syft icon indicating copy to clipboard operation
syft copied to clipboard

Use `mvn dependency:tree` to resolve dependency information for Maven source

Open kzantow opened this issue 1 year ago • 1 comments

kzantow avatar Aug 11 '23 18:08 kzantow

I've considered this while building #2669, but:

  1. Using mvn help:effective-pom to generate an effective-pom.xml allows us to re-use the existing pom parsing code. Otherwise additional parsing of the mvn dependency:treeoutput (however simple) would be needed. And the pom parsing code would still be needed to parse pom.xml files embedded in (Java) archives.
  2. mvn dependency:tree is quite a bit to a lot slower, than mvn help:effective-pom

GijsCalis avatar Feb 29 '24 19:02 GijsCalis