syft
syft copied to clipboard
Use `mvn dependency:tree` to resolve dependency information for Maven source
I've considered this while building #2669, but:
- Using
mvn help:effective-pom
to generate an effective-pom.xml allows us to re-use the existing pom parsing code. Otherwise additional parsing of themvn dependency:tree
output (however simple) would be needed. And the pom parsing code would still be needed to parse pom.xml files embedded in (Java) archives. -
mvn dependency:tree
is quite a bit to a lot slower, thanmvn help:effective-pom