From 9ca78c8133425445fd7e101f265bc9aff71e14ce Mon Sep 17 00:00:00 2001 From: Chao Wang Date: Fri, 21 Nov 2025 09:38:25 +0800 Subject: [PATCH 1/6] build: Upgrade trustify-da-api-spec 2.0.1 and trustify-da-java-client 0.0.9 --- build.gradle.kts | 23 ++----------------- gradle/libs.versions.toml | 8 +++---- .../componentanalysis/CAAnnotator.java | 2 +- .../componentanalysis/CAIntentionAction.java | 4 ++-- .../intellij/componentanalysis/CAService.java | 8 +++---- .../CAUpdateManifestIntentionAction.java | 4 ++-- .../golang/GoCAAnnotator.java | 2 +- .../golang/GoCAIntentionAction.java | 2 +- .../gradle/GradleCAAnnotator.java | 2 +- .../gradle/GradleCAIntentionAction.java | 2 +- ...GradleCAUpdateManifestIntentionAction.java | 2 +- .../maven/MavenCAAnnotator.java | 2 +- .../maven/MavenCAIntentionAction.java | 2 +- .../MavenCAUpdateManifestIntentionAction.java | 2 +- .../componentanalysis/npm/NpmCAAnnotator.java | 2 +- .../npm/NpmCAIntentionAction.java | 2 +- .../pypi/PipCAAnnotator.java | 2 +- .../pypi/PipCAIntentionAction.java | 2 +- .../tools/intellij/exhort/ApiService.java | 6 ++--- .../tools/intellij/image/ApiService.java | 8 +++---- .../intellij/image/DockerfileAnnotator.java | 13 +++++------ .../intellij/image/ImageCacheService.java | 4 ++-- .../tools/intellij/image/ImageService.java | 17 ++++++++++++-- 23 files changed, 57 insertions(+), 64 deletions(-) diff --git a/build.gradle.kts b/build.gradle.kts index 247b8abb..ce264462 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -12,11 +12,6 @@ plugins { group = "com.redhat.devtools.intellij" version = providers.gradleProperty("projectVersion").get() // Plugin version val platformVersion = providers.gradleProperty("ideaVersion").get() -val exhortRepoUser: String? = findProperty("gpr.username") as String? - ?: System.getenv("GITHUB_USERNAME") -val exhortRepoToken: String? = findProperty("gpr.token") as String? - ?: System.getenv("GITHUB_TOKEN") - // Set the JVM language level used to build the project. java { sourceCompatibility = JavaVersion.VERSION_17 @@ -32,20 +27,6 @@ repositories { defaultRepositories() } maven { url = uri("https://jitpack.io") } - maven { - url = uri("https://maven.pkg.github.com/trustification/exhort-java-api") - credentials { - username = exhortRepoUser - password = exhortRepoToken - } - } - maven { - url = uri("https://maven.pkg.github.com/guacsec/trustify-da-api-spec") - credentials { - username = exhortRepoUser - password = exhortRepoToken - } - } } sourceSets { @@ -80,8 +61,8 @@ dependencies { implementation(libs.github.api) implementation(libs.commons.compress) - implementation(libs.exhort.api.spec) - implementation(libs.exhort.java.api) + implementation(libs.trustify.da.api.spec) + implementation(libs.trustify.da.java.client) implementation(libs.caffeine) implementation(libs.packageurl.java) implementation(libs.commons.io) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 5e9d743f..7b6cee42 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -3,8 +3,8 @@ caffeine = "3.1.8" commons-compress = "1.21" commons-io = "2.16.1" -exhort-api-spec = "1.0.18" -exhort-java-api = "0.0.9-SNAPSHOT" +trustify-da-api-spec = "2.0.1" +trustify-da-java-client = "0.0.9" github-api = "1.314" junit = "4.13.2" mockito = "4.11.0" @@ -17,8 +17,8 @@ gradleIntelliJPlugin = "2.6.0" caffeine = { group = "com.github.ben-manes.caffeine", name = "caffeine", version.ref = "caffeine" } commons-compress = { group = "org.apache.commons", name = "commons-compress", version.ref = "commons-compress" } commons-io = { group = "commons-io", name = "commons-io", version.ref = "commons-io" } -exhort-api-spec = { group = "com.redhat.ecosystemappeng", name = "exhort-api-spec", version.ref = "exhort-api-spec" } -exhort-java-api = { group = "com.redhat.exhort", name = "exhort-java-api", version.ref = "exhort-java-api" } +trustify-da-api-spec = { group = "io.github.guacsec", name = "trustify-da-api-model", version.ref = "trustify-da-api-spec" } +trustify-da-java-client = { group = "io.github.guacsec", name = "trustify-da-java-client", version.ref = "trustify-da-java-client" } github-api = { group = "org.kohsuke", name = "github-api", version.ref = "github-api" } junit = { group = "junit", name = "junit", version.ref = "junit" } mockito = { group = "org.mockito", name = "mockito-core", version.ref = "mockito" } diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/CAAnnotator.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/CAAnnotator.java index 2eb844df..3dc05df1 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/CAAnnotator.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/CAAnnotator.java @@ -28,7 +28,7 @@ import com.intellij.psi.PsiElement; import com.intellij.psi.PsiFile; import com.intellij.serviceContainer.AlreadyDisposedException; -import com.redhat.exhort.api.v4.DependencyReport; +import io.github.guacsec.trustifyda.api.v5.DependencyReport; import org.jetbrains.annotations.NotNull; import org.jetbrains.annotations.Nullable; diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/CAIntentionAction.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/CAIntentionAction.java index 0adeb790..74a317ff 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/CAIntentionAction.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/CAIntentionAction.java @@ -21,8 +21,8 @@ import com.intellij.psi.PsiFile; import com.intellij.psi.util.PsiTreeUtil; import com.intellij.util.IncorrectOperationException; -import com.redhat.exhort.api.v4.DependencyReport; -import com.redhat.exhort.api.v4.Issue; +import io.github.guacsec.trustifyda.api.v5.DependencyReport; +import io.github.guacsec.trustifyda.api.v5.Issue; import org.jboss.tools.intellij.exhort.TelemetryService; import org.jetbrains.annotations.NotNull; import org.jetbrains.annotations.Nullable; diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/CAService.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/CAService.java index 5b5d3c59..8bdc9673 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/CAService.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/CAService.java @@ -23,10 +23,10 @@ import com.intellij.openapi.project.Project; import com.intellij.psi.PsiDocumentManager; import com.intellij.psi.PsiFile; -import com.redhat.exhort.api.v4.AnalysisReport; -import com.redhat.exhort.api.v4.DependencyReport; -import com.redhat.exhort.api.v4.ProviderReport; -import com.redhat.exhort.api.v4.Source; +import io.github.guacsec.trustifyda.api.v5.AnalysisReport; +import io.github.guacsec.trustifyda.api.v5.DependencyReport; +import io.github.guacsec.trustifyda.api.v5.ProviderReport; +import io.github.guacsec.trustifyda.api.v5.Source; import org.jboss.tools.intellij.exhort.ApiService; import java.util.Collections; diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/CAUpdateManifestIntentionAction.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/CAUpdateManifestIntentionAction.java index 3f1fbc25..cd6a4867 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/CAUpdateManifestIntentionAction.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/CAUpdateManifestIntentionAction.java @@ -19,8 +19,8 @@ import com.intellij.psi.PsiElement; import com.intellij.psi.PsiFile; import com.intellij.util.IncorrectOperationException; -import com.redhat.exhort.api.v4.DependencyReport; -import com.redhat.exhort.api.PackageRef; +import io.github.guacsec.trustifyda.api.PackageRef; +import io.github.guacsec.trustifyda.api.v5.DependencyReport; import org.jetbrains.annotations.NotNull; import java.util.Objects; diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/golang/GoCAAnnotator.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/golang/GoCAAnnotator.java index 6a637cd1..d287c4fd 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/golang/GoCAAnnotator.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/golang/GoCAAnnotator.java @@ -13,7 +13,7 @@ import com.intellij.psi.PsiElement; import com.intellij.psi.PsiFile; -import com.redhat.exhort.api.v4.DependencyReport; +import io.github.guacsec.trustifyda.api.v5.DependencyReport; import org.jboss.tools.intellij.componentanalysis.CAAnnotator; import org.jboss.tools.intellij.componentanalysis.CAIntentionAction; import org.jboss.tools.intellij.componentanalysis.CAUpdateManifestIntentionAction; diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/golang/GoCAIntentionAction.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/golang/GoCAIntentionAction.java index d1e0f669..c579bf23 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/golang/GoCAIntentionAction.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/golang/GoCAIntentionAction.java @@ -18,7 +18,7 @@ import com.intellij.psi.PsiDocumentManager; import com.intellij.psi.PsiElement; import com.intellij.psi.PsiFile; -import com.redhat.exhort.api.v4.DependencyReport; +import io.github.guacsec.trustifyda.api.v5.DependencyReport; import org.jboss.tools.intellij.componentanalysis.CAIntentionAction; import org.jboss.tools.intellij.componentanalysis.VulnerabilitySource; import org.jetbrains.annotations.NotNull; diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/gradle/GradleCAAnnotator.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/gradle/GradleCAAnnotator.java index 89cca0fd..29abcb33 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/gradle/GradleCAAnnotator.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/gradle/GradleCAAnnotator.java @@ -13,7 +13,7 @@ import com.intellij.psi.PsiElement; import com.intellij.psi.PsiFile; -import com.redhat.exhort.api.v4.DependencyReport; +import io.github.guacsec.trustifyda.api.v5.DependencyReport; import org.jboss.tools.intellij.componentanalysis.CAAnnotator; import org.jboss.tools.intellij.componentanalysis.CAIntentionAction; import org.jboss.tools.intellij.componentanalysis.CAUpdateManifestIntentionAction; diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/gradle/GradleCAIntentionAction.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/gradle/GradleCAIntentionAction.java index fd1f71ba..c37a0d6a 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/gradle/GradleCAIntentionAction.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/gradle/GradleCAIntentionAction.java @@ -17,7 +17,7 @@ import com.intellij.psi.PsiElement; import com.intellij.psi.PsiFile; import com.intellij.psi.PsiFileFactory; -import com.redhat.exhort.api.v4.DependencyReport; +import io.github.guacsec.trustifyda.api.v5.DependencyReport; import org.jboss.tools.intellij.componentanalysis.CAIntentionAction; import org.jboss.tools.intellij.componentanalysis.VulnerabilitySource; import org.jboss.tools.intellij.componentanalysis.gradle.build.filetype.BuildGradleFileType; diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/gradle/GradleCAUpdateManifestIntentionAction.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/gradle/GradleCAUpdateManifestIntentionAction.java index cf727989..b277c90e 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/gradle/GradleCAUpdateManifestIntentionAction.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/gradle/GradleCAUpdateManifestIntentionAction.java @@ -6,7 +6,7 @@ import com.intellij.psi.PsiFile; import com.intellij.psi.PsiFileFactory; import com.intellij.psi.impl.source.tree.LeafPsiElement; -import com.redhat.exhort.api.v4.DependencyReport; +import io.github.guacsec.trustifyda.api.v5.DependencyReport; import org.jboss.tools.intellij.componentanalysis.CAUpdateManifestIntentionAction; import org.jboss.tools.intellij.componentanalysis.gradle.build.filetype.BuildGradleFileType; import org.jboss.tools.intellij.componentanalysis.gradle.build.psi.BuildGradleFile; diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/maven/MavenCAAnnotator.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/maven/MavenCAAnnotator.java index 05e67e2d..0f8c0285 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/maven/MavenCAAnnotator.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/maven/MavenCAAnnotator.java @@ -17,7 +17,7 @@ import com.intellij.psi.xml.XmlDocument; import com.intellij.psi.xml.XmlTag; import com.intellij.psi.xml.XmlText; -import com.redhat.exhort.api.v4.DependencyReport; +import io.github.guacsec.trustifyda.api.v5.DependencyReport; import org.jboss.tools.intellij.componentanalysis.CAAnnotator; import org.jboss.tools.intellij.componentanalysis.CAIntentionAction; import org.jboss.tools.intellij.componentanalysis.CAUpdateManifestIntentionAction; diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/maven/MavenCAIntentionAction.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/maven/MavenCAIntentionAction.java index 61fcdecb..6fde6b58 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/maven/MavenCAIntentionAction.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/maven/MavenCAIntentionAction.java @@ -18,7 +18,7 @@ import com.intellij.psi.PsiFile; import com.intellij.psi.xml.XmlTag; import com.intellij.psi.xml.XmlText; -import com.redhat.exhort.api.v4.DependencyReport; +import io.github.guacsec.trustifyda.api.v5.DependencyReport; import org.jboss.tools.intellij.componentanalysis.CAIntentionAction; import org.jboss.tools.intellij.componentanalysis.VulnerabilitySource; import org.jetbrains.annotations.NotNull; diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/maven/MavenCAUpdateManifestIntentionAction.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/maven/MavenCAUpdateManifestIntentionAction.java index 6542bd88..95821f21 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/maven/MavenCAUpdateManifestIntentionAction.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/maven/MavenCAUpdateManifestIntentionAction.java @@ -8,7 +8,7 @@ import com.intellij.psi.xml.XmlDocument; import com.intellij.psi.xml.XmlTag; import com.intellij.psi.xml.XmlText; -import com.redhat.exhort.api.v4.DependencyReport; +import io.github.guacsec.trustifyda.api.v5.DependencyReport; import org.jboss.tools.intellij.componentanalysis.CAUpdateManifestIntentionAction; import org.jetbrains.annotations.NotNull; diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/npm/NpmCAAnnotator.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/npm/NpmCAAnnotator.java index 94516545..a9363f6f 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/npm/NpmCAAnnotator.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/npm/NpmCAAnnotator.java @@ -15,7 +15,7 @@ import com.intellij.json.psi.JsonStringLiteral; import com.intellij.psi.PsiElement; import com.intellij.psi.PsiFile; -import com.redhat.exhort.api.v4.DependencyReport; +import io.github.guacsec.trustifyda.api.v5.DependencyReport; import org.jboss.tools.intellij.componentanalysis.CAAnnotator; import org.jboss.tools.intellij.componentanalysis.CAIntentionAction; import org.jboss.tools.intellij.componentanalysis.CAUpdateManifestIntentionAction; diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/npm/NpmCAIntentionAction.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/npm/NpmCAIntentionAction.java index 4f0bd06e..8c46476d 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/npm/NpmCAIntentionAction.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/npm/NpmCAIntentionAction.java @@ -19,7 +19,7 @@ import com.intellij.openapi.project.Project; import com.intellij.psi.PsiElement; import com.intellij.psi.PsiFile; -import com.redhat.exhort.api.v4.DependencyReport; +import io.github.guacsec.trustifyda.api.v5.DependencyReport; import org.jboss.tools.intellij.componentanalysis.CAIntentionAction; import org.jboss.tools.intellij.componentanalysis.VulnerabilitySource; import org.jetbrains.annotations.NotNull; diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/pypi/PipCAAnnotator.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/pypi/PipCAAnnotator.java index 8b5724b3..3e411eb7 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/pypi/PipCAAnnotator.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/pypi/PipCAAnnotator.java @@ -13,7 +13,7 @@ import com.intellij.psi.PsiElement; import com.intellij.psi.PsiFile; -import com.redhat.exhort.api.v4.DependencyReport; +import io.github.guacsec.trustifyda.api.v5.DependencyReport; import org.jboss.tools.intellij.componentanalysis.CAAnnotator; import org.jboss.tools.intellij.componentanalysis.CAIntentionAction; import org.jboss.tools.intellij.componentanalysis.CAUpdateManifestIntentionAction; diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/pypi/PipCAIntentionAction.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/pypi/PipCAIntentionAction.java index b1293b6f..0cd83ee4 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/pypi/PipCAIntentionAction.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/pypi/PipCAIntentionAction.java @@ -17,7 +17,7 @@ import com.intellij.psi.PsiElement; import com.intellij.psi.PsiFile; import com.intellij.psi.PsiFileFactory; -import com.redhat.exhort.api.v4.DependencyReport; +import io.github.guacsec.trustifyda.api.v5.DependencyReport; import org.jboss.tools.intellij.componentanalysis.CAIntentionAction; import org.jboss.tools.intellij.componentanalysis.VulnerabilitySource; import org.jboss.tools.intellij.componentanalysis.pypi.requirements.filetype.RequirementsFileType; diff --git a/src/main/java/org/jboss/tools/intellij/exhort/ApiService.java b/src/main/java/org/jboss/tools/intellij/exhort/ApiService.java index 2b6085e3..c34bc7b4 100644 --- a/src/main/java/org/jboss/tools/intellij/exhort/ApiService.java +++ b/src/main/java/org/jboss/tools/intellij/exhort/ApiService.java @@ -19,9 +19,9 @@ import com.intellij.openapi.extensions.PluginId; import com.intellij.util.net.ProxyConfiguration; import com.intellij.util.net.ProxySettings; -import com.redhat.exhort.Api; -import com.redhat.exhort.api.v4.AnalysisReport; -import com.redhat.exhort.impl.ExhortApi; +import io.github.guacsec.trustifyda.Api; +import io.github.guacsec.trustifyda.api.v5.AnalysisReport; +import io.github.guacsec.trustifyda.impl.ExhortApi; import org.jboss.tools.intellij.settings.ApiSettingsState; import org.jboss.tools.intellij.settings.MavenSettingsUtil; diff --git a/src/main/java/org/jboss/tools/intellij/image/ApiService.java b/src/main/java/org/jboss/tools/intellij/image/ApiService.java index 06142beb..684ce736 100644 --- a/src/main/java/org/jboss/tools/intellij/image/ApiService.java +++ b/src/main/java/org/jboss/tools/intellij/image/ApiService.java @@ -18,10 +18,10 @@ import com.intellij.openapi.diagnostic.Logger; import com.intellij.openapi.extensions.PluginDescriptor; import com.intellij.openapi.extensions.PluginId; -import com.redhat.exhort.Api; -import com.redhat.exhort.api.v4.AnalysisReport; -import com.redhat.exhort.image.ImageRef; -import com.redhat.exhort.impl.ExhortApi; +import io.github.guacsec.trustifyda.Api; +import io.github.guacsec.trustifyda.api.v5.AnalysisReport; +import io.github.guacsec.trustifyda.image.ImageRef; +import io.github.guacsec.trustifyda.impl.ExhortApi; import org.jboss.tools.intellij.exhort.TelemetryService; import org.jboss.tools.intellij.settings.ApiSettingsState; diff --git a/src/main/java/org/jboss/tools/intellij/image/DockerfileAnnotator.java b/src/main/java/org/jboss/tools/intellij/image/DockerfileAnnotator.java index 19c90bb5..9d8bda80 100644 --- a/src/main/java/org/jboss/tools/intellij/image/DockerfileAnnotator.java +++ b/src/main/java/org/jboss/tools/intellij/image/DockerfileAnnotator.java @@ -24,14 +24,13 @@ import com.intellij.psi.PsiElement; import com.intellij.psi.PsiFile; import com.intellij.serviceContainer.AlreadyDisposedException; -import com.redhat.exhort.api.v4.AnalysisReport; -import com.redhat.exhort.api.v4.DependencyReport; -import com.redhat.exhort.api.v4.ProviderReport; -import com.redhat.exhort.api.v4.Severity; -import com.redhat.exhort.api.v4.Source; -import com.redhat.exhort.image.ImageRef; +import io.github.guacsec.trustifyda.api.v5.AnalysisReport; +import io.github.guacsec.trustifyda.api.v5.DependencyReport; +import io.github.guacsec.trustifyda.api.v5.ProviderReport; +import io.github.guacsec.trustifyda.api.v5.Severity; +import io.github.guacsec.trustifyda.api.v5.Source; +import io.github.guacsec.trustifyda.image.ImageRef; import org.jboss.tools.intellij.image.build.filetype.DockerfileFileType; -import org.jboss.tools.intellij.image.build.psi.*; import org.jetbrains.annotations.NotNull; import org.jetbrains.annotations.Nullable; diff --git a/src/main/java/org/jboss/tools/intellij/image/ImageCacheService.java b/src/main/java/org/jboss/tools/intellij/image/ImageCacheService.java index 22540925..d8ced2ab 100644 --- a/src/main/java/org/jboss/tools/intellij/image/ImageCacheService.java +++ b/src/main/java/org/jboss/tools/intellij/image/ImageCacheService.java @@ -15,8 +15,8 @@ import com.github.benmanes.caffeine.cache.Caffeine; import com.intellij.openapi.components.Service; import com.intellij.openapi.project.Project; -import com.redhat.exhort.api.v4.AnalysisReport; -import com.redhat.exhort.image.ImageRef; +import io.github.guacsec.trustifyda.api.v5.AnalysisReport; +import io.github.guacsec.trustifyda.image.ImageRef; import java.util.Collection; import java.util.List; diff --git a/src/main/java/org/jboss/tools/intellij/image/ImageService.java b/src/main/java/org/jboss/tools/intellij/image/ImageService.java index 20db6942..0506dd15 100644 --- a/src/main/java/org/jboss/tools/intellij/image/ImageService.java +++ b/src/main/java/org/jboss/tools/intellij/image/ImageService.java @@ -23,11 +23,24 @@ import com.intellij.psi.PsiFile; import com.intellij.psi.util.PsiTreeUtil; import org.jboss.tools.intellij.image.build.filetype.DockerfileFileType; -import org.jboss.tools.intellij.image.build.psi.*; +import org.jboss.tools.intellij.image.build.psi.DockerfileArgDeclaration; +import org.jboss.tools.intellij.image.build.psi.DockerfileArgInstruction; +import org.jboss.tools.intellij.image.build.psi.DockerfileAsClause; +import org.jboss.tools.intellij.image.build.psi.DockerfileFromInstruction; +import org.jboss.tools.intellij.image.build.psi.DockerfileImageName; +import org.jboss.tools.intellij.image.build.psi.DockerfilePlatformOption; +import org.jboss.tools.intellij.image.build.psi.DockerfilePlatformValue; import org.jboss.tools.intellij.report.AnalyticsReportUtils; import java.nio.file.Path; -import java.util.*; +import java.util.ArrayList; +import java.util.Collection; +import java.util.HashMap; +import java.util.HashSet; +import java.util.LinkedList; +import java.util.List; +import java.util.Map; +import java.util.Set; import java.util.regex.Pattern; import java.util.stream.Collectors; From d4eed0cda4065c74ff221c859f3da92991e64be5 Mon Sep 17 00:00:00 2001 From: Chao Wang Date: Fri, 21 Nov 2025 10:20:16 +0800 Subject: [PATCH 2/6] feat: update to trustify-da --- README.md | 42 ++++----- .../intellij/componentanalysis/CAUtil.java | 4 +- .../golang/GoCAAnnotator.java | 6 +- .../gradle/GradleCAAnnotator.java | 4 +- .../maven/MavenCAAnnotator.java | 4 +- .../pypi/PipCAAnnotator.java | 4 +- .../tools/intellij/exhort/ApiService.java | 90 +++++++++---------- .../intellij/exhort/TelemetryService.java | 2 +- .../tools/intellij/image/ApiService.java | 42 ++++----- src/main/resources/META-INF/plugin.xml | 32 +++---- 10 files changed, 115 insertions(+), 115 deletions(-) diff --git a/README.md b/README.md index 8da4f5c4..768bbf0f 100644 --- a/README.md +++ b/README.md @@ -180,16 +180,16 @@ according to your preferences. You can specify a specific path to these binaries, and others by settings the following parameters as environment variables or system properties: - * `EXHORT_SYFT_PATH` : Specify the absolute path of `syft` executable. - * `EXHORT_SYFT_CONFIG_PATH` : Specify the absolute path to the Syft configuration file. - * `EXHORT_SKOPEO_PATH` : Specify the absolute path of `skopeo` executable. - * `EXHORT_SKOPEO_CONFIG_PATH` : Specify the absolute path to the authentication file used by the `skopeo inspect` + * `TRUSTIFY_DA_SYFT_PATH` : Specify the absolute path of `syft` executable. + * `TRUSTIFY_DA_SYFT_CONFIG_PATH` : Specify the absolute path to the Syft configuration file. + * `TRUSTIFY_DA_SKOPEO_PATH` : Specify the absolute path of `skopeo` executable. + * `TRUSTIFY_DA_SKOPEO_CONFIG_PATH` : Specify the absolute path to the authentication file used by the `skopeo inspect` command. - * `EXHORT_DOCKER_PATH` : Specify the absolute path of `docker` executable. - * `EXHORT_PODMAN_PATH` : Specify the absolute path of `podman` executable. - * `EXHORT_IMAGE_PLATFORM` : Specify the platform used for multi-arch images. - * `EXHORT_MVN_USER_SETTINGS` : Specify the absolute path to the Maven user settings file. - * `EXHORT_MVN_LOCAL_REPO` : Specify the absolute path to the Maven local repository. + * `TRUSTIFY_DA_DOCKER_PATH` : Specify the absolute path of `docker` executable. + * `TRUSTIFY_DA_PODMAN_PATH` : Specify the absolute path of `podman` executable. + * `TRUSTIFY_DA_IMAGE_PLATFORM` : Specify the platform used for multi-arch images. + * `TRUSTIFY_DA_MVN_USER_SETTINGS` : Specify the absolute path to the Maven user settings file. + * `TRUSTIFY_DA_MVN_LOCAL_REPO` : Specify the absolute path to the Maven local repository. ![ Animated screenshot showing the inline reporting feature of Image Analysis ](src/main/resources/images/image-analysis.gif) @@ -239,20 +239,20 @@ When modifying the grammar or lexer files, you need to regenerate the parser cla - Comments and complex shell commands - Comprehensive syntax error handling -- **Excluding dependencies with `exhortignore`** +- **Excluding dependencies with `trustify-da-ignore`**
You can exclude a package from analysis by marking the package for exclusion. - If you want to ignore vulnerabilities for a dependency in a `pom.xml` file, you must add `exhortignore` as a comment + If you want to ignore vulnerabilities for a dependency in a `pom.xml` file, you must add `trustify-da-ignore` as a comment against the dependency, group id, artifact id, or version scopes of that particular dependency in the manifest file. For example: ```xml - + ... ... ... ``` - If you want to ignore vulnerabilities for a dependency in a `package.json` file, you must add `exhortignore` as a + If you want to ignore vulnerabilities for a dependency in a `package.json` file, you must add `trustify-da-ignore` as a attribute-value pair. For example: ```json @@ -270,33 +270,33 @@ When modifying the grammar or lexer files, you need to regenerate the parser cla "jsonwebtoken": "^8.5.1", "mongoose": "^5.9.18" }, - "exhortignore": [ + "trustify-da-ignore": [ "jsonwebtoken" ] } ``` - If you want to ignore vulnerabilities for a dependency in a `go.mod` file, you must add `exhortignore` as a comment + If you want to ignore vulnerabilities for a dependency in a `go.mod` file, you must add `trustify-da-ignore` as a comment against the dependency in the manifest file. For example: ```text require ( - golang.org/x/sys v1.6.7 // exhortignore + golang.org/x/sys v1.6.7 // trustify-da-ignore ) ``` - If you want to ignore vulnerabilities for a dependency in a `requirements.txt` file, you must add `exhortignore` as a + If you want to ignore vulnerabilities for a dependency in a `requirements.txt` file, you must add `trustify-da-ignore` as a comment against the dependency in the manifest file. For example: ```text - requests==2.28.1 # exhortignore + requests==2.28.1 # trustify-da-ignore ``` - If you want to ignore vulnerabilities for a dependency in a `build.gradle` file, you must add `exhortignore` as a + If you want to ignore vulnerabilities for a dependency in a `build.gradle` file, you must add `trustify-da-ignore` as a comment against the dependency in the manifest file. For example: ```text - implementation "log4j:log4j:1.2.17" // exhortignore - implementation group: 'log4j', name: 'log4j', version: '1.2.17' // exhortignore + implementation "log4j:log4j:1.2.17" // trustify-da-ignore + implementation group: 'log4j', name: 'log4j', version: '1.2.17' // trustify-da-ignore ``` - **Excluding developmental or test dependencies** diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/CAUtil.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/CAUtil.java index 904ce3a0..9571793a 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/CAUtil.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/CAUtil.java @@ -32,7 +32,7 @@ public class CAUtil { public static String PACKAGE_JSON = "package.json"; - public static String EXHORT_IGNORE = "exhortignore"; + public static String TRUSTIFY_DA_IGNORE = "trustify-da-ignore"; public static String DEPENDENCIES = "dependencies"; public static Map> getDependencyListMap(PsiFile file) { @@ -77,7 +77,7 @@ private static Set getIgnoredDependencies(PsiFile file) { Set ignored = Arrays.stream(file.getChildren()) .filter(e -> e instanceof JsonObject) .flatMap(e -> Arrays.stream(e.getChildren())) - .filter(e -> e instanceof JsonProperty && EXHORT_IGNORE.equals(((JsonProperty) e).getName())) + .filter(e -> e instanceof JsonProperty && TRUSTIFY_DA_IGNORE.equals(((JsonProperty) e).getName())) .flatMap(e -> Arrays.stream(e.getChildren())) .filter(e -> e instanceof JsonArray) .flatMap(e -> Arrays.stream(e.getChildren())) diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/golang/GoCAAnnotator.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/golang/GoCAAnnotator.java index d287c4fd..d9c402f6 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/golang/GoCAAnnotator.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/golang/GoCAAnnotator.java @@ -28,7 +28,7 @@ import java.util.regex.Matcher; import java.util.regex.Pattern; -import static org.jboss.tools.intellij.componentanalysis.CAUtil.EXHORT_IGNORE; +import static org.jboss.tools.intellij.componentanalysis.CAUtil.TRUSTIFY_DA_IGNORE; public class GoCAAnnotator extends CAAnnotator { public static final Pattern REQUIRE_PATTERN = Pattern.compile("^\\s*([a-zA-Z0-9._/-]+)\\s+(v?[0-9]+(?:\\.[0-9]+)*[0-9a-zA-Z\\-+._]*)(?:\\s*//.*)?$"); @@ -69,8 +69,8 @@ protected Map> getDependencies(PsiFile file) { continue; } - // Skip if line contains exhortignore - if (line.contains(EXHORT_IGNORE)) { + // Skip if line contains trustify-da-ignore + if (line.contains(TRUSTIFY_DA_IGNORE)) { continue; } diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/gradle/GradleCAAnnotator.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/gradle/GradleCAAnnotator.java index 29abcb33..d5c3143c 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/gradle/GradleCAAnnotator.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/gradle/GradleCAAnnotator.java @@ -29,7 +29,7 @@ import java.util.Map; import java.util.Objects; -import static org.jboss.tools.intellij.componentanalysis.CAUtil.EXHORT_IGNORE; +import static org.jboss.tools.intellij.componentanalysis.CAUtil.TRUSTIFY_DA_IGNORE; public class GradleCAAnnotator extends CAAnnotator { @@ -44,7 +44,7 @@ protected Map> getDependencies(PsiFile file) { Map> resultMap = new HashMap<>(); Arrays.stream(file.getChildren()) .filter(e -> e instanceof Artifact) - .filter(artifact -> ((Artifact)artifact).getComment() == null || Objects.nonNull(((Artifact)artifact).getComment()) && !((Artifact)artifact).getComment().getText().contains(EXHORT_IGNORE)) + .filter(artifact -> ((Artifact)artifact).getComment() == null || Objects.nonNull(((Artifact)artifact).getComment()) && !((Artifact)artifact).getComment().getText().contains(TRUSTIFY_DA_IGNORE)) .map(dep -> (Artifact)dep) .forEach( dep -> { Dependency dependency = new Dependency("maven", dep.getGroup().getText().replace("\"","") , dep.getArtifactId().getText(),dep.getVersion().getText()); diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/maven/MavenCAAnnotator.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/maven/MavenCAAnnotator.java index 0f8c0285..2c5ac4fa 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/maven/MavenCAAnnotator.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/maven/MavenCAAnnotator.java @@ -34,7 +34,7 @@ import java.util.Optional; import static org.jboss.tools.intellij.componentanalysis.CAUtil.DEPENDENCIES; -import static org.jboss.tools.intellij.componentanalysis.CAUtil.EXHORT_IGNORE; +import static org.jboss.tools.intellij.componentanalysis.CAUtil.TRUSTIFY_DA_IGNORE; public class MavenCAAnnotator extends CAAnnotator { @@ -58,7 +58,7 @@ protected Map> getDependencies(PsiFile file) { .filter(e -> e instanceof XmlTag && "dependency".equals(((XmlTag) e).getName())) .filter(e -> Arrays.stream(e.getChildren()) .noneMatch(c -> c instanceof XmlComment - && EXHORT_IGNORE.equals(((XmlComment) c).getCommentText().trim()))) + && TRUSTIFY_DA_IGNORE.equals(((XmlComment) c).getCommentText().trim()))) .map(e -> (XmlTag) e) .forEach(d -> { List elements = Arrays.stream(d.getChildren()) diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/pypi/PipCAAnnotator.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/pypi/PipCAAnnotator.java index 3e411eb7..73c4efbd 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/pypi/PipCAAnnotator.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/pypi/PipCAAnnotator.java @@ -29,7 +29,7 @@ import java.util.List; import java.util.Map; -import static org.jboss.tools.intellij.componentanalysis.CAUtil.EXHORT_IGNORE; +import static org.jboss.tools.intellij.componentanalysis.CAUtil.TRUSTIFY_DA_IGNORE; public class PipCAAnnotator extends CAAnnotator { @Override @@ -50,7 +50,7 @@ protected Map> getDependencies(PsiFile file) { .noneMatch(c -> { String comment = c.getText().trim(); if (!comment.isEmpty() && '#' == comment.charAt(0)) { - return EXHORT_IGNORE.equals(comment.substring(1).trim()); + return TRUSTIFY_DA_IGNORE.equals(comment.substring(1).trim()); } return false; })) diff --git a/src/main/java/org/jboss/tools/intellij/exhort/ApiService.java b/src/main/java/org/jboss/tools/intellij/exhort/ApiService.java index c34bc7b4..f3b79319 100644 --- a/src/main/java/org/jboss/tools/intellij/exhort/ApiService.java +++ b/src/main/java/org/jboss/tools/intellij/exhort/ApiService.java @@ -40,7 +40,7 @@ public final class ApiService { private static final Logger LOG = Logger.getInstance(ApiService.class); enum TelemetryKeys { - MANIFEST, ECOSYSTEM, PLATFORM, RHDA_TOKEN; + MANIFEST, ECOSYSTEM, PLATFORM, TRUST_DA_TOKEN; @Override public String toString() { @@ -63,7 +63,7 @@ public Path getStackAnalysis(final String packageManager, final String manifestN telemetryMsg.property(TelemetryKeys.ECOSYSTEM.toString(), packageManager); telemetryMsg.property(TelemetryKeys.PLATFORM.toString(), System.getProperty("os.name")); telemetryMsg.property(TelemetryKeys.MANIFEST.toString(), manifestName); - telemetryMsg.property(TelemetryKeys.RHDA_TOKEN.toString(), ApiSettingsState.getInstance().rhdaToken); + telemetryMsg.property(TelemetryKeys.TRUST_DA_TOKEN.toString(), ApiSettingsState.getInstance().rhdaToken); try { setRequestProperties(manifestName); @@ -86,7 +86,7 @@ public AnalysisReport getComponentAnalysis(final String packageManager, final St telemetryMsg.property(TelemetryKeys.ECOSYSTEM.toString(), packageManager); telemetryMsg.property(TelemetryKeys.PLATFORM.toString(), System.getProperty("os.name")); telemetryMsg.property(TelemetryKeys.MANIFEST.toString(), manifestName); - telemetryMsg.property(TelemetryKeys.RHDA_TOKEN.toString(), ApiSettingsState.getInstance().rhdaToken); + telemetryMsg.property(TelemetryKeys.TRUST_DA_TOKEN.toString(), ApiSettingsState.getInstance().rhdaToken); try { setRequestProperties(manifestName); @@ -121,50 +121,50 @@ private void setRequestProperties(final String manifestName) { PluginDescriptor pluginDescriptor = PluginManagerCore.getPlugin(PluginId.getId("org.jboss.tools.intellij.analytics")); if (pluginDescriptor != null) { String pluginName = pluginDescriptor.getName() + " " + pluginDescriptor.getVersion(); - System.setProperty("RHDA_SOURCE", ideName + " / " + pluginName); + System.setProperty("TRUST_DA_SOURCE", ideName + " / " + pluginName); } else { - System.setProperty("RHDA_SOURCE", ideName); + System.setProperty("TRUST_DA_SOURCE", ideName); } ApiSettingsState settings = ApiSettingsState.getInstance(); - System.setProperty("RHDA_TOKEN", settings.rhdaToken); + System.setProperty("TRUST_DA_TOKEN", settings.rhdaToken); if (settings.mvnPath != null && !settings.mvnPath.isBlank()) { - System.setProperty("EXHORT_MVN_PATH", settings.mvnPath); + System.setProperty("TRUSTIFY_DA_MVN_PATH", settings.mvnPath); } else { - System.clearProperty("EXHORT_MVN_PATH"); + System.clearProperty("TRUSTIFY_DA_MVN_PATH"); } if (settings.useMavenWrapper.equals("fallback")) { if (MavenSettingsUtil.isMavenWrapperSelected()) { - System.setProperty("EXHORT_PREFER_MVNW", settings.useMavenWrapper); + System.setProperty("TRUSTIFY_DA_PREFER_MVNW", settings.useMavenWrapper); } else { - System.clearProperty("EXHORT_PREFER_MVNW"); + System.clearProperty("TRUSTIFY_DA_PREFER_MVNW"); } } else if (settings.useMavenWrapper.equals("true")) { - System.setProperty("EXHORT_PREFER_MVNW", settings.useMavenWrapper); + System.setProperty("TRUSTIFY_DA_PREFER_MVNW", settings.useMavenWrapper); } else { - System.clearProperty("EXHORT_PREFER_MVNW"); + System.clearProperty("TRUSTIFY_DA_PREFER_MVNW"); } String userSettingsFile = MavenSettingsUtil.getUserSettingsFile(); if (!userSettingsFile.isBlank()) { - System.setProperty("EXHORT_MVN_USER_SETTINGS", userSettingsFile); + System.setProperty("TRUSTIFY_DA_MVN_USER_SETTINGS", userSettingsFile); } else { - System.clearProperty("EXHORT_MVN_USER_SETTINGS"); + System.clearProperty("TRUSTIFY_DA_MVN_USER_SETTINGS"); } String localRepository = MavenSettingsUtil.getLocalRepository(); if (!localRepository.isBlank()) { - System.setProperty("EXHORT_MVN_LOCAL_REPO", localRepository); + System.setProperty("TRUSTIFY_DA_MVN_LOCAL_REPO", localRepository); } else { - System.clearProperty("EXHORT_MVN_LOCAL_REPO"); + System.clearProperty("TRUSTIFY_DA_MVN_LOCAL_REPO"); } if (settings.gradlePath != null && !settings.gradlePath.isBlank()) { - System.setProperty("EXHORT_GRADLE_PATH", settings.gradlePath); + System.setProperty("TRUSTIFY_DA_GRADLE_PATH", settings.gradlePath); } else { - System.clearProperty("EXHORT_GRADLE_PATH"); + System.clearProperty("TRUSTIFY_DA_GRADLE_PATH"); } if (settings.javaPath != null && !settings.javaPath.isBlank()) { @@ -173,14 +173,14 @@ private void setRequestProperties(final String manifestName) { System.clearProperty("JAVA_HOME"); } if (settings.npmPath != null && !settings.npmPath.isBlank()) { - System.setProperty("EXHORT_NPM_PATH", settings.npmPath); + System.setProperty("TRUSTIFY_DA_NPM_PATH", settings.npmPath); } else { - System.clearProperty("EXHORT_NPM_PATH"); + System.clearProperty("TRUSTIFY_DA_NPM_PATH"); } if (settings.yarnPath != null && !settings.yarnPath.isBlank()) { - System.setProperty("EXHORT_YARN_PATH", settings.yarnPath); + System.setProperty("TRUSTIFY_DA_YARN_PATH", settings.yarnPath); } else { - System.clearProperty("EXHORT_YARN_PATH"); + System.clearProperty("TRUSTIFY_DA_YARN_PATH"); } if (settings.nodePath != null && !settings.nodePath.isBlank()) { System.setProperty("NODE_HOME", settings.nodePath); @@ -188,14 +188,14 @@ private void setRequestProperties(final String manifestName) { System.clearProperty("NODE_HOME"); } if (settings.pnpmPath != null && !settings.pnpmPath.isBlank()) { - System.setProperty("EXHORT_PNPM_PATH", settings.pnpmPath); + System.setProperty("TRUSTIFY_DA_PNPM_PATH", settings.pnpmPath); } else { - System.clearProperty("EXHORT_PNPM_PATH"); + System.clearProperty("TRUSTIFY_DA_PNPM_PATH"); } if (settings.goPath != null && !settings.goPath.isBlank()) { - System.setProperty("EXHORT_GO_PATH", settings.goPath); + System.setProperty("TRUSTIFY_DA_GO_PATH", settings.goPath); } else { - System.clearProperty("EXHORT_GO_PATH"); + System.clearProperty("TRUSTIFY_DA_GO_PATH"); } if ("go.mod".equals(manifestName)) { if (settings.goMatchManifestVersions) { @@ -206,41 +206,41 @@ private void setRequestProperties(final String manifestName) { } if (settings.usePython2) { if (settings.pythonPath != null && !settings.pythonPath.isBlank()) { - System.setProperty("EXHORT_PYTHON_PATH", settings.pythonPath); + System.setProperty("TRUSTIFY_DA_PYTHON_PATH", settings.pythonPath); } else { - System.clearProperty("EXHORT_PYTHON_PATH"); + System.clearProperty("TRUSTIFY_DA_PYTHON_PATH"); } if (settings.pipPath != null && !settings.pipPath.isBlank()) { - System.setProperty("EXHORT_PIP_PATH", settings.pipPath); + System.setProperty("TRUSTIFY_DA_PIP_PATH", settings.pipPath); } else { - System.clearProperty("EXHORT_PIP_PATH"); + System.clearProperty("TRUSTIFY_DA_PIP_PATH"); } - System.clearProperty("EXHORT_PYTHON3_PATH"); - System.clearProperty("EXHORT_PIP3_PATH"); + System.clearProperty("TRUSTIFY_DA_PYTHON3_PATH"); + System.clearProperty("TRUSTIFY_DA_PIP3_PATH"); } else { if (settings.pythonPath != null && !settings.pythonPath.isBlank()) { - System.setProperty("EXHORT_PYTHON3_PATH", settings.pythonPath); + System.setProperty("TRUSTIFY_DA_PYTHON3_PATH", settings.pythonPath); } else { - System.clearProperty("EXHORT_PYTHON3_PATH"); + System.clearProperty("TRUSTIFY_DA_PYTHON3_PATH"); } if (settings.pipPath != null && !settings.pipPath.isBlank()) { - System.setProperty("EXHORT_PIP3_PATH", settings.pipPath); + System.setProperty("TRUSTIFY_DA_PIP3_PATH", settings.pipPath); } else { - System.clearProperty("EXHORT_PIP3_PATH"); + System.clearProperty("TRUSTIFY_DA_PIP3_PATH"); } - System.clearProperty("EXHORT_PYTHON_PATH"); - System.clearProperty("EXHORT_PIP_PATH"); + System.clearProperty("TRUSTIFY_DA_PYTHON_PATH"); + System.clearProperty("TRUSTIFY_DA_PIP_PATH"); } if (settings.usePythonVirtualEnv) { - System.setProperty("EXHORT_PYTHON_VIRTUAL_ENV", "true"); + System.setProperty("TRUSTIFY_DA_PYTHON_VIRTUAL_ENV", "true"); if (settings.pythonInstallBestEfforts) { - System.setProperty("EXHORT_PYTHON_INSTALL_BEST_EFFORTS", "true"); + System.setProperty("TRUSTIFY_DA_PYTHON_INSTALL_BEST_EFFORTS", "true"); } else { - System.clearProperty("EXHORT_PYTHON_INSTALL_BEST_EFFORTS"); + System.clearProperty("TRUSTIFY_DA_PYTHON_INSTALL_BEST_EFFORTS"); } } else { - System.clearProperty("EXHORT_PYTHON_VIRTUAL_ENV"); - System.clearProperty("EXHORT_PYTHON_INSTALL_BEST_EFFORTS"); + System.clearProperty("TRUSTIFY_DA_PYTHON_VIRTUAL_ENV"); + System.clearProperty("TRUSTIFY_DA_PYTHON_INSTALL_BEST_EFFORTS"); } if ("requirements.txt".equals(manifestName)) { if (settings.pythonMatchManifestVersions) { @@ -254,9 +254,9 @@ private void setRequestProperties(final String manifestName) { } Optional proxyUrlOpt = getProxyUrl(); if (proxyUrlOpt.isPresent()) { - System.setProperty("EXHORT_PROXY_URL", proxyUrlOpt.get()); + System.setProperty("TRUSTIFY_DA_PROXY_URL", proxyUrlOpt.get()); } else { - System.clearProperty("EXHORT_PROXY_URL"); + System.clearProperty("TRUSTIFY_DA_PROXY_URL"); } } diff --git a/src/main/java/org/jboss/tools/intellij/exhort/TelemetryService.java b/src/main/java/org/jboss/tools/intellij/exhort/TelemetryService.java index 5614f350..914905d1 100644 --- a/src/main/java/org/jboss/tools/intellij/exhort/TelemetryService.java +++ b/src/main/java/org/jboss/tools/intellij/exhort/TelemetryService.java @@ -32,7 +32,7 @@ public static void sendPackageUpdateEvent(PsiFile file, String recommendedVersio telemetryMsg.property(ApiService.TelemetryKeys.ECOSYSTEM.toString(), CAAnnotator.getPackageManager(file.getName())); telemetryMsg.property(ApiService.TelemetryKeys.PLATFORM.toString(), System.getProperty("os.name")); telemetryMsg.property(ApiService.TelemetryKeys.MANIFEST.toString(), file.getName()); - telemetryMsg.property(ApiService.TelemetryKeys.RHDA_TOKEN.toString(), ApiSettingsState.getInstance().rhdaToken); + telemetryMsg.property(ApiService.TelemetryKeys.TRUST_DA_TOKEN.toString(), ApiSettingsState.getInstance().rhdaToken); telemetryMsg.send(); } diff --git a/src/main/java/org/jboss/tools/intellij/image/ApiService.java b/src/main/java/org/jboss/tools/intellij/image/ApiService.java index 684ce736..78814417 100644 --- a/src/main/java/org/jboss/tools/intellij/image/ApiService.java +++ b/src/main/java/org/jboss/tools/intellij/image/ApiService.java @@ -67,7 +67,7 @@ Map getImageAnalysis(final Set imageRefs) { telemetryMsg.property("ecosystem", "image"); telemetryMsg.property("platform", System.getProperty("os.name")); telemetryMsg.property("images", String.join(";", imageRefs.toString())); - telemetryMsg.property("rhda_token", ApiSettingsState.getInstance().rhdaToken); + telemetryMsg.property("trust_da_token", ApiSettingsState.getInstance().rhdaToken); try { setServiceEnvironment(); @@ -96,7 +96,7 @@ Path getImageAnalysisReport(final Set imageRefs) { telemetryMsg.property("ecosystem", "image"); telemetryMsg.property("platform", System.getProperty("os.name")); telemetryMsg.property("images", String.join(";", imageRefs.toString())); - telemetryMsg.property("rhda_token", ApiSettingsState.getInstance().rhdaToken); + telemetryMsg.property("trust_da_token", ApiSettingsState.getInstance().rhdaToken); try { setServiceEnvironment(); @@ -117,61 +117,61 @@ private void setServiceEnvironment() { PluginDescriptor pluginDescriptor = PluginManagerCore.getPlugin(PluginId.getId("org.jboss.tools.intellij.analytics")); if (pluginDescriptor != null) { var pluginName = pluginDescriptor.getName() + " " + pluginDescriptor.getVersion(); - System.setProperty("RHDA_SOURCE", ideName + " / " + pluginName); + System.setProperty("TRUST_DA_SOURCE", ideName + " / " + pluginName); } else { - System.setProperty("RHDA_SOURCE", ideName); + System.setProperty("TRUST_DA_SOURCE", ideName); } var settings = ApiSettingsState.getInstance(); - System.setProperty("RHDA_TOKEN", settings.rhdaToken); + System.setProperty("TRUST_DA_TOKEN", settings.rhdaToken); if (settings.syftPath != null && !settings.syftPath.isBlank()) { - System.setProperty("EXHORT_SYFT_PATH", settings.syftPath); + System.setProperty("TRUSTIFY_DA_SYFT_PATH", settings.syftPath); } else { - System.clearProperty("EXHORT_SYFT_PATH"); + System.clearProperty("TRUSTIFY_DA_SYFT_PATH"); } if (settings.syftConfigPath != null && !settings.syftConfigPath.isBlank()) { - System.setProperty("EXHORT_SYFT_CONFIG_PATH", settings.syftConfigPath); + System.setProperty("TRUSTIFY_DA_SYFT_CONFIG_PATH", settings.syftConfigPath); } else { - System.clearProperty("EXHORT_SYFT_CONFIG_PATH"); + System.clearProperty("TRUSTIFY_DA_SYFT_CONFIG_PATH"); } if (settings.skopeoPath != null && !settings.skopeoPath.isBlank()) { - System.setProperty("EXHORT_SKOPEO_PATH", settings.skopeoPath); + System.setProperty("TRUSTIFY_DA_SKOPEO_PATH", settings.skopeoPath); } else { - System.clearProperty("EXHORT_SKOPEO_PATH"); + System.clearProperty("TRUSTIFY_DA_SKOPEO_PATH"); } if (settings.skopeoConfigPath != null && !settings.skopeoConfigPath.isBlank()) { - System.setProperty("EXHORT_SKOPEO_CONFIG_PATH", settings.skopeoConfigPath); + System.setProperty("TRUSTIFY_DA_SKOPEO_CONFIG_PATH", settings.skopeoConfigPath); } else { - System.clearProperty("EXHORT_SKOPEO_CONFIG_PATH"); + System.clearProperty("TRUSTIFY_DA_SKOPEO_CONFIG_PATH"); } if (settings.dockerPath != null && !settings.dockerPath.isBlank()) { - System.setProperty("EXHORT_DOCKER_PATH", settings.dockerPath); + System.setProperty("TRUSTIFY_DA_DOCKER_PATH", settings.dockerPath); } else { - System.clearProperty("EXHORT_DOCKER_PATH"); + System.clearProperty("TRUSTIFY_DA_DOCKER_PATH"); } if (settings.podmanPath != null && !settings.podmanPath.isBlank()) { - System.setProperty("EXHORT_PODMAN_PATH", settings.podmanPath); + System.setProperty("TRUSTIFY_DA_PODMAN_PATH", settings.podmanPath); } else { - System.clearProperty("EXHORT_PODMAN_PATH"); + System.clearProperty("TRUSTIFY_DA_PODMAN_PATH"); } if (settings.imagePlatform != null && !settings.imagePlatform.isBlank()) { - System.setProperty("EXHORT_IMAGE_PLATFORM", settings.imagePlatform); + System.setProperty("TRUSTIFY_DA_IMAGE_PLATFORM", settings.imagePlatform); } else { - System.clearProperty("EXHORT_IMAGE_PLATFORM"); + System.clearProperty("TRUSTIFY_DA_IMAGE_PLATFORM"); } Optional proxyUrlOpt = getProxyUrl(); if (proxyUrlOpt.isPresent()) { - System.setProperty("EXHORT_PROXY_URL", proxyUrlOpt.get()); + System.setProperty("TRUSTIFY_DA_PROXY_URL", proxyUrlOpt.get()); } else { - System.clearProperty("EXHORT_PROXY_URL"); + System.clearProperty("TRUSTIFY_DA_PROXY_URL"); } } } diff --git a/src/main/resources/META-INF/plugin.xml b/src/main/resources/META-INF/plugin.xml index f6e7325d..b3f9977d 100644 --- a/src/main/resources/META-INF/plugin.xml +++ b/src/main/resources/META-INF/plugin.xml @@ -230,28 +230,28 @@
You can specify a specific path to these binaries, and others by settings the following parameters as environment variables or system properties:
    -
  • EXHORT_SYFT_PATH : Specify the absolute path of syft executable.
    • -
  • EXHORT_SYFT_CONFIG_PATH : Specify the absolute path to the Syft configuration file.
    • -
  • EXHORT_SKOPEO_PATH : Specify the absolute path of skopeo executable.
    • -
  • EXHORT_SKOPEO_CONFIG_PATH : Specify the absolute path to the authentication file used by +
  • TRUSTIFY_DA_SYFT_PATH : Specify the absolute path of syft executable.
    • +
  • TRUSTIFY_DA_SYFT_CONFIG_PATH : Specify the absolute path to the Syft configuration file.
    • +
  • TRUSTIFY_DA_SKOPEO_PATH : Specify the absolute path of skopeo executable.
    • +
  • TRUSTIFY_DA_SKOPEO_CONFIG_PATH : Specify the absolute path to the authentication file used by the skopeo inspect command.
    • -
  • EXHORT_DOCKER_PATH : Specify the absolute path of docker executable.
    • -
  • EXHORT_PODMAN_PATH : Specify the absolute path of podman executable.
    • -
  • EXHORT_IMAGE_PLATFORM : Specify the platform used for multi-arch images.
    • +
  • TRUSTIFY_DA_DOCKER_PATH : Specify the absolute path of docker executable.
    • +
  • TRUSTIFY_DA_PODMAN_PATH : Specify the absolute path of podman executable.
    • +
  • TRUSTIFY_DA_IMAGE_PLATFORM : Specify the platform used for multi-arch images.
Animated screenshot showing the inline reporting feature of Image Analysis
  • - Excluding dependencies with exhortignore + Excluding dependencies with trustify-da-ignore
    You can exclude a package from analysis by marking the package for exclusion.
    -
    If you wish to ignore vulnerabilities for a dependency in a pom.xml file, you must add exhortignore +
    If you wish to ignore vulnerabilities for a dependency in a pom.xml file, you must add trustify-da-ignore as a comment against the dependency, group id, artifact id, or version scopes of that particular dependency in the manifest file.
    For example: -
    <dependency> <!--exhortignore--> +
    <dependency> <!--trustify-da-ignore-->
      <groupId>...</groupId>
      <artifactId>...</artifactId>
      <version>...</version> @@ -259,7 +259,7 @@

    If you wish to ignore vulnerabilities for a dependency in a package.json file, you must add - exhortignore as a attribute-value pair. + trustify-da-ignore as an attribute-value pair.
    For example:
    { @@ -276,26 +276,26 @@
        "jsonwebtoken": "^8.5.1",
        "mongoose": "^5.9.18"
      }, -
      "exhortignore": [ +
      "trustify-da-ignore": [
        "jsonwebtoken"
      ]
    }

    If you wish to ignore vulnerabilities for a dependency in a go.mod file, you must add - exhortignore as a comment against the dependency in the manifest file. + trustify-da-ignore as a comment against the dependency in the manifest file.
    For example:
    require ( -
      golang.org/x/sys v1.6.7 // exhortignore +
      golang.org/x/sys v1.6.7 // trustify-da-ignore
    )

    If you wish to ignore vulnerabilities for a dependency in a requirements.txt file, you must add - exhortignore as a comment against the dependency in the manifest file. + trustify-da-ignore as a comment against the dependency in the manifest file.
    For example: -
    requests==2.28.1 # exhortignore +
    requests==2.28.1 # trustify-da-ignore
  • From 6e731512a34dea29bff9f0b5ded5af69fd011531 Mon Sep 17 00:00:00 2001 From: Chao Wang Date: Fri, 21 Nov 2025 18:03:36 +0800 Subject: [PATCH 3/6] fix: add back exhortignore to for backward compatibility and set required TRUSTIFY_DA_BACKEND_URL before creating ExhortApi instance --- .../intellij/componentanalysis/CAUtil.java | 5 ++++- .../golang/GoCAAnnotator.java | 5 +++-- .../gradle/GradleCAAnnotator.java | 5 ++++- .../maven/MavenCAAnnotator.java | 4 +++- .../pypi/PipCAAnnotator.java | 5 ++++- .../tools/intellij/exhort/ApiService.java | 19 ++++++++++++++++++- .../tools/intellij/image/ApiService.java | 7 +++++-- 7 files changed, 41 insertions(+), 9 deletions(-) diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/CAUtil.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/CAUtil.java index 9571793a..2f143750 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/CAUtil.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/CAUtil.java @@ -33,6 +33,7 @@ public class CAUtil { public static String PACKAGE_JSON = "package.json"; public static String TRUSTIFY_DA_IGNORE = "trustify-da-ignore"; + public static String EXHORT_IGNORE = "exhortignore"; public static String DEPENDENCIES = "dependencies"; public static Map> getDependencyListMap(PsiFile file) { @@ -77,7 +78,9 @@ private static Set getIgnoredDependencies(PsiFile file) { Set ignored = Arrays.stream(file.getChildren()) .filter(e -> e instanceof JsonObject) .flatMap(e -> Arrays.stream(e.getChildren())) - .filter(e -> e instanceof JsonProperty && TRUSTIFY_DA_IGNORE.equals(((JsonProperty) e).getName())) + .filter(e -> e instanceof JsonProperty && + (TRUSTIFY_DA_IGNORE.equals(((JsonProperty) e).getName()) || + EXHORT_IGNORE.equals(((JsonProperty) e).getName()))) .flatMap(e -> Arrays.stream(e.getChildren())) .filter(e -> e instanceof JsonArray) .flatMap(e -> Arrays.stream(e.getChildren())) diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/golang/GoCAAnnotator.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/golang/GoCAAnnotator.java index d9c402f6..42ede239 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/golang/GoCAAnnotator.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/golang/GoCAAnnotator.java @@ -29,6 +29,7 @@ import java.util.regex.Pattern; import static org.jboss.tools.intellij.componentanalysis.CAUtil.TRUSTIFY_DA_IGNORE; +import static org.jboss.tools.intellij.componentanalysis.CAUtil.EXHORT_IGNORE; public class GoCAAnnotator extends CAAnnotator { public static final Pattern REQUIRE_PATTERN = Pattern.compile("^\\s*([a-zA-Z0-9._/-]+)\\s+(v?[0-9]+(?:\\.[0-9]+)*[0-9a-zA-Z\\-+._]*)(?:\\s*//.*)?$"); @@ -69,8 +70,8 @@ protected Map> getDependencies(PsiFile file) { continue; } - // Skip if line contains trustify-da-ignore - if (line.contains(TRUSTIFY_DA_IGNORE)) { + // Skip if line contains trustify-da-ignore or exhortignore + if (line.contains(TRUSTIFY_DA_IGNORE) || line.contains(EXHORT_IGNORE)) { continue; } diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/gradle/GradleCAAnnotator.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/gradle/GradleCAAnnotator.java index d5c3143c..6458cbf4 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/gradle/GradleCAAnnotator.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/gradle/GradleCAAnnotator.java @@ -30,6 +30,7 @@ import java.util.Objects; import static org.jboss.tools.intellij.componentanalysis.CAUtil.TRUSTIFY_DA_IGNORE; +import static org.jboss.tools.intellij.componentanalysis.CAUtil.EXHORT_IGNORE; public class GradleCAAnnotator extends CAAnnotator { @@ -44,7 +45,9 @@ protected Map> getDependencies(PsiFile file) { Map> resultMap = new HashMap<>(); Arrays.stream(file.getChildren()) .filter(e -> e instanceof Artifact) - .filter(artifact -> ((Artifact)artifact).getComment() == null || Objects.nonNull(((Artifact)artifact).getComment()) && !((Artifact)artifact).getComment().getText().contains(TRUSTIFY_DA_IGNORE)) + .filter(artifact -> ((Artifact)artifact).getComment() == null || Objects.nonNull(((Artifact)artifact).getComment()) && + !((Artifact)artifact).getComment().getText().contains(TRUSTIFY_DA_IGNORE) && + !((Artifact)artifact).getComment().getText().contains(EXHORT_IGNORE)) .map(dep -> (Artifact)dep) .forEach( dep -> { Dependency dependency = new Dependency("maven", dep.getGroup().getText().replace("\"","") , dep.getArtifactId().getText(),dep.getVersion().getText()); diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/maven/MavenCAAnnotator.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/maven/MavenCAAnnotator.java index 2c5ac4fa..8631b939 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/maven/MavenCAAnnotator.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/maven/MavenCAAnnotator.java @@ -35,6 +35,7 @@ import static org.jboss.tools.intellij.componentanalysis.CAUtil.DEPENDENCIES; import static org.jboss.tools.intellij.componentanalysis.CAUtil.TRUSTIFY_DA_IGNORE; +import static org.jboss.tools.intellij.componentanalysis.CAUtil.EXHORT_IGNORE; public class MavenCAAnnotator extends CAAnnotator { @@ -58,7 +59,8 @@ protected Map> getDependencies(PsiFile file) { .filter(e -> e instanceof XmlTag && "dependency".equals(((XmlTag) e).getName())) .filter(e -> Arrays.stream(e.getChildren()) .noneMatch(c -> c instanceof XmlComment - && TRUSTIFY_DA_IGNORE.equals(((XmlComment) c).getCommentText().trim()))) + && (TRUSTIFY_DA_IGNORE.equals(((XmlComment) c).getCommentText().trim()) || + EXHORT_IGNORE.equals(((XmlComment) c).getCommentText().trim())))) .map(e -> (XmlTag) e) .forEach(d -> { List elements = Arrays.stream(d.getChildren()) diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/pypi/PipCAAnnotator.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/pypi/PipCAAnnotator.java index 73c4efbd..e87f1f3e 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/pypi/PipCAAnnotator.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/pypi/PipCAAnnotator.java @@ -30,6 +30,7 @@ import java.util.Map; import static org.jboss.tools.intellij.componentanalysis.CAUtil.TRUSTIFY_DA_IGNORE; +import static org.jboss.tools.intellij.componentanalysis.CAUtil.EXHORT_IGNORE; public class PipCAAnnotator extends CAAnnotator { @Override @@ -50,7 +51,9 @@ protected Map> getDependencies(PsiFile file) { .noneMatch(c -> { String comment = c.getText().trim(); if (!comment.isEmpty() && '#' == comment.charAt(0)) { - return TRUSTIFY_DA_IGNORE.equals(comment.substring(1).trim()); + String commentContent = comment.substring(1).trim(); + return TRUSTIFY_DA_IGNORE.equals(commentContent) || + EXHORT_IGNORE.equals(commentContent); } return false; })) diff --git a/src/main/java/org/jboss/tools/intellij/exhort/ApiService.java b/src/main/java/org/jboss/tools/intellij/exhort/ApiService.java index f3b79319..4f66273a 100644 --- a/src/main/java/org/jboss/tools/intellij/exhort/ApiService.java +++ b/src/main/java/org/jboss/tools/intellij/exhort/ApiService.java @@ -38,6 +38,8 @@ public final class ApiService { private static final Logger LOG = Logger.getInstance(ApiService.class); + private static final String TRUSTIFY_DA_BACKEND_URL_PROPERTY = "TRUSTIFY_DA_BACKEND_URL"; + private static final String RHDA_BACKEND_URL = "https://rhda.rhcloud.com"; enum TelemetryKeys { MANIFEST, ECOSYSTEM, PLATFORM, TRUST_DA_TOKEN; @@ -51,7 +53,12 @@ public String toString() { private final Api exhortApi; public ApiService() { - this(new ExhortApi()); + this(createExhortApiWithBackendUrl()); + } + + public static Api createExhortApiWithBackendUrl() { + setBackendUrl(); + return new ExhortApi(); } ApiService(Api exhortApi) { @@ -129,6 +136,8 @@ private void setRequestProperties(final String manifestName) { ApiSettingsState settings = ApiSettingsState.getInstance(); System.setProperty("TRUST_DA_TOKEN", settings.rhdaToken); + setBackendUrl(); + if (settings.mvnPath != null && !settings.mvnPath.isBlank()) { System.setProperty("TRUSTIFY_DA_MVN_PATH", settings.mvnPath); } else { @@ -260,6 +269,14 @@ private void setRequestProperties(final String manifestName) { } } + public static void setBackendUrl() { + String backendUrl = System.getenv(TRUSTIFY_DA_BACKEND_URL_PROPERTY); + if (backendUrl == null || backendUrl.isBlank()) { + backendUrl = RHDA_BACKEND_URL; + } + System.setProperty(TRUSTIFY_DA_BACKEND_URL_PROPERTY, backendUrl); + } + public static Optional getProxyUrl() { // This API only works in 2024.2+ versions. ProxyConfiguration proxyConfiguration = ProxySettings.getInstance().getProxyConfiguration(); diff --git a/src/main/java/org/jboss/tools/intellij/image/ApiService.java b/src/main/java/org/jboss/tools/intellij/image/ApiService.java index 78814417..c387fcf0 100644 --- a/src/main/java/org/jboss/tools/intellij/image/ApiService.java +++ b/src/main/java/org/jboss/tools/intellij/image/ApiService.java @@ -21,7 +21,6 @@ import io.github.guacsec.trustifyda.Api; import io.github.guacsec.trustifyda.api.v5.AnalysisReport; import io.github.guacsec.trustifyda.image.ImageRef; -import io.github.guacsec.trustifyda.impl.ExhortApi; import org.jboss.tools.intellij.exhort.TelemetryService; import org.jboss.tools.intellij.settings.ApiSettingsState; @@ -37,7 +36,9 @@ import java.util.function.Function; import java.util.stream.Collectors; +import static org.jboss.tools.intellij.exhort.ApiService.createExhortApiWithBackendUrl; import static org.jboss.tools.intellij.exhort.ApiService.getProxyUrl; +import static org.jboss.tools.intellij.exhort.ApiService.setBackendUrl; @Service(Service.Level.APP) public final class ApiService { @@ -47,7 +48,7 @@ public final class ApiService { private final Api exhortApi; public ApiService() { - this.exhortApi = new ExhortApi(); + this.exhortApi = createExhortApiWithBackendUrl(); } static ApiService getInstance() { @@ -125,6 +126,8 @@ private void setServiceEnvironment() { var settings = ApiSettingsState.getInstance(); System.setProperty("TRUST_DA_TOKEN", settings.rhdaToken); + setBackendUrl(); + if (settings.syftPath != null && !settings.syftPath.isBlank()) { System.setProperty("TRUSTIFY_DA_SYFT_PATH", settings.syftPath); } else { From bcc06d4e5f9ce2526aeab2346105dc4385a87795 Mon Sep 17 00:00:00 2001 From: Chao Wang Date: Thu, 27 Nov 2025 16:23:59 +0800 Subject: [PATCH 4/6] build: upgrade trustify-da-java-client to 0.0.11 and trustify-da-api-spec to 2.0.2 --- gradle/libs.versions.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index 7b6cee42..daae656d 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -3,8 +3,8 @@ caffeine = "3.1.8" commons-compress = "1.21" commons-io = "2.16.1" -trustify-da-api-spec = "2.0.1" -trustify-da-java-client = "0.0.9" +trustify-da-api-spec = "2.0.2" +trustify-da-java-client = "0.0.11" github-api = "1.314" junit = "4.13.2" mockito = "4.11.0" From f74d0fdc9ad6717e6b83c401e3526e40bc685d2c Mon Sep 17 00:00:00 2001 From: Chao Wang Date: Sat, 29 Nov 2025 21:31:22 +0800 Subject: [PATCH 5/6] fix: fix NPE when issue.getRemediation() return null --- .../tools/intellij/componentanalysis/CAIntentionAction.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/CAIntentionAction.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/CAIntentionAction.java index 74a317ff..7a15d5ab 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/CAIntentionAction.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/CAIntentionAction.java @@ -115,7 +115,7 @@ public boolean startInWriteAction() { } private static boolean thereIsTcRemediation(DependencyReport dependency) { - Optional issue = dependency.getIssues().stream().filter(iss -> iss.getRemediation().getTrustedContent() != null).findFirst(); + Optional issue = dependency.getIssues().stream().filter(iss -> iss.getRemediation() != null && iss.getRemediation().getTrustedContent() != null).findFirst(); if(issue.isPresent()) { return issue.get().getRemediation().getTrustedContent() != null; } From dd2c0e1e447030f1efb1d9d04e54c279e1cccc22 Mon Sep 17 00:00:00 2001 From: Chao Wang Date: Sat, 29 Nov 2025 21:33:52 +0800 Subject: [PATCH 6/6] fix: eliminate duplicate vulnerability annotations in CAAnnotator Create single annotation per element instead of one per vulnerability source to avoid showing duplicate messages for the same dependency --- .../componentanalysis/CAAnnotator.java | 23 ++++++++++--------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/src/main/java/org/jboss/tools/intellij/componentanalysis/CAAnnotator.java b/src/main/java/org/jboss/tools/intellij/componentanalysis/CAAnnotator.java index 3dc05df1..2f20af8e 100644 --- a/src/main/java/org/jboss/tools/intellij/componentanalysis/CAAnnotator.java +++ b/src/main/java/org/jboss/tools/intellij/componentanalysis/CAAnnotator.java @@ -170,23 +170,24 @@ public void apply(@NotNull PsiFile file, Map annotationResul elements.forEach(e -> { if (e != null) { if (!quickfixes.isEmpty() && this.isQuickFixApplicable(e)) { - quickfixes.forEach((source, report) ->{ - AnnotationBuilder builder = holder - .newAnnotation(getHighlightSeverity(report, e), messageBuilder.toString()) - .tooltip(tooltipBuilder.toString()) - .range(e); + DependencyReport firstReport = quickfixes.values().iterator().next(); + AnnotationBuilder builder = holder + .newAnnotation(getHighlightSeverity(firstReport, e), messageBuilder.toString()) + .tooltip(tooltipBuilder.toString()) + .range(e); + + quickfixes.forEach((source, report) -> { if(CAIntentionAction.isQuickFixAvailable(report)) { - CAUpdateManifestIntentionAction patchManifest = this.patchManifest(file, report); builder.withFix(this.createQuickFix(e, source, report)); + CAUpdateManifestIntentionAction patchManifest = this.patchManifest(file, report); if(Objects.nonNull(patchManifest)) { builder.withFix(patchManifest); } } - builder.withFix(new SAIntentionAction()); - builder.withFix(new ExcludeManifestIntentionAction()); - builder.create(); - } - ); + }); + builder.withFix(new SAIntentionAction()); + builder.withFix(new ExcludeManifestIntentionAction()); + builder.create(); } } });