Keep maven identification dataset for use by java cataloger
Open
ecosystem:java
enhancement
needs-research
online
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 954
- Avg merge
- 23h 27m
- Merged PRs (30d)
- 48
Description
It would be ideal to have a `sha1` to `groupID, artifactID` for jars that do not have `pom.xml` and are hosted on maven. This would help with the following issues:
- [x] https://github.com/anchore/syft/issues/2152
- [ ] (I think there are more...)
Keeping a dataset for a mapping of all of maven might be prohibitive, but we should investigate doing this for a subset of maven artifacts that do not have a `pom.xml` in the jar.
Contributor guide
Research direction
Start by reviewing the Java cataloger and issue #2152, then determine which Maven artifacts lack a pom.xml and whether a bounded dataset is viable. Done means documenting or implementing an agreed subset that maps jar SHA-1 values to groupID and artifactID.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- cli, devtools
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100