
-  }
 }

src/main/java/com/redhat/exhort/providers/JavaScriptNpmProvider.java

@@ -16,6 +16,7 @@
 package com.redhat.exhort.providers;
 
 import com.redhat.exhort.tools.Ecosystem;
+import com.redhat.exhort.tools.Operations;
 import java.nio.file.Path;
 
 /**
@@ -25,7 +26,7 @@
 public final class JavaScriptNpmProvider extends JavaScriptProvider {
 
   public static final String LOCK_FILE = "package-lock.json";
-  public static final String CMD_NAME = "npm";
+  public static final String CMD_NAME = Operations.isWindows() ? "npm.cmd" : "npm";
 
   public JavaScriptNpmProvider(Path manifest) {
     super(manifest, Ecosystem.Type.NPM, CMD_NAME);
@@ -38,25 +39,11 @@ protected String lockFileName() {
 
   @Override
   protected String[] updateLockFileCmd(Path manifestDir) {
-    return new String[] {
-      packageManager(), "i", "--package-lock-only", "--prefix", manifestDir.toString()
-    };
+    return new String[] {packageManager(), "i", "--package-lock-only"};
   }
 
   @Override
   protected String[] listDepsCmd(boolean includeTransitive, Path manifestDir) {
-    if (manifestDir != null) {
-      return new String[] {
-        packageManager(),
-        "ls",
-        includeTransitive ? "--all" : "--depth=0",
-        "--omit=dev",
-        "--package-lock-only",
-        "--json",
-        "--prefix",
-        manifestDir.toString()
-      };
-    }
     return new String[] {
       packageManager(),
       "ls",