build: Upgrade trustify-da-api-spec 2.0.1 and trustify-da-java-client 0.0.11

README.md

@@ -180,16 +180,16 @@ according to your preferences.
   You can specify a specific path to these binaries, and others by settings the following parameters as environment
   variables or system properties:
 
-    * `EXHORT_SYFT_PATH` : Specify the absolute path of `syft` executable.
-    * `EXHORT_SYFT_CONFIG_PATH` : Specify the absolute path to the Syft configuration file.
-    * `EXHORT_SKOPEO_PATH` : Specify the absolute path of `skopeo` executable.
-    * `EXHORT_SKOPEO_CONFIG_PATH` : Specify the absolute path to the authentication file used by the `skopeo inspect`
+    * `TRUSTIFY_DA_SYFT_PATH` : Specify the absolute path of `syft` executable.
+    * `TRUSTIFY_DA_SYFT_CONFIG_PATH` : Specify the absolute path to the Syft configuration file.
+    * `TRUSTIFY_DA_SKOPEO_PATH` : Specify the absolute path of `skopeo` executable.
+    * `TRUSTIFY_DA_SKOPEO_CONFIG_PATH` : Specify the absolute path to the authentication file used by the `skopeo inspect`
       command.
-    * `EXHORT_DOCKER_PATH` : Specify the absolute path of `docker` executable.
-    * `EXHORT_PODMAN_PATH` : Specify the absolute path of `podman` executable.
-    * `EXHORT_IMAGE_PLATFORM` : Specify the platform used for multi-arch images.
-    * `EXHORT_MVN_USER_SETTINGS` : Specify the absolute path to the Maven user settings file.
-    * `EXHORT_MVN_LOCAL_REPO` : Specify the absolute path to the Maven local repository.
+    * `TRUSTIFY_DA_DOCKER_PATH` : Specify the absolute path of `docker` executable.
+    * `TRUSTIFY_DA_PODMAN_PATH` : Specify the absolute path of `podman` executable.
+    * `TRUSTIFY_DA_IMAGE_PLATFORM` : Specify the platform used for multi-arch images.
+    * `TRUSTIFY_DA_MVN_USER_SETTINGS` : Specify the absolute path to the Maven user settings file.
+    * `TRUSTIFY_DA_MVN_LOCAL_REPO` : Specify the absolute path to the Maven local repository.
 
   ![ Animated screenshot showing the inline reporting feature of Image Analysis ](src/main/resources/images/image-analysis.gif)
 
@@ -239,20 +239,20 @@ When modifying the grammar or lexer files, you need to regenerate the parser cla
 - Comments and complex shell commands
 - Comprehensive syntax error handling
 
-- **Excluding dependencies with `exhortignore`**
+- **Excluding dependencies with `trustify-da-ignore`**
   <br >You can exclude a package from analysis by marking the package for exclusion.
-  If you want to ignore vulnerabilities for a dependency in a `pom.xml` file, you must add `exhortignore` as a comment
+  If you want to ignore vulnerabilities for a dependency in a `pom.xml` file, you must add `trustify-da-ignore` as a comment
   against the dependency, group id, artifact id, or version scopes of that particular dependency in the manifest file.
   For example:
   ```xml
-  <dependency> <!--exhortignore-->
+  <dependency> <!--trustify-da-ignore-->
       <groupId>...</groupId>
       <artifactId>...</artifactId>
       <version>...</version>
   </dependency>
   ```
 
-  If you want to ignore vulnerabilities for a dependency in a `package.json` file, you must add `exhortignore` as a
+  If you want to ignore vulnerabilities for a dependency in a `package.json` file, you must add `trustify-da-ignore` as a
   attribute-value pair.
   For example:
   ```json
@@ -270,33 +270,33 @@ When modifying the grammar or lexer files, you need to regenerate the parser cla
           "jsonwebtoken": "^8.5.1",
           "mongoose": "^5.9.18"
       },
-      "exhortignore": [
+      "trustify-da-ignore": [
           "jsonwebtoken"
       ]
   }
   ```
 
-  If you want to ignore vulnerabilities for a dependency in a `go.mod` file, you must add `exhortignore` as a comment
+  If you want to ignore vulnerabilities for a dependency in a `go.mod` file, you must add `trustify-da-ignore` as a comment
   against the dependency in the manifest file.
   For example:
   ```text
   require (
-      golang.org/x/sys v1.6.7 // exhortignore
+      golang.org/x/sys v1.6.7 // trustify-da-ignore
   )
   ```
 
-  If you want to ignore vulnerabilities for a dependency in a `requirements.txt` file, you must add `exhortignore` as a
+  If you want to ignore vulnerabilities for a dependency in a `requirements.txt` file, you must add `trustify-da-ignore` as a
   comment against the dependency in the manifest file.
   For example:
   ```text
-  requests==2.28.1 # exhortignore
+  requests==2.28.1 # trustify-da-ignore
   ```
-  If you want to ignore vulnerabilities for a dependency in a `build.gradle` file, you must add `exhortignore` as a
+  If you want to ignore vulnerabilities for a dependency in a `build.gradle` file, you must add `trustify-da-ignore` as a
   comment against the dependency in the manifest file.
   For example:
   ```text
-  implementation "log4j:log4j:1.2.17" // exhortignore
-  implementation group: 'log4j', name: 'log4j', version: '1.2.17' // exhortignore 
+  implementation "log4j:log4j:1.2.17" // trustify-da-ignore
+  implementation group: 'log4j', name: 'log4j', version: '1.2.17' // trustify-da-ignore
   ```
 
 - **Excluding developmental or test dependencies**

build.gradle.kts

@@ -12,11 +12,6 @@ plugins {
 group = "com.redhat.devtools.intellij"
 version = providers.gradleProperty("projectVersion").get() // Plugin version
 val platformVersion = providers.gradleProperty("ideaVersion").get()
-val exhortRepoUser: String? = findProperty("gpr.username") as String?
-    ?: System.getenv("GITHUB_USERNAME")
-val exhortRepoToken: String? = findProperty("gpr.token") as String?
-    ?: System.getenv("GITHUB_TOKEN")
-
 // Set the JVM language level used to build the project.
 java {
     sourceCompatibility = JavaVersion.VERSION_17
@@ -32,20 +27,6 @@ repositories {
         defaultRepositories()
     }
     maven { url = uri("https://jitpack.io") }
-    maven {
-        url = uri("https://maven.pkg.github.com/trustification/exhort-java-api")
-        credentials {
-            username = exhortRepoUser
-            password = exhortRepoToken
-        }
-    }
-    maven {
-        url = uri("https://maven.pkg.github.com/guacsec/trustify-da-api-spec")
-        credentials {
-            username = exhortRepoUser
-            password = exhortRepoToken
-        }
-    }
 }
 
 sourceSets {
@@ -80,8 +61,8 @@ dependencies {
 
     implementation(libs.github.api)
     implementation(libs.commons.compress)
-    implementation(libs.exhort.api.spec)
-    implementation(libs.exhort.java.api)
+    implementation(libs.trustify.da.api.spec)
+    implementation(libs.trustify.da.java.client)
     implementation(libs.caffeine)
     implementation(libs.packageurl.java)
     implementation(libs.commons.io)

gradle/libs.versions.toml

@@ -3,8 +3,8 @@
 caffeine = "3.1.8"
 commons-compress = "1.21"
 commons-io = "2.16.1"
-exhort-api-spec = "1.0.18"
-exhort-java-api = "0.0.9-SNAPSHOT"
+trustify-da-api-spec = "2.0.2"
+trustify-da-java-client = "0.0.11"
 github-api = "1.314"
 junit = "4.13.2"
 mockito = "4.11.0"
@@ -17,8 +17,8 @@ gradleIntelliJPlugin = "2.6.0"
 caffeine = { group = "com.github.ben-manes.caffeine", name = "caffeine", version.ref = "caffeine" }
 commons-compress = { group = "org.apache.commons", name = "commons-compress", version.ref = "commons-compress" }
 commons-io = { group = "commons-io", name = "commons-io", version.ref = "commons-io" }
-exhort-api-spec = { group = "com.redhat.ecosystemappeng", name = "exhort-api-spec", version.ref = "exhort-api-spec" }
-exhort-java-api = { group = "com.redhat.exhort", name = "exhort-java-api", version.ref = "exhort-java-api" }
+trustify-da-api-spec = { group = "io.github.guacsec", name = "trustify-da-api-model", version.ref = "trustify-da-api-spec" }
+trustify-da-java-client = { group = "io.github.guacsec", name = "trustify-da-java-client", version.ref = "trustify-da-java-client" }
 github-api = { group = "org.kohsuke", name = "github-api", version.ref = "github-api" }
 junit = { group = "junit", name = "junit", version.ref = "junit" }
 mockito = { group = "org.mockito", name = "mockito-core", version.ref = "mockito" }

src/main/java/org/jboss/tools/intellij/componentanalysis/CAAnnotator.java

@@ -28,7 +28,7 @@
 import com.intellij.psi.PsiElement;
 import com.intellij.psi.PsiFile;
 import com.intellij.serviceContainer.AlreadyDisposedException;
-import com.redhat.exhort.api.v4.DependencyReport;
+import io.github.guacsec.trustifyda.api.v5.DependencyReport;
 import org.jetbrains.annotations.NotNull;
 import org.jetbrains.annotations.Nullable;
 
@@ -170,23 +170,24 @@ public void apply(@NotNull PsiFile file, Map<Dependency, Result> annotationResul
                         elements.forEach(e -> {
                             if (e != null) {
                                 if (!quickfixes.isEmpty() && this.isQuickFixApplicable(e)) {
-                                    quickfixes.forEach((source, report) ->{
-                                        AnnotationBuilder builder = holder
-                                                .newAnnotation(getHighlightSeverity(report, e), messageBuilder.toString())
-                                                .tooltip(tooltipBuilder.toString())
-                                                .range(e);
+                                    DependencyReport firstReport = quickfixes.values().iterator().next();
+                                    AnnotationBuilder builder = holder
+                                            .newAnnotation(getHighlightSeverity(firstReport, e), messageBuilder.toString())
+                                            .tooltip(tooltipBuilder.toString())
+                                            .range(e);
+
+                                    quickfixes.forEach((source, report) -> {
                                         if(CAIntentionAction.isQuickFixAvailable(report)) {
-                                            CAUpdateManifestIntentionAction patchManifest = this.patchManifest(file, report);
                                             builder.withFix(this.createQuickFix(e, source, report));
+                                            CAUpdateManifestIntentionAction patchManifest = this.patchManifest(file, report);
                                             if(Objects.nonNull(patchManifest)) {
                                                 builder.withFix(patchManifest);
                                             }
                                         }
-                                        builder.withFix(new SAIntentionAction());
-                                        builder.withFix(new ExcludeManifestIntentionAction());
-                                        builder.create();
-                                      }
-                                    );
+                                    });
+                                    builder.withFix(new SAIntentionAction());
+                                    builder.withFix(new ExcludeManifestIntentionAction());
+                                    builder.create();
                                 }
                             }
                         });

src/main/java/org/jboss/tools/intellij/componentanalysis/CAIntentionAction.java

@@ -21,8 +21,8 @@
 import com.intellij.psi.PsiFile;
 import com.intellij.psi.util.PsiTreeUtil;
 import com.intellij.util.IncorrectOperationException;
-import com.redhat.exhort.api.v4.DependencyReport;
-import com.redhat.exhort.api.v4.Issue;
+import io.github.guacsec.trustifyda.api.v5.DependencyReport;
+import io.github.guacsec.trustifyda.api.v5.Issue;
 import org.jboss.tools.intellij.exhort.TelemetryService;
 import org.jetbrains.annotations.NotNull;
 import org.jetbrains.annotations.Nullable;
@@ -115,7 +115,7 @@ public boolean startInWriteAction() {
     }
 
     private static boolean thereIsTcRemediation(DependencyReport dependency) {
-        Optional<Issue> issue = dependency.getIssues().stream().filter(iss -> iss.getRemediation().getTrustedContent() != null).findFirst();
+        Optional<Issue> issue = dependency.getIssues().stream().filter(iss -> iss.getRemediation() != null && iss.getRemediation().getTrustedContent() != null).findFirst();
         if(issue.isPresent()) {
             return issue.get().getRemediation().getTrustedContent() != null;
         }

src/main/java/org/jboss/tools/intellij/componentanalysis/CAService.java

@@ -23,10 +23,10 @@
 import com.intellij.openapi.project.Project;
 import com.intellij.psi.PsiDocumentManager;
 import com.intellij.psi.PsiFile;
-import com.redhat.exhort.api.v4.AnalysisReport;
-import com.redhat.exhort.api.v4.DependencyReport;
-import com.redhat.exhort.api.v4.ProviderReport;
-import com.redhat.exhort.api.v4.Source;
+import io.github.guacsec.trustifyda.api.v5.AnalysisReport;
+import io.github.guacsec.trustifyda.api.v5.DependencyReport;
+import io.github.guacsec.trustifyda.api.v5.ProviderReport;
+import io.github.guacsec.trustifyda.api.v5.Source;
 import org.jboss.tools.intellij.exhort.ApiService;
 
 import java.util.Collections;

src/main/java/org/jboss/tools/intellij/componentanalysis/CAUpdateManifestIntentionAction.java

@@ -19,8 +19,8 @@
 import com.intellij.psi.PsiElement;
 import com.intellij.psi.PsiFile;
 import com.intellij.util.IncorrectOperationException;
-import com.redhat.exhort.api.v4.DependencyReport;
-import com.redhat.exhort.api.PackageRef;
+import io.github.guacsec.trustifyda.api.PackageRef;
+import io.github.guacsec.trustifyda.api.v5.DependencyReport;
 import org.jetbrains.annotations.NotNull;
 
 import java.util.Objects;

src/main/java/org/jboss/tools/intellij/componentanalysis/CAUtil.java

@@ -32,6 +32,7 @@
 public class CAUtil {
 
     public static String PACKAGE_JSON = "package.json";
+    public static String TRUSTIFY_DA_IGNORE = "trustify-da-ignore";
     public static String EXHORT_IGNORE = "exhortignore";
     public static String DEPENDENCIES = "dependencies";
 
@@ -77,7 +78,9 @@ private static Set<String> getIgnoredDependencies(PsiFile file) {
         Set<String> ignored = Arrays.stream(file.getChildren())
                 .filter(e -> e instanceof JsonObject)
                 .flatMap(e -> Arrays.stream(e.getChildren()))
-                .filter(e -> e instanceof JsonProperty && EXHORT_IGNORE.equals(((JsonProperty) e).getName()))
+                .filter(e -> e instanceof JsonProperty &&
+                        (TRUSTIFY_DA_IGNORE.equals(((JsonProperty) e).getName()) ||
+                         EXHORT_IGNORE.equals(((JsonProperty) e).getName())))
                 .flatMap(e -> Arrays.stream(e.getChildren()))
                 .filter(e -> e instanceof JsonArray)
                 .flatMap(e -> Arrays.stream(e.getChildren()))

src/main/java/org/jboss/tools/intellij/componentanalysis/golang/GoCAAnnotator.java

@@ -13,7 +13,7 @@
 
 import com.intellij.psi.PsiElement;
 import com.intellij.psi.PsiFile;
-import com.redhat.exhort.api.v4.DependencyReport;
+import io.github.guacsec.trustifyda.api.v5.DependencyReport;
 import org.jboss.tools.intellij.componentanalysis.CAAnnotator;
 import org.jboss.tools.intellij.componentanalysis.CAIntentionAction;
 import org.jboss.tools.intellij.componentanalysis.CAUpdateManifestIntentionAction;
@@ -28,6 +28,7 @@
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
+import static org.jboss.tools.intellij.componentanalysis.CAUtil.TRUSTIFY_DA_IGNORE;
 import static org.jboss.tools.intellij.componentanalysis.CAUtil.EXHORT_IGNORE;
 
 public class GoCAAnnotator extends CAAnnotator {
@@ -69,8 +70,8 @@ protected Map<Dependency, List<PsiElement>> getDependencies(PsiFile file) {
                 continue;
             }
 
-            // Skip if line contains exhortignore
-            if (line.contains(EXHORT_IGNORE)) {
+            // Skip if line contains trustify-da-ignore or exhortignore
+            if (line.contains(TRUSTIFY_DA_IGNORE) || line.contains(EXHORT_IGNORE)) {
                 continue;
             }
 

src/main/java/org/jboss/tools/intellij/componentanalysis/golang/GoCAIntentionAction.java

@@ -18,7 +18,7 @@
 import com.intellij.psi.PsiDocumentManager;
 import com.intellij.psi.PsiElement;
 import com.intellij.psi.PsiFile;
-import com.redhat.exhort.api.v4.DependencyReport;
+import io.github.guacsec.trustifyda.api.v5.DependencyReport;
 import org.jboss.tools.intellij.componentanalysis.CAIntentionAction;
 import org.jboss.tools.intellij.componentanalysis.VulnerabilitySource;
 import org.jetbrains.annotations.NotNull;

src/main/java/org/jboss/tools/intellij/componentanalysis/gradle/GradleCAAnnotator.java

@@ -13,7 +13,7 @@
 
 import com.intellij.psi.PsiElement;
 import com.intellij.psi.PsiFile;
-import com.redhat.exhort.api.v4.DependencyReport;
+import io.github.guacsec.trustifyda.api.v5.DependencyReport;
 import org.jboss.tools.intellij.componentanalysis.CAAnnotator;
 import org.jboss.tools.intellij.componentanalysis.CAIntentionAction;
 import org.jboss.tools.intellij.componentanalysis.CAUpdateManifestIntentionAction;
@@ -29,6 +29,7 @@
 import java.util.Map;
 import java.util.Objects;
 
+import static org.jboss.tools.intellij.componentanalysis.CAUtil.TRUSTIFY_DA_IGNORE;
 import static org.jboss.tools.intellij.componentanalysis.CAUtil.EXHORT_IGNORE;
 
 public class GradleCAAnnotator extends CAAnnotator {
@@ -44,7 +45,9 @@ protected Map<Dependency, List<PsiElement>> getDependencies(PsiFile file) {
             Map<Dependency, List<PsiElement>> resultMap = new HashMap<>();
             Arrays.stream(file.getChildren())
                     .filter(e -> e instanceof Artifact)
-                    .filter(artifact -> ((Artifact)artifact).getComment() == null || Objects.nonNull(((Artifact)artifact).getComment()) && !((Artifact)artifact).getComment().getText().contains(EXHORT_IGNORE))
+                    .filter(artifact -> ((Artifact)artifact).getComment() == null || Objects.nonNull(((Artifact)artifact).getComment()) &&
+                            !((Artifact)artifact).getComment().getText().contains(TRUSTIFY_DA_IGNORE) &&
+                            !((Artifact)artifact).getComment().getText().contains(EXHORT_IGNORE))
                     .map(dep -> (Artifact)dep)
                     .forEach(  dep -> {
                             Dependency dependency = new Dependency("maven", dep.getGroup().getText().replace("\"","") , dep.getArtifactId().getText(),dep.getVersion().getText());

src/main/java/org/jboss/tools/intellij/componentanalysis/gradle/GradleCAIntentionAction.java

@@ -17,7 +17,7 @@
 import com.intellij.psi.PsiElement;
 import com.intellij.psi.PsiFile;
 import com.intellij.psi.PsiFileFactory;
-import com.redhat.exhort.api.v4.DependencyReport;
+import io.github.guacsec.trustifyda.api.v5.DependencyReport;
 import org.jboss.tools.intellij.componentanalysis.CAIntentionAction;
 import org.jboss.tools.intellij.componentanalysis.VulnerabilitySource;
 import org.jboss.tools.intellij.componentanalysis.gradle.build.filetype.BuildGradleFileType;

src/main/java/org/jboss/tools/intellij/componentanalysis/gradle/GradleCAUpdateManifestIntentionAction.java

@@ -6,7 +6,7 @@
 import com.intellij.psi.PsiFile;
 import com.intellij.psi.PsiFileFactory;
 import com.intellij.psi.impl.source.tree.LeafPsiElement;
-import com.redhat.exhort.api.v4.DependencyReport;
+import io.github.guacsec.trustifyda.api.v5.DependencyReport;
 import org.jboss.tools.intellij.componentanalysis.CAUpdateManifestIntentionAction;
 import org.jboss.tools.intellij.componentanalysis.gradle.build.filetype.BuildGradleFileType;
 import org.jboss.tools.intellij.componentanalysis.gradle.build.psi.BuildGradleFile;

src/main/java/org/jboss/tools/intellij/componentanalysis/maven/MavenCAAnnotator.java

@@ -17,7 +17,7 @@
 import com.intellij.psi.xml.XmlDocument;
 import com.intellij.psi.xml.XmlTag;
 import com.intellij.psi.xml.XmlText;
-import com.redhat.exhort.api.v4.DependencyReport;
+import io.github.guacsec.trustifyda.api.v5.DependencyReport;
 import org.jboss.tools.intellij.componentanalysis.CAAnnotator;
 import org.jboss.tools.intellij.componentanalysis.CAIntentionAction;
 import org.jboss.tools.intellij.componentanalysis.CAUpdateManifestIntentionAction;
@@ -34,6 +34,7 @@
 import java.util.Optional;
 
 import static org.jboss.tools.intellij.componentanalysis.CAUtil.DEPENDENCIES;
+import static org.jboss.tools.intellij.componentanalysis.CAUtil.TRUSTIFY_DA_IGNORE;
 import static org.jboss.tools.intellij.componentanalysis.CAUtil.EXHORT_IGNORE;
 
 public class MavenCAAnnotator extends CAAnnotator {
@@ -58,7 +59,8 @@ protected Map<Dependency, List<PsiElement>> getDependencies(PsiFile file) {
                     .filter(e -> e instanceof XmlTag && "dependency".equals(((XmlTag) e).getName()))
                     .filter(e -> Arrays.stream(e.getChildren())
                             .noneMatch(c -> c instanceof XmlComment
-                                    && EXHORT_IGNORE.equals(((XmlComment) c).getCommentText().trim())))
+                                    && (TRUSTIFY_DA_IGNORE.equals(((XmlComment) c).getCommentText().trim()) ||
+                                        EXHORT_IGNORE.equals(((XmlComment) c).getCommentText().trim()))))
                     .map(e -> (XmlTag) e)
                     .forEach(d -> {
                         List<XmlTag> elements = Arrays.stream(d.getChildren())