Project: FOSSA (Provisioning / Security & Compliance)
File: maven.md

For maven projects, we offer a more-accurate strategy (mavenplugin), and a strategy with zero requirements (pomxml). | Strategy | Direct Deps | Transitive Deps | Edges | Container Scanning | | -- | | | | | | | :whitecheckmark: | :whitecheckmark: | :whitecheckmark: | :x: | | | :whitecheckmark: | :whitecheckmark: | :whitecheckmark: | :x: | | | :whitecheckmark: | :x: | :x: | :whitecheckmark: | Maven analysis attempts these analysis methods in order: Run the maven plugin command version 4.0.1. Run the maven tree command. Run the maven plugin command version 3.3.0. Scan `pom.xml` files located in the file tree. FOSSA CLI uses for Maven commands: Maven candidate commands are: If present, the command specified by the `FOSSAMAVENCMD` environment variable. If present, the `mvnw` or `mvnw.bat` script in the project directory or any ancestor directory. Finally, the `mvn` command, which is searched for in `$PATH`. To choose a command from the candidates, FOSSA CLI runs each candidate with `-v` and selects the first one that succeeds. The mavenplugin and treecmd tactic can result in transitive dependencies which do not display paths to parents. This example graph shows how that can happen: ``` +- com.amazonaws:aws-java-sdk-kms:1.11.415:compile | +- com.amazonaws:aws-java-sdk-core:1.11.415:compile \- com.jayway.restassured:rest-assured:2.9.0:test +- org.apache.httpcomponents:httpclient:4.5.1:compile ``` `httpclient` will appear as a transitive dependency in the FOSSA UI, but it will not have any paths. There are a few things that contribute to this happening. `httpclient`'s only listed parent is `restassured` which is a `test` dependency, however, `httpclient` is a `compile`. This tells us that `httpclient` has another parent in the graph, but we are unable to determine where. You can use to provide maven dependency scopes that you would like to filter. You can filter by either inclusion or exclusion. When both scope-only and scope-exclude are provided, scope-only will take precedence and be used for filtering. ```yaml version: 3 maven: scope-only: compile runtime scope-exclude: provided system test ``` If you have maven project which has one or more subprojects, you may only want to analyze a specific set of subprojects in some cases. In `fossa-cli`, this can be achieved by using . 1) Run `fossa list-targets`, to identify project directory and identifier of subprojects. ```bash [ INFO] Found project: maven@./ [ INFO] Found target: maven@./:com.fossa:app [ INFO] Found target: maven@./:com.fossa:list [ INFO] Found target: maven@./:com.fossa:utilities ``` Note that, targets are denoted in following format `type@path:target`. For example `maven@./:com.fossa:utilities`: Note: maven submodules targets are composed of `<groupId>:<artifactId>`, so the utilities submodule here is referenced by "com.fossa:utilities" ``` maven @ ./ : com.fossa:utilities -- Type Path Path Target Target separator separator ``` 2) Now to analyze only `utilities`, use a `.fossa.yml` file in the project root. ```yaml version: 3 targets: only: type: maven path: ./ target: 'com.fossa:utilities' ``` Likewise, if you want to exclude specific set of subprojects, you can do following: ```yaml version: 3 targets: only: type: maven exclude: type: maven path: ./ target: 'com.fossa:app' type: gradle path: ./ target: 'com.fossa:utilities' ``` 1) Running `fossa analyze` will only analyze `list` submodule. <!-- TODO: write docs, like Gradle's. Docs outline: Concepts Multi-module reactor builds POMs and POM closures settings.xml Discovery Finding pom.xmls Tactics dependency:tree POM parsing -->