From 7ccbadff34d92b153cf5aab6472144bb84d74c40 Mon Sep 17 00:00:00 2001 From: Colm O hEigeartaigh Date: Sat, 11 Nov 2023 03:02:53 +0000 Subject: [PATCH] Fall back to searching maven central using groupIDFromJavaMetadata (#2295) Signed-off-by: Colm O hEigeartaigh --- syft/pkg/cataloger/java/archive_parser.go | 24 +++++++++++++++++++++++ 1 file changed, 24 insertions(+) diff --git a/syft/pkg/cataloger/java/archive_parser.go b/syft/pkg/cataloger/java/archive_parser.go index 850727fd124..1d418cb28a6 100644 --- a/syft/pkg/cataloger/java/archive_parser.go +++ b/syft/pkg/cataloger/java/archive_parser.go @@ -250,9 +250,33 @@ func (j *archiveParser) parseLicenses(manifest *pkg.JavaManifest) ([]pkg.License } } + // If we didn't find any licenses in the archive so far, we'll try again in Maven Central using groupIDFromJavaMetadata + if len(licenses) == 0 && j.cfg.UseNetwork { + licenses = findLicenseFromJavaMetadata(name, manifest, version, j, licenses) + } + return licenses, name, version, nil } +func findLicenseFromJavaMetadata(name string, manifest *pkg.JavaManifest, version string, j *archiveParser, licenses []pkg.License) []pkg.License { + var groupID = name + if gID := groupIDFromJavaMetadata(name, pkg.JavaArchive{Manifest: manifest}); gID != "" { + groupID = gID + } + pomLicenses, err := recursivelyFindLicensesFromParentPom(groupID, name, version, j.cfg) + if err != nil { + log.Tracef("unable to get parent pom from Maven central: %v", err) + } + + if len(pomLicenses) > 0 { + pkgLicenses := pkg.NewLicensesFromLocation(j.location, pomLicenses...) + if pkgLicenses != nil { + licenses = append(licenses, pkgLicenses...) + } + } + return licenses +} + type parsedPomProject struct { *pkg.JavaPomProject Licenses []pkg.License