Track repository_url

src/main/java/org/cyclonedx/maven/BaseCycloneDxMojo.java

@@ -46,10 +46,15 @@
 import org.cyclonedx.parsers.JsonParser;
 import org.cyclonedx.parsers.Parser;
 import org.cyclonedx.parsers.XmlParser;
+import org.eclipse.aether.repository.ArtifactRepository;
+import org.eclipse.aether.repository.RemoteRepository;
 
 import javax.xml.parsers.ParserConfigurationException;
 import java.io.File;
 import java.io.IOException;
+import java.io.UnsupportedEncodingException;
+import java.net.URLEncoder;
+import java.nio.charset.Charset;
 import java.nio.charset.StandardCharsets;
 import java.util.ArrayList;
 import java.util.Collections;
@@ -511,17 +516,37 @@ protected void logParameters() {
         }
     }
 
-    protected void populateComponents(final Set<String> topLevelComponents, final Map<String, Component> components, final Map<String, Artifact> artifacts, final ProjectDependencyAnalysis dependencyAnalysis) {
+    protected void populateComponents(final Set<String> topLevelComponents, final Map<String, Component> components, final Map<String, Artifact> artifacts, final Map<String, ArtifactRepository> artifactRemoteRepositories, final ProjectDependencyAnalysis dependencyAnalysis) {
         for (Map.Entry<String, Artifact> entry: artifacts.entrySet()) {
             final String purl = entry.getKey();
             final Artifact artifact = entry.getValue();
             final Component.Scope artifactScope = getComponentScope(artifact, dependencyAnalysis);
             final Component component = components.get(purl);
+            final ArtifactRepository repository = artifactRemoteRepositories.get(purl);
+            String repository_url = "";
+            if (repository instanceof RemoteRepository) {
+                try {
+                    String url = ((RemoteRepository) repository).getUrl();
+                    // As per purl spec, only repo.maven.apache.org/maven2 is considered the default
+                    if (url != null && !url.startsWith("https://repo.maven.apache.org/maven2")) {
+                        repository_url = "&repository_url=" + URLEncoder.encode(url, "UTF-8");
+                    }
+                } catch (UnsupportedEncodingException e) {
+                    // ignore
+                }
+            }
             if (component == null) {
                 final Component newComponent = convertMavenDependency(artifact);
                 newComponent.setScope(artifactScope);
+                if (!repository_url.isEmpty()) {
+                    newComponent.setPurl(newComponent.getPurl() + repository_url);
+                }
                 components.put(purl, newComponent);
             } else if (!topLevelComponents.contains(purl)) {
+                String currentPurl = component.getPurl();
+                if (!repository_url.isEmpty() && !currentPurl.contains("repository_url")) {
+                    component.setPurl(currentPurl + repository_url);
+                }
                 component.setScope(mergeScopes(component.getScope(), artifactScope));
             }
         }

src/main/java/org/cyclonedx/maven/CycloneDxAggregateMojo.java

@@ -130,7 +130,7 @@ protected String extractComponentsAndDependencies(final Set<String> topLevelComp
             components.put(projectBomComponent.getPurl(), projectBomComponent);
             topLevelComponents.add(projectBomComponent.getPurl());
 
-            populateComponents(topLevelComponents, components, bomDependencies.getArtifacts(), doProjectDependencyAnalysis(mavenProject, bomDependencies));
+            populateComponents(topLevelComponents, components, bomDependencies.getArtifacts(), bomDependencies.getArtifactRemoteRepositories(), doProjectDependencyAnalysis(mavenProject, bomDependencies));
 
             projectDependencies.forEach(dependencies::putIfAbsent);
         }

src/main/java/org/cyclonedx/maven/CycloneDxMojo.java

@@ -127,7 +127,7 @@ protected String extractComponentsAndDependencies(final Set<String> topLevelComp
         components.put(projectBomComponent.getPurl(), projectBomComponent);
         topLevelComponents.add(projectBomComponent.getPurl());
 
-        populateComponents(topLevelComponents, components, bomDependencies.getArtifacts(), doProjectDependencyAnalysis(getProject(), bomDependencies));
+        populateComponents(topLevelComponents, components, bomDependencies.getArtifacts(), bomDependencies.getArtifactRemoteRepositories(), doProjectDependencyAnalysis(getProject(), bomDependencies));
 
         projectDependencies.forEach(dependencies::putIfAbsent);
 

src/main/java/org/cyclonedx/maven/CycloneDxPackageMojo.java

@@ -70,7 +70,7 @@ protected String extractComponentsAndDependencies(Set<String> topLevelComponents
             components.put(projectBomComponent.getPurl(), projectBomComponent);
             topLevelComponents.add(projectBomComponent.getPurl());
 
-            populateComponents(topLevelComponents, components, bomDependencies.getArtifacts(), null);
+            populateComponents(topLevelComponents, components, bomDependencies.getArtifacts(), bomDependencies.getArtifactRemoteRepositories(), null);
 
             projectDependencies.forEach(dependencies::putIfAbsent);
         }

src/main/java/org/cyclonedx/maven/DefaultModelConverter.java

@@ -34,11 +34,15 @@
 import org.apache.maven.repository.RepositorySystem;
 import org.cyclonedx.CycloneDxSchema;
 import org.cyclonedx.model.Component;
+import org.cyclonedx.model.Evidence;
 import org.cyclonedx.model.ExternalReference;
+import org.cyclonedx.model.Hash;
 import org.cyclonedx.model.License;
 import org.cyclonedx.model.LicenseChoice;
 import org.cyclonedx.model.Metadata;
 import org.cyclonedx.model.Tool;
+import org.cyclonedx.model.component.evidence.Identity;
+import org.cyclonedx.model.component.evidence.Method;
 import org.cyclonedx.util.BomUtils;
 import org.cyclonedx.util.LicenseResolver;
 import org.eclipse.aether.artifact.ArtifactProperties;
@@ -52,15 +56,26 @@
 import java.io.IOException;
 import java.net.URI;
 import java.net.URISyntaxException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
+import java.util.Optional;
 import java.util.Properties;
 import java.util.TreeMap;
 import java.util.stream.Collectors;
 
+
 @Singleton
 @Named
 public class DefaultModelConverter implements ModelConverter {
+    // Confidence value for filename based identity detection
+    public static final double FILENAME_CONFIDENCE = 0.1;
+
+    // Confidence value for hash comparison based identity detection
+    public static final double HASH_COMPARISON_CONFIDENCE = 0.8;
     private final Logger logger = LoggerFactory.getLogger(DefaultModelConverter.class);
 
     @Inject
@@ -122,7 +137,7 @@ public String generateClassifierlessPackageUrl(final org.eclipse.aether.artifact
     }
 
     private boolean isEmpty(final String value) {
-        return (value == null) || (value.length() == 0);
+        return (value == null) || (value.isEmpty());
     }
 
     private String generatePackageUrl(final org.eclipse.aether.artifact.Artifact artifact, final boolean includeVersion, final boolean includeClassifier) {
@@ -184,10 +199,87 @@ public Component convertMavenDependency(Artifact artifact, CycloneDxSchema.Versi
                 logger.warn("Unable to create Maven project for " + artifact.getId() + " from repository.");
             }
         }
+        // Set component evidence for cyclonedx 1.5
+        if (CycloneDxSchema.Version.VERSION_15 == schemaVersion) {
+            addComponentEvidence(component, artifact);
+        }
         return component;
 
     }
 
+    /**
+     * Adds component identity evidence for the component using the filename, hash and gpg key files
+     *
+     * @param component Component for which the evidence needs to be attached
+     * @param artifact Maven artifact
+     */
+    private static void addComponentEvidence(final Component component, final Artifact artifact) {
+        if (artifact.getFile() != null) {
+            final List<Hash> sha1OrMd5Hashes = component.getHashes().stream().filter(hash -> hash.getAlgorithm().equals("SHA-1") || hash.getAlgorithm().equals("MD5")).collect(Collectors.toList());
+            final Evidence evidence = new Evidence();
+            final Identity identity = new Identity();
+            final List<Method> methods = new ArrayList<>();
+            final Method jarFileMethod = new Method();
+            final Method ascFileMethod = new Method();
+            double overallConfidence = 0.0;
+            final String jarPath = artifact.getFile().getAbsolutePath();
+            final String sha1Path = jarPath.replace(".jar", ".jar.sha1");
+            final String ascPath = jarPath.replace(".jar", ".jar.asc");
+            final String md5Path = jarPath.replace(".jar", ".jar.md5");
+            jarFileMethod.setValue(".m2/" + jarPath.replaceFirst("^(.*).m2/", ""));
+            jarFileMethod.setConfidence(FILENAME_CONFIDENCE);
+            jarFileMethod.setTechnique(Method.Technique.FILENAME);
+            methods.add(jarFileMethod);
+            overallConfidence += FILENAME_CONFIDENCE;
+            // For gpg signed artifacts, we can bump up the confidence a bit more
+            // In the future, there could be a setting to explicitly verify the gpg keys
+            if (Files.exists(Paths.get(ascPath))) {
+                ascFileMethod.setValue(".m2/" + ascPath.replaceFirst("^(.*).m2/", ""));
+                ascFileMethod.setConfidence(FILENAME_CONFIDENCE);
+                ascFileMethod.setTechnique(Method.Technique.FILENAME);
+                methods.add(ascFileMethod);
+                overallConfidence += FILENAME_CONFIDENCE;
+            }
+            final Path sha1FilePath = Paths.get(sha1Path);
+            final Path md5FilePath = Paths.get(md5Path);
+            if (!sha1OrMd5Hashes.isEmpty()) {
+                Path hashFileToUse = null;
+                // Prefer the .sha1 file followed by .md5
+                if (Files.exists(sha1FilePath)) {
+                    hashFileToUse = sha1FilePath;
+                } else if (Files.exists(md5FilePath)) {
+                    hashFileToUse = md5FilePath;
+                }
+                if (hashFileToUse != null) {
+                    try {
+                        final Optional<String> hashFileContent = Files.readAllLines(hashFileToUse).stream().findFirst();
+                        if (hashFileContent.isPresent()) {
+                            String storedHashValue = hashFileContent.get().split(" ")[0].trim();
+                            for (Hash sha1OrMd5Hash : sha1OrMd5Hashes) {
+                                if (storedHashValue.equals(sha1OrMd5Hash.getValue())) {
+                                    final Method hashMethod = new Method();
+                                    hashMethod.setConfidence(HASH_COMPARISON_CONFIDENCE);
+                                    overallConfidence += HASH_COMPARISON_CONFIDENCE;
+                                    hashMethod.setTechnique(Method.Technique.HASH_COMPARISON);
+                                    hashMethod.setValue(storedHashValue);
+                                    methods.add(hashMethod);
+                                    break;
+                                }
+                            }
+                        }
+                    } catch (IOException e) {
+                        // Invalid hash
+                    }
+                }
+            }
+            identity.setField(Identity.Field.PURL);
+            identity.setConfidence(overallConfidence);
+            identity.setMethods(methods);
+            evidence.setIdentity(identity);
+            component.setEvidence(evidence);
+        }
+    }
+
     private static void setExternalReferences(Component component, ExternalReference[] externalReferences) {
         if (externalReferences == null || externalReferences.length == 0) {
             return;
@@ -240,7 +332,7 @@ private void extractComponentMetadata(MavenProject project, Component component,
             if (project.getIssueManagement() != null) {
                 addExternalReference(ExternalReference.Type.ISSUE_TRACKER, project.getIssueManagement().getUrl(), component);
             }
-            if (project.getMailingLists() != null && project.getMailingLists().size() > 0) {
+            if (project.getMailingLists() != null && !project.getMailingLists().isEmpty()) {
                 for (MailingList list : project.getMailingLists()) {
                     String url = list.getArchive();
                     if (url == null) {
@@ -401,6 +493,6 @@ private Component.Type resolveProjectType(String projectType) {
     }
 
     private static boolean isURLBlank(String url) {
-        return url == null || url.isEmpty() || url.trim().length() == 0;
+        return url == null || url.isEmpty() || url.trim().isEmpty();
     }
 }

src/main/java/org/cyclonedx/maven/DefaultProjectDependenciesConverter.java

@@ -35,6 +35,7 @@
 import org.eclipse.aether.artifact.ArtifactProperties;
 import org.eclipse.aether.collection.CollectResult;
 import org.eclipse.aether.graph.DependencyNode;
+import org.eclipse.aether.repository.ArtifactRepository;
 import org.eclipse.aether.util.graph.transformer.ConflictResolver;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -66,6 +67,8 @@ public class DefaultProjectDependenciesConverter implements ProjectDependenciesC
     private Set<String> excludeTypesSet;
     private MavenDependencyScopes include;
 
+    final Map<String, ArtifactRepository> artifactRemoteRepositories = new LinkedHashMap<>();
+
     @Override
     public BomDependencies extractBOMDependencies(MavenProject mavenProject, MavenDependencyScopes include, String[] excludeTypes) throws MojoExecutionException {
         this.include = include;
@@ -77,9 +80,8 @@ public BomDependencies extractBOMDependencies(MavenProject mavenProject, MavenDe
         final Map<String, Artifact> mavenArtifacts = new LinkedHashMap<>();
         final Map<String, Artifact> mavenDependencyArtifacts = new LinkedHashMap<>();
         try {
-            final DelegatingRepositorySystem delegateRepositorySystem = new DelegatingRepositorySystem(aetherRepositorySystem);
+            final DelegatingRepositorySystem delegateRepositorySystem = new DelegatingRepositorySystem(aetherRepositorySystem, modelConverter, artifactRemoteRepositories);
             final DependencyCollectorBuilder dependencyCollectorBuilder = new DefaultDependencyCollectorBuilder(delegateRepositorySystem);
-
             final org.apache.maven.shared.dependency.graph.DependencyNode mavenRoot = dependencyCollectorBuilder.collectDependencyGraph(buildingRequest, null);
             populateArtifactMap(mavenArtifacts, mavenDependencyArtifacts, mavenRoot, 0);
 
@@ -98,7 +100,7 @@ public BomDependencies extractBOMDependencies(MavenProject mavenProject, MavenDe
             // rather than throwing an exception https://github.com/CycloneDX/cyclonedx-maven-plugin/issues/55
             logger.warn("An error occurred building dependency graph: " + e.getMessage());
         }
-        return new BomDependencies(dependencies, mavenArtifacts, mavenDependencyArtifacts);
+        return new BomDependencies(dependencies, mavenArtifacts, mavenDependencyArtifacts, artifactRemoteRepositories);
     }
 
     private void populateArtifactMap(final Map<String, Artifact> artifactMap, final Map<String, Artifact> dependencyArtifactMap, final org.apache.maven.shared.dependency.graph.DependencyNode node, final int level) {

src/main/java/org/cyclonedx/maven/DelegatingRepositorySystem.java

@@ -2,10 +2,12 @@
 
 import java.util.Collection;
 import java.util.List;
+import java.util.Map;
 
 import org.eclipse.aether.RepositorySystem;
 import org.eclipse.aether.RepositorySystemSession;
 import org.eclipse.aether.SyncContext;
+import org.eclipse.aether.artifact.Artifact;
 import org.eclipse.aether.collection.CollectRequest;
 import org.eclipse.aether.collection.CollectResult;
 import org.eclipse.aether.collection.DependencyCollectionException;
@@ -17,6 +19,7 @@
 import org.eclipse.aether.installation.InstallRequest;
 import org.eclipse.aether.installation.InstallResult;
 import org.eclipse.aether.installation.InstallationException;
+import org.eclipse.aether.repository.ArtifactRepository;
 import org.eclipse.aether.repository.LocalRepository;
 import org.eclipse.aether.repository.LocalRepositoryManager;
 import org.eclipse.aether.repository.RemoteRepository;
@@ -49,8 +52,18 @@ class DelegatingRepositorySystem implements RepositorySystem {
     private final RepositorySystem delegate;
     private CollectResult collectResult;
 
-    public DelegatingRepositorySystem(final RepositorySystem repositorySystem) {
+    private final ModelConverter modelConverter;
+
+    private final Map<String, ArtifactRepository> artifactRemoteRepositories;
+
+    public Map<String, ArtifactRepository> getArtifactRemoteRepositories() {
+        return artifactRemoteRepositories;
+    }
+
+    public DelegatingRepositorySystem(final RepositorySystem repositorySystem, final ModelConverter modelConverter, final Map<String, ArtifactRepository> artifactRemoteRepositories) {
         this.delegate = repositorySystem;
+        this.modelConverter = modelConverter;
+        this.artifactRemoteRepositories = artifactRemoteRepositories;
     }
 
     public CollectResult getCollectResult() {
@@ -69,7 +82,9 @@ public boolean visitEnter(final DependencyNode node)
                 if (root != node) {
                     try {
                         final ArtifactResult resolveArtifact = resolveArtifact(session, new ArtifactRequest(node));
-                        node.setArtifact(resolveArtifact.getArtifact());
+                        final Artifact artifact = resolveArtifact.getArtifact();
+                        node.setArtifact(artifact);
+                        artifactRemoteRepositories.put(modelConverter.generatePackageUrl(artifact), resolveArtifact.getRepository());
                     } catch (ArtifactResolutionException e) {} // ignored
                 }
                 return true;

src/main/java/org/cyclonedx/maven/ProjectDependenciesConverter.java

@@ -24,6 +24,7 @@
 import org.cyclonedx.model.Component;
 import org.cyclonedx.model.Dependency;
 import org.cyclonedx.model.Metadata;
+import org.eclipse.aether.repository.ArtifactRepository;
 
 import java.util.Map;
 
@@ -66,10 +67,13 @@ public static class BomDependencies {
         private final Map<String, Artifact> artifacts;
         private final Map<String, Artifact> dependencyArtifacts;
 
-        public BomDependencies(final Map<String, Dependency> dependencies, final Map<String, Artifact> artifacts, final Map<String, Artifact> dependencyArtifacts) {
+        private final Map<String, ArtifactRepository> artifactRemoteRepositories;
+
+        public BomDependencies(final Map<String, Dependency> dependencies, final Map<String, Artifact> artifacts, final Map<String, Artifact> dependencyArtifacts, final Map<String, ArtifactRepository> artifactRemoteRepositories) {
             this.dependencies = dependencies;
             this.artifacts = artifacts;
             this.dependencyArtifacts = dependencyArtifacts;
+            this.artifactRemoteRepositories = artifactRemoteRepositories;
         }
 
         public final Map<String, Dependency> getDependencies() {
@@ -83,5 +87,7 @@ public final Map<String, Artifact> getDependencyArtifacts() {
         public final Map<String, Artifact> getArtifacts() {
             return artifacts;
         }
+
+        public final Map<String, ArtifactRepository> getArtifactRemoteRepositories() { return artifactRemoteRepositories; }
     }
 }