Skip to content

Commit e1853f2

Browse files
committed
chore: update expectations and minor fixes
Signed-off-by: Ruben Romero Montes <rromerom@redhat.com>
1 parent 636f9a5 commit e1853f2

14 files changed

Lines changed: 375 additions & 157 deletions

File tree

.serena/.gitignore

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
/cache
2+
/project.local.yml
Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
# GoModulesProvider Architecture
2+
3+
## Dependency Resolution Flow
4+
1. `getDependenciesSbom(Path, boolean)` orchestrates: runs `go mod graph`, `go mod edit -json`, determines main module version
5+
2. `buildGoModulesDependencies(Path)` - runs `go mod graph` to get full dependency graph
6+
3. `getDirectDependencyPaths(Path)` - runs `go mod edit -json` to identify direct vs indirect deps
7+
4. For stack analysis: `buildSbomFromGraph` builds full dependency tree
8+
5. For component analysis: `buildSbomFromList` lists only direct dependencies
9+
10+
## Direct vs Indirect Filtering (TC-4300)
11+
- Since Go 1.17, `go mod tidy` adds all transitively-imported modules to go.mod with `// indirect` marker
12+
- `go mod graph` emits root-level edges for ALL modules in go.mod (both direct and indirect)
13+
- `go mod edit -json` returns structured JSON with `Require` array where each entry has optional `Indirect: true`
14+
- Both `buildSbomFromGraph` and `buildSbomFromList` filter root-level deps to only include direct ones
15+
16+
## Key Gotcha: MVS Version Suffix
17+
After MVS processing (`getFinalPackagesVersionsForModule`), the root key in the edges map changes from `module/path` to `module/path@v0.0.0`. The root comparison must use `getModulePath()` to strip the version suffix for both sides, otherwise the filtering silently does nothing when MVS is enabled.
18+
19+
## Helper Methods
20+
- `getModulePath(String)` - strips `@version` suffix from `go mod graph` entries (e.g., `github.com/foo/bar@v1.2.3` -> `github.com/foo/bar`)
21+
- `extractPackageName(String)` - strips `//` comment from go.mod require lines (different purpose, don't confuse)
22+
- `getParentVertex(String)` / `getChildVertex(String)` - split `go mod graph` edge lines on space
23+
- `isGoToolchainEntry(String)` - filters out `go@` and `toolchain@` entries
24+
25+
## Test Fixtures
26+
- `src/test/resources/tst_manifests/golang/` - main test fixtures with 6 test folders
27+
- `src/test/resources/msc/golang/mvs_logic/` - MVS-specific test fixtures
28+
- Tests use `dropIgnoredKeepFormat()` to strip timestamps and goarch/goos before comparison
29+
- Tests use `prettyJson()` (Jackson) to normalize JSON formatting
Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# exhort-java-api Project Overview
2+
3+
## Purpose
4+
Java client library for the Dependency Analytics (DA) / Exhort vulnerability analysis backend. Generates SBOMs (CycloneDX JSON) from project manifests and submits them for analysis.
5+
6+
## Tech Stack
7+
- Java 17+, Maven build
8+
- Jackson for JSON, TOML parsing (com.moandjiezana.toml)
9+
- XMLStreamReader for POM parsing
10+
- CycloneDX SBOM model (custom `Sbom` class)
11+
12+
## Key Directories
13+
- `src/main/java/io/github/guacsec/trustifyda/providers/` - Provider implementations per ecosystem
14+
- `src/main/java/io/github/guacsec/trustifyda/tools/` - Utilities (Operations, Ecosystem, Environment)
15+
- `src/main/java/io/github/guacsec/trustifyda/utils/` - Shared utilities (IgnorePatternDetector, PythonControllerBase)
16+
- `src/test/resources/tst_manifests/` - Test fixtures per ecosystem
17+
18+
## Provider Pattern
19+
Each ecosystem has a Provider class extending `Provider` abstract class with methods:
20+
- `provideStack()` - Full dependency tree SBOM
21+
- `provideComponent()` - Direct dependencies only SBOM
22+
- `readLicenseFromManifest()` - License extraction
23+
- `validateLockFile(Path)` - Lock file validation
24+
25+
## Ignore Pattern Detection
26+
Centralized in `IgnorePatternDetector` with constants `IGNORE_PATTERN` ("trustify-da-ignore") and `LEGACY_IGNORE_PATTERN` ("exhortignore").
27+
28+
## Commands
29+
- Build: `mvn clean install`
30+
- Test: `mvn test`
31+
- Format: `mvn spotless:apply`

.serena/project.yml

Lines changed: 152 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,152 @@
1+
# the name by which the project can be referenced within Serena
2+
project_name: "trustify-da-java-client"
3+
4+
5+
# list of languages for which language servers are started; choose from:
6+
# al bash clojure cpp csharp
7+
# csharp_omnisharp dart elixir elm erlang
8+
# fortran fsharp go groovy haskell
9+
# java julia kotlin lua markdown
10+
# matlab nix pascal perl php
11+
# php_phpactor powershell python python_jedi r
12+
# rego ruby ruby_solargraph rust scala
13+
# swift terraform toml typescript typescript_vts
14+
# vue yaml zig
15+
# (This list may be outdated. For the current list, see values of Language enum here:
16+
# https://github.com/oraios/serena/blob/main/src/solidlsp/ls_config.py
17+
# For some languages, there are alternative language servers, e.g. csharp_omnisharp, ruby_solargraph.)
18+
# Note:
19+
# - For C, use cpp
20+
# - For JavaScript, use typescript
21+
# - For Free Pascal/Lazarus, use pascal
22+
# Special requirements:
23+
# Some languages require additional setup/installations.
24+
# See here for details: https://oraios.github.io/serena/01-about/020_programming-languages.html#language-servers
25+
# When using multiple languages, the first language server that supports a given file will be used for that file.
26+
# The first language is the default language and the respective language server will be used as a fallback.
27+
# Note that when using the JetBrains backend, language servers are not used and this list is correspondingly ignored.
28+
languages:
29+
- java
30+
31+
# the encoding used by text files in the project
32+
# For a list of possible encodings, see https://docs.python.org/3.11/library/codecs.html#standard-encodings
33+
encoding: "utf-8"
34+
35+
# line ending convention to use when writing source files.
36+
# Possible values: unset (use global setting), "lf", "crlf", or "native" (platform default)
37+
# This does not affect Serena's own files (e.g. memories and configuration files), which always use native line endings.
38+
line_ending:
39+
40+
# The language backend to use for this project.
41+
# If not set, the global setting from serena_config.yml is used.
42+
# Valid values: LSP, JetBrains
43+
# Note: the backend is fixed at startup. If a project with a different backend
44+
# is activated post-init, an error will be returned.
45+
language_backend:
46+
47+
# whether to use project's .gitignore files to ignore files
48+
ignore_all_files_in_gitignore: true
49+
50+
# list of additional paths to ignore in this project.
51+
# Same syntax as gitignore, so you can use * and **.
52+
# Note: global ignored_paths from serena_config.yml are also applied additively.
53+
ignored_paths: []
54+
55+
# whether the project is in read-only mode
56+
# If set to true, all editing tools will be disabled and attempts to use them will result in an error
57+
# Added on 2025-04-18
58+
read_only: false
59+
60+
# list of tool names to exclude.
61+
# This extends the existing exclusions (e.g. from the global configuration)
62+
#
63+
# Below is the complete list of tools for convenience.
64+
# To make sure you have the latest list of tools, and to view their descriptions,
65+
# execute `uv run scripts/print_tool_overview.py`.
66+
#
67+
# * `activate_project`: Activates a project by name.
68+
# * `check_onboarding_performed`: Checks whether project onboarding was already performed.
69+
# * `create_text_file`: Creates/overwrites a file in the project directory.
70+
# * `delete_lines`: Deletes a range of lines within a file.
71+
# * `delete_memory`: Deletes a memory from Serena's project-specific memory store.
72+
# * `execute_shell_command`: Executes a shell command.
73+
# * `find_referencing_code_snippets`: Finds code snippets in which the symbol at the given location is referenced.
74+
# * `find_referencing_symbols`: Finds symbols that reference the symbol at the given location (optionally filtered by type).
75+
# * `find_symbol`: Performs a global (or local) search for symbols with/containing a given name/substring (optionally filtered by type).
76+
# * `get_current_config`: Prints the current configuration of the agent, including the active and available projects, tools, contexts, and modes.
77+
# * `get_symbols_overview`: Gets an overview of the top-level symbols defined in a given file.
78+
# * `initial_instructions`: Gets the initial instructions for the current project.
79+
# Should only be used in settings where the system prompt cannot be set,
80+
# e.g. in clients you have no control over, like Claude Desktop.
81+
# * `insert_after_symbol`: Inserts content after the end of the definition of a given symbol.
82+
# * `insert_at_line`: Inserts content at a given line in a file.
83+
# * `insert_before_symbol`: Inserts content before the beginning of the definition of a given symbol.
84+
# * `list_dir`: Lists files and directories in the given directory (optionally with recursion).
85+
# * `list_memories`: Lists memories in Serena's project-specific memory store.
86+
# * `onboarding`: Performs onboarding (identifying the project structure and essential tasks, e.g. for testing or building).
87+
# * `prepare_for_new_conversation`: Provides instructions for preparing for a new conversation (in order to continue with the necessary context).
88+
# * `read_file`: Reads a file within the project directory.
89+
# * `read_memory`: Reads the memory with the given name from Serena's project-specific memory store.
90+
# * `remove_project`: Removes a project from the Serena configuration.
91+
# * `replace_lines`: Replaces a range of lines within a file with new content.
92+
# * `replace_symbol_body`: Replaces the full definition of a symbol.
93+
# * `restart_language_server`: Restarts the language server, may be necessary when edits not through Serena happen.
94+
# * `search_for_pattern`: Performs a search for a pattern in the project.
95+
# * `summarize_changes`: Provides instructions for summarizing the changes made to the codebase.
96+
# * `switch_modes`: Activates modes by providing a list of their names
97+
# * `think_about_collected_information`: Thinking tool for pondering the completeness of collected information.
98+
# * `think_about_task_adherence`: Thinking tool for determining whether the agent is still on track with the current task.
99+
# * `think_about_whether_you_are_done`: Thinking tool for determining whether the task is truly completed.
100+
# * `write_memory`: Writes a named memory (for future reference) to Serena's project-specific memory store.
101+
excluded_tools: []
102+
103+
# list of tools to include that would otherwise be disabled (particularly optional tools that are disabled by default).
104+
# This extends the existing inclusions (e.g. from the global configuration).
105+
included_optional_tools: []
106+
107+
# fixed set of tools to use as the base tool set (if non-empty), replacing Serena's default set of tools.
108+
# This cannot be combined with non-empty excluded_tools or included_optional_tools.
109+
fixed_tools: []
110+
111+
# list of mode names to that are always to be included in the set of active modes
112+
# The full set of modes to be activated is base_modes + default_modes.
113+
# If the setting is undefined, the base_modes from the global configuration (serena_config.yml) apply.
114+
# Otherwise, this setting overrides the global configuration.
115+
# Set this to [] to disable base modes for this project.
116+
# Set this to a list of mode names to always include the respective modes for this project.
117+
base_modes:
118+
119+
# list of mode names that are to be activated by default.
120+
# The full set of modes to be activated is base_modes + default_modes.
121+
# If the setting is undefined, the default_modes from the global configuration (serena_config.yml) apply.
122+
# Otherwise, this overrides the setting from the global configuration (serena_config.yml).
123+
# This setting can, in turn, be overridden by CLI parameters (--mode).
124+
default_modes:
125+
126+
# initial prompt for the project. It will always be given to the LLM upon activating the project
127+
# (contrary to the memories, which are loaded on demand).
128+
initial_prompt: ""
129+
130+
# time budget (seconds) per tool call for the retrieval of additional symbol information
131+
# such as docstrings or parameter information.
132+
# This overrides the corresponding setting in the global configuration; see the documentation there.
133+
# If null or missing, use the setting from the global configuration.
134+
symbol_info_budget:
135+
136+
# list of regex patterns which, when matched, mark a memory entry as read‑only.
137+
# Extends the list from the global configuration, merging the two lists.
138+
read_only_memory_patterns: []
139+
140+
# list of regex patterns for memories to completely ignore.
141+
# Matching memories will not appear in list_memories or activate_project output
142+
# and cannot be accessed via read_memory or write_memory.
143+
# To access ignored memory files, use the read_file tool on the raw file path.
144+
# Extends the list from the global configuration, merging the two lists.
145+
# Example: ["_archive/.*", "_episodes/.*"]
146+
ignored_memory_patterns: []
147+
148+
# advanced configuration option allowing to configure language server-specific options.
149+
# Maps the language key to the options.
150+
# Have a look at the docstring of the constructors of the LS implementations within solidlsp (e.g., for C# or PHP) to see which options are available.
151+
# No documentation on options means no options are available.
152+
ls_specific_settings: {}

src/main/java/io/github/guacsec/trustifyda/providers/GoModulesProvider.java

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -466,13 +466,14 @@ private Set<String> getDirectDependencyPaths(Path manifestPath) {
466466
for (JsonNode req : requireArray) {
467467
JsonNode indirectNode = req.get("Indirect");
468468
if (indirectNode == null || !indirectNode.asBoolean()) {
469-
directDepPaths.add(req.get("Path").asText());
469+
if (req.get("Path") != null) {
470+
directDepPaths.add(req.get("Path").asText());
471+
}
470472
}
471473
}
472474
}
473475
} catch (JsonProcessingException e) {
474-
throw new IllegalStateException(
475-
"Failed to parse go mod edit -json output: " + e.getMessage(), e);
476+
throw new IllegalStateException("Failed to parse go mod edit -json output", e);
476477
}
477478
if (debugLoggingIsNeeded()) {
478479
log.info(String.format("Direct dependency paths from go mod edit -json: %s", directDepPaths));

src/main/java/io/github/guacsec/trustifyda/sbom/CycloneDXSbom.java

Lines changed: 29 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -16,12 +16,6 @@
1616
*/
1717
package io.github.guacsec.trustifyda.sbom;
1818

19-
import static io.github.guacsec.trustifyda.impl.ExhortApi.debugLoggingIsNeeded;
20-
21-
import com.github.packageurl.MalformedPackageURLException;
22-
import com.github.packageurl.PackageURL;
23-
import io.github.guacsec.trustifyda.logging.LoggersFactory;
24-
import io.github.guacsec.trustifyda.utils.Environment;
2519
import java.util.ArrayList;
2620
import java.util.Collection;
2721
import java.util.Collections;
@@ -33,6 +27,7 @@
3327
import java.util.function.Predicate;
3428
import java.util.logging.Logger;
3529
import java.util.stream.Collectors;
30+
3631
import org.cyclonedx.Version;
3732
import org.cyclonedx.exception.GeneratorException;
3833
import org.cyclonedx.generators.BomGeneratorFactory;
@@ -45,6 +40,16 @@
4540
import org.cyclonedx.model.Metadata;
4641
import org.cyclonedx.util.LicenseResolver;
4742

43+
import com.fasterxml.jackson.core.JsonProcessingException;
44+
import com.fasterxml.jackson.databind.ObjectMapper;
45+
import com.fasterxml.jackson.databind.node.ObjectNode;
46+
import com.github.packageurl.MalformedPackageURLException;
47+
import com.github.packageurl.PackageURL;
48+
49+
import static io.github.guacsec.trustifyda.impl.ExhortApi.debugLoggingIsNeeded;
50+
import io.github.guacsec.trustifyda.logging.LoggersFactory;
51+
import io.github.guacsec.trustifyda.utils.Environment;
52+
4853
public class CycloneDXSbom implements Sbom {
4954

5055
private static final String TRUSTIFY_DA_IGNORE_METHOD = "TRUSTIFY_DA_IGNORE_METHOD";
@@ -67,8 +72,8 @@ public CycloneDXSbom() {
6772
Metadata metadata = new Metadata();
6873
metadata.setTimestamp(new Date());
6974
bom.setMetadata(metadata);
70-
bom.setComponents(new ArrayList<>());
7175
bom.setDependencies(new ArrayList<>());
76+
bom.setComponents(new ArrayList<>());
7277
belongingCriteriaBinaryAlgorithm = getBelongingConditionByName();
7378
this.exhortIgnoreMethod = "insensitive";
7479
}
@@ -315,16 +320,26 @@ public String getAsJsonString() {
315320
}
316321
}
317322

318-
private String ensureComponentsField(String json) {
323+
private String ensureComponentsField(String json) throws GeneratorException {
319324
try {
320-
var mapper = new com.fasterxml.jackson.databind.ObjectMapper();
321-
var root = (com.fasterxml.jackson.databind.node.ObjectNode) mapper.readTree(json);
322-
if (!root.has("components")) {
323-
root.set("components", mapper.createArrayNode());
325+
var mapper = new ObjectMapper();
326+
var rootNode = (ObjectNode) mapper.readTree(json);
327+
if (!rootNode.has("components")) {
328+
var ordered = mapper.createObjectNode();
329+
rootNode
330+
.properties()
331+
.forEach(
332+
field -> {
333+
ordered.set(field.getKey(), field.getValue());
334+
if (field.getKey().equals("metadata")) {
335+
ordered.set("components", mapper.createArrayNode());
336+
}
337+
});
338+
return mapper.writerWithDefaultPrettyPrinter().writeValueAsString(ordered);
324339
}
325-
return mapper.writeValueAsString(root);
326-
} catch (Exception e) {
327340
return json;
341+
} catch (JsonProcessingException e) {
342+
throw new GeneratorException("Unable to ensure components field in JSON", e);
328343
}
329344
}
330345

Lines changed: 17 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,23 @@
11
{
2-
"bomFormat" : "CycloneDX",
3-
"specVersion" : "1.4",
4-
"version" : 1,
5-
"metadata" : {
6-
"timestamp" : "2025-04-09T12:15:45Z",
7-
"component" : {
8-
"type" : "application",
9-
"bom-ref" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
10-
"group" : "pom-with-deps-and-ignore",
11-
"name" : "pom-with-dependency-not-ignored-for-tests",
12-
"version" : "0.0.1",
13-
"purl" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1"
2+
"bomFormat": "CycloneDX",
3+
"specVersion": "1.4",
4+
"version": 1,
5+
"metadata": {
6+
"timestamp": "2025-04-09T12:15:45Z",
7+
"component": {
8+
"type": "application",
9+
"bom-ref": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
10+
"group": "pom-with-deps-and-ignore",
11+
"name": "pom-with-dependency-not-ignored-for-tests",
12+
"version": "0.0.1",
13+
"purl": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1"
1414
}
1515
},
16-
"dependencies" : [
16+
"components": [],
17+
"dependencies": [
1718
{
18-
"ref" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
19-
"dependsOn" : [ ]
19+
"ref": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
20+
"dependsOn": []
2021
}
2122
]
22-
}
23+
}
Lines changed: 15 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,18 @@
11
{
2-
"bomFormat" : "CycloneDX",
3-
"specVersion" : "1.4",
4-
"version" : 1,
5-
"metadata" : {
6-
"timestamp" : "2025-04-09T12:14:35Z",
7-
"component" : {
8-
"type" : "application",
9-
"bom-ref" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
10-
"group" : "pom-with-deps-and-ignore",
11-
"name" : "pom-with-dependency-not-ignored-for-tests",
12-
"version" : "0.0.1",
13-
"purl" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1"
2+
"bomFormat": "CycloneDX",
3+
"specVersion": "1.4",
4+
"version": 1,
5+
"metadata": {
6+
"timestamp": "2025-04-09T12:14:35Z",
7+
"component": {
8+
"type": "application",
9+
"bom-ref": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
10+
"group": "pom-with-deps-and-ignore",
11+
"name": "pom-with-dependency-not-ignored-for-tests",
12+
"version": "0.0.1",
13+
"purl": "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1"
1414
}
1515
},
16-
"dependencies" : [
17-
{
18-
"ref" : "pkg:maven/pom-with-deps-and-ignore/pom-with-dependency-not-ignored-for-tests@0.0.1",
19-
"dependsOn" : [ ]
20-
}
21-
]
22-
}
16+
"components": [],
17+
"dependencies": []
18+
}

0 commit comments

Comments
 (0)