Add location to dependencies in telemetry

[smola]

What Does This Do

Adds a location field to each dependency in telemetry.

The location will serve as a hint for users to understand where a dependency was found. This is currently a challenge for shaded dependencies and nested jars.

Some examples of location:

• mydep-1.2.jar
• mydep.jar!/META-INF/maven/my.dep/pom.properties
• myapp.jar!/BOOT-INF/lib/mydep.1.2.jar

Motivation

Additional Notes

Jira ticket: APPSEC-11466

To Do:

• [ ] Wait for final approval of the schema change.

[pr-commenter[bot]]

Benchmarks

Startup

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
git_branch	master	smola/APPSEC-11466-dep-location
git_commit_date	1707372699	1707380808
git_commit_sha	0869a9dc67	05154da91a
release_version	1.30.0-SNAPSHOT~0869a9dc67	1.30.0-SNAPSHOT~05154da91a

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1707383869	1707383869
ci_job_id	429105289	429105289
ci_pipeline_id	27941676	27941676
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
module	Agent	Agent
parent	None	None
variant	iast	iast

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 45 metrics, 9 unstable metrics.

Load

Parameters

	Baseline	Candidate
baseline_or_candidate	baseline	candidate
end_time	2024-02-08T08:53:51	2024-02-08T09:12:46
git_branch	master	smola/APPSEC-11466-dep-location
git_commit_date	1707372699	1707380808
git_commit_sha	0869a9dc67	05154da91a
release_version	1.30.0-SNAPSHOT~0869a9dc67	1.30.0-SNAPSHOT~05154da91a
start_time	2024-02-08T08:53:38	2024-02-08T09:12:33

See matching parameters

	Baseline	Candidate
application	insecure-bank	insecure-bank
ci_job_date	1707383869	1707383869
ci_job_id	429105289	429105289
ci_pipeline_id	27941676	27941676
cpu_model	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz	Intel(R) Xeon(R) Platinum 8259CL CPU @ 2.50GHz
variant	iast	iast

Summary

Found 0 performance improvements and 0 performance regressions! Performance is the same for 10 metrics, 16 unstable metrics.

Request duration reports for insecure-bank

gantt
    title insecure-bank - request duration [CI 0.99] : candidate=1.30.0-SNAPSHOT~05154da91a, baseline=1.30.0-SNAPSHOT~0869a9dc67
    dateFormat X
    axisFormat %s
section baseline
no_agent (364.971 µs) : 345, 385
.   : milestone, 365,
iast (471.691 µs) : 450, 493
.   : milestone, 472,
iast_FULL (532.715 µs) : 512, 553
.   : milestone, 533,
iast_GLOBAL (501.622 µs) : 480, 523
.   : milestone, 502,
iast_HARDCODED_SECRET_DISABLED (471.729 µs) : 451, 493
.   : milestone, 472,
iast_INACTIVE (447.997 µs) : 427, 469
.   : milestone, 448,
iast_TELEMETRY_OFF (468.845 µs) : 448, 489
.   : milestone, 469,
tracing (442.635 µs) : 422, 463
.   : milestone, 443,
section candidate
no_agent (365.735 µs) : 346, 386
.   : milestone, 366,
iast (475.902 µs) : 455, 497
.   : milestone, 476,
iast_FULL (532.868 µs) : 512, 554
.   : milestone, 533,
iast_GLOBAL (487.877 µs) : 468, 508
.   : milestone, 488,
iast_HARDCODED_SECRET_DISABLED (472.056 µs) : 451, 493
.   : milestone, 472,
iast_INACTIVE (443.922 µs) : 423, 465
.   : milestone, 444,
iast_TELEMETRY_OFF (470.33 µs) : 449, 491
.   : milestone, 470,
tracing (449.216 µs) : 427, 471
.   : milestone, 449,

• baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	364.971 µs [344.588 µs, 385.354 µs]	-
iast	471.691 µs [450.242 µs, 493.141 µs]	106.721 µs (29.2%)
iast_FULL	532.715 µs [512.057 µs, 553.373 µs]	167.744 µs (46.0%)
iast_GLOBAL	501.622 µs [479.757 µs, 523.488 µs]	136.652 µs (37.4%)
iast_HARDCODED_SECRET_DISABLED	471.729 µs [450.736 µs, 492.721 µs]	106.758 µs (29.3%)
iast_INACTIVE	447.997 µs [426.529 µs, 469.464 µs]	83.026 µs (22.7%)
iast_TELEMETRY_OFF	468.845 µs [448.279 µs, 489.412 µs]	103.875 µs (28.5%)
tracing	442.635 µs [422.176 µs, 463.094 µs]	77.664 µs (21.3%)

• candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	365.735 µs [345.912 µs, 385.558 µs]	-
iast	475.902 µs [455.03 µs, 496.775 µs]	110.168 µs (30.1%)
iast_FULL	532.868 µs [512.031 µs, 553.705 µs]	167.133 µs (45.7%)
iast_GLOBAL	487.877 µs [467.579 µs, 508.175 µs]	122.142 µs (33.4%)
iast_HARDCODED_SECRET_DISABLED	472.056 µs [450.787 µs, 493.325 µs]	106.321 µs (29.1%)
iast_INACTIVE	443.922 µs [422.53 µs, 465.314 µs]	78.187 µs (21.4%)
iast_TELEMETRY_OFF	470.33 µs [449.489 µs, 491.171 µs]	104.595 µs (28.6%)
tracing	449.216 µs [427.346 µs, 471.086 µs]	83.481 µs (22.8%)

Request duration reports for petclinic

gantt
    title petclinic - request duration [CI 0.99] : candidate=1.30.0-SNAPSHOT~05154da91a, baseline=1.30.0-SNAPSHOT~0869a9dc67
    dateFormat X
    axisFormat %s
section baseline
no_agent (1.357 ms) : 1338, 1376
.   : milestone, 1357,
appsec (1.75 ms) : 1725, 1776
.   : milestone, 1750,
iast (1.51 ms) : 1486, 1534
.   : milestone, 1510,
profiling (1.544 ms) : 1518, 1571
.   : milestone, 1544,
tracing (1.489 ms) : 1464, 1514
.   : milestone, 1489,
section candidate
no_agent (1.355 ms) : 1336, 1374
.   : milestone, 1355,
appsec (1.771 ms) : 1745, 1797
.   : milestone, 1771,
iast (1.511 ms) : 1486, 1535
.   : milestone, 1511,
profiling (1.6 ms) : 1575, 1626
.   : milestone, 1600,
tracing (1.501 ms) : 1477, 1526
.   : milestone, 1501,

• baseline results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.357 ms [1.338 ms, 1.376 ms]	-
appsec	1.75 ms [1.725 ms, 1.776 ms]	393.768 µs (29.0%)
iast	1.51 ms [1.486 ms, 1.534 ms]	153.417 µs (11.3%)
profiling	1.544 ms [1.518 ms, 1.571 ms]	187.54 µs (13.8%)
tracing	1.489 ms [1.464 ms, 1.514 ms]	132.02 µs (9.7%)

• candidate results

Variant	Request duration [CI 0.99]	Δ no_agent
no_agent	1.355 ms [1.336 ms, 1.374 ms]	-
appsec	1.771 ms [1.745 ms, 1.797 ms]	415.962 µs (30.7%)
iast	1.511 ms [1.486 ms, 1.535 ms]	155.372 µs (11.5%)
profiling	1.6 ms [1.575 ms, 1.626 ms]	244.989 µs (18.1%)
tracing	1.501 ms [1.477 ms, 1.526 ms]	145.791 µs (10.8%)