Empty version field on some dependencies when reading pom.xml #1129
Assignees
Labels
bug
Something isn't working
Comments
|
Related to the same issue we see that versions provided as parameter in the For example we see results like: while in |
|
I attempted to reproduce this without luck from the portion, can you provide the full |
|
Hi @wagoodman 👋, thank you for showing interest on this issue. Further investigation leaded to some findings. As @bsoroushian mentioned, parametrized versions are not evaluated when grype reads This $ syft packages file:pom.xml
✔ Indexed pom.xml
✔ Cataloged packages [33 packages]
NAME VERSION TYPE
commons-codec 1.14 java-archive
commons-io 2.7 java-archive
easy-random-core ${easy-random-core.version} java-archive
easy-random-randomizers ${easy-random-core.version} java-archive
gson 2.8.9 java-archive
guava 31.1-jre java-archive
h2 2.1.214 java-archive
jackson-module-kotlin 2.13.3 java-archive
joda-time 2.10.14 java-archive
json 20220320 java-archive
junit-jupiter-api java-archive
junit-jupiter-engine java-archive
kafka-clients 6.2.0-ccs java-archive
kafka-json-serializer 6.2.0 java-archive
kafka-streams 6.2.0-ccs java-archive
kafka-streams-test-utils 6.2.0-ccs java-archive
kotlin-maven-allopen ${kotlin.version} java-archive
kotlin-reflect ${kotlin.version} java-archive
kotlin-stdlib ${kotlin.version} java-archive
micrometer-registry-prometheus ${micrometer.version} java-archive
mockk ${io.mockk.version} java-archive
opentracing-spring-cloud-starter 0.5.9 java-archive
opentracing-spring-jaeger-cloud-starter 3.3.1 java-archive
spring-boot-starter-actuator java-archive
spring-boot-starter-data-jpa java-archive
spring-boot-starter-data-mongodb java-archive
spring-boot-starter-security java-archive
spring-boot-starter-test java-archive
spring-boot-starter-web java-archive
spring-cloud-starter-openfeign java-archive
spring-security-test java-archive
springdoc-openapi-kotlin ${springdoc-openapi.version} java-archive
springdoc-openapi-ui ${springdoc-openapi.version} java-archivethe output shown avobe was created scanning the following <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.org.services</groupId>
<artifactId>product-name</artifactId>
<version>1.0.0</version>
<parent>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-parent</artifactId>
<version>2.7.2</version>
<relativePath/>
</parent>
<properties>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<spring.framework.version>5.3.1.RELEASE</spring.framework.version>
<java.version>11</java.version>
<sonar.coverage.exclusions>
**/configuration/**/*,
**/exception/**/*,
**/model/**/*,
**/ConstantsUtils.kt,
**/Application.kt,
</sonar.coverage.exclusions>
<sonar.java.coveragePlugin>jacoco</sonar.java.coveragePlugin>
<sonar.dynamicAnalysis>reuseReports</sonar.dynamicAnalysis>
<sonar.jacoco.reportPaths>${basedir}/target/jacoco.exec</sonar.jacoco.reportPaths>
<sonar.language>kotlin</sonar.language>
<jacoco.version>0.8.7</jacoco.version>
<springdoc-openapi.version>1.6.9</springdoc-openapi.version>
<micrometer.version>1.9.3</micrometer.version>
<kotlin.version>1.7.10</kotlin.version>
<io.mockk.version>1.10.3</io.mockk.version>
<kotlin.compiler.incremental>true</kotlin.compiler.incremental>
<dokka.version>1.6.21</dokka.version>
<openfeign.version>3.0.6</openfeign.version>
<openfeign.core.version>2.2.6.RELEASE</openfeign.core.version>
<easy-random-core.version>5.0.0</easy-random-core.version>
</properties>
<repositories>
<repository>
<id>confluent</id>
<url>https://packages.confluent.io/maven/</url>
</repository>
</repositories>
<dependencyManagement>
<dependencies>
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-dependencies</artifactId>
<version>2021.0.3</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-actuator</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-jpa</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-mongodb</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springdoc</groupId>
<artifactId>springdoc-openapi-ui</artifactId>
<version>${springdoc-openapi.version}</version>
</dependency>
<dependency>
<groupId>org.springdoc</groupId>
<artifactId>springdoc-openapi-kotlin</artifactId>
<version>${springdoc-openapi.version}</version>
</dependency>
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>31.1-jre</version>
</dependency>
<dependency>
<groupId>io.micrometer</groupId>
<artifactId>micrometer-registry-prometheus</artifactId>
<version>${micrometer.version}</version>
</dependency>
<dependency>
<groupId>com.h2database</groupId>
<artifactId>h2</artifactId>
<version>2.1.214</version>
</dependency>
<dependency>
<groupId>commons-codec</groupId>
<artifactId>commons-codec</artifactId>
<version>1.14</version>
</dependency>
<dependency>
<groupId>commons-io</groupId>
<artifactId>commons-io</artifactId>
<version>2.7</version>
</dependency>
<dependency>
<groupId>org.json</groupId>
<artifactId>json</artifactId>
<version>20220320</version>
</dependency>
<dependency>
<groupId>joda-time</groupId>
<artifactId>joda-time</artifactId>
<version>2.10.14</version>
</dependency>
<dependency>
<groupId>com.google.code.gson</groupId>
<artifactId>gson</artifactId>
<version>2.8.9</version>
</dependency>
<dependency>
<groupId>org.jetbrains.kotlin</groupId>
<artifactId>kotlin-stdlib</artifactId>
<version>${kotlin.version}</version>
</dependency>
<dependency>
<groupId>org.jetbrains.kotlin</groupId>
<artifactId>kotlin-reflect</artifactId>
<version>${kotlin.version}</version>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.module</groupId>
<artifactId>jackson-module-kotlin</artifactId>
<version>2.13.3</version>
</dependency>
<dependency>
<groupId>org.jetbrains.kotlin</groupId>
<artifactId>kotlin-maven-allopen</artifactId>
<version>${kotlin.version}</version>
</dependency>
<dependency>
<groupId>io.mockk</groupId>
<artifactId>mockk</artifactId>
<version>${io.mockk.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-test</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-engine</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.junit.jupiter</groupId>
<artifactId>junit-jupiter-api</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.apache.kafka</groupId>
<artifactId>kafka-streams</artifactId>
<version>6.2.0-ccs</version>
</dependency>
<dependency>
<groupId>org.apache.kafka</groupId>
<artifactId>kafka-clients</artifactId>
<version>6.2.0-ccs</version>
</dependency>
<dependency>
<groupId>io.confluent</groupId>
<artifactId>kafka-json-serializer</artifactId>
<version>6.2.0</version>
</dependency>
<dependency>
<groupId>org.apache.kafka</groupId>
<artifactId>kafka-streams-test-utils</artifactId>
<version>6.2.0-ccs</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>io.opentracing.contrib</groupId>
<artifactId>opentracing-spring-cloud-starter</artifactId>
<version>0.5.9</version>
</dependency>
<dependency>
<groupId>io.opentracing.contrib</groupId>
<artifactId>opentracing-spring-jaeger-cloud-starter</artifactId>
<version>3.3.1</version>
</dependency>
<!-- Feign dependencies -->
<dependency>
<groupId>org.springframework.cloud</groupId>
<artifactId>spring-cloud-starter-openfeign</artifactId>
<!--<version>${openfeign.version}</version>-->
</dependency>
<!-- Easy random dependencies -->
<dependency>
<groupId>org.jeasy</groupId>
<artifactId>easy-random-core</artifactId>
<version>${easy-random-core.version}</version>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.jeasy</groupId>
<artifactId>easy-random-randomizers</artifactId>
<version>${easy-random-core.version}</version>
<scope>test</scope>
</dependency>
</dependencies>
<build>
<sourceDirectory>${project.basedir}/src/main/kotlin</sourceDirectory>
<testSourceDirectory>${project.basedir}/src/test/kotlin</testSourceDirectory>
<plugins>
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
</plugin>
<plugin>
<groupId>org.sonarsource.scanner.maven</groupId>
<artifactId>sonar-maven-plugin</artifactId>
<version>3.6.0.1398</version>
</plugin>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
<version>2.22.2</version>
<configuration>
<skipTests>false</skipTests>
<testFailureIgnore>true</testFailureIgnore>
<forkMode>once</forkMode>
</configuration>
</plugin>
<plugin>
<groupId>org.jacoco</groupId>
<artifactId>jacoco-maven-plugin</artifactId>
<version>${jacoco.version}</version>
<executions>
<execution>
<id>default-prepare-agent</id>
<goals>
<goal>prepare-agent</goal>
</goals>
</execution>
<execution>
<id>default-report</id>
<phase>test</phase>
<goals>
<goal>report</goal>
</goals>
</execution>
</executions>
</plugin>
<plugin>
<artifactId>kotlin-maven-plugin</artifactId>
<groupId>org.jetbrains.kotlin</groupId>
<version>${kotlin.version}</version>
<configuration>
<compilerPlugins>
<plugin>spring</plugin>
</compilerPlugins>
<jvmTarget>11</jvmTarget>
<languageVersion>1.5</languageVersion>
</configuration>
<executions>
<execution>
<id>compile</id>
<phase>compile</phase>
<goals>
<goal>compile</goal>
</goals>
</execution>
<execution>
<id>test-compile</id>
<phase>test-compile</phase>
<goals>
<goal>test-compile</goal>
</goals>
</execution>
</executions>
<dependencies>
<dependency>
<groupId>org.jetbrains.kotlin</groupId>
<artifactId>kotlin-maven-allopen</artifactId>
<version>${kotlin.version}</version>
</dependency>
</dependencies>
</plugin>
</plugins>
</build>
</project>
|
|
Related to this, Syft generates a malformed "purl" which does not parse as a URI. I believe the dollar # these version strings are not being uri/percent-encoded when generating the "purl" string. |
|
Hi team, any update on this? I am getting empty version numbers for all my pom.xml dependencies (even the ones specifying a version number directly. Here is the packages command output: Using Sift version: syft 0.69.1 |
|
Related to #1251 |
|
maven version properties are now supported via #1251. But looks like parent versions are still unsupported (eg: the spring-boot-starter-parent) example shared above. Is that correct? |
|
@setchy this is correct -- also currently the versions specified in |
|
@khan-a1 -- given the POM you provided, I don't see any versions specified directly but rather specified in the |
|
I've added this to our backlog, but can't say when it will bubble up to the top |
|
This PR should be fixed by #2769 |
# for free
to join this conversation on GitHub.
Already have an account?
# to comment
What happened:
Syft does not detect the current version of some dependencies when scanning a maven project.
What you expected to happen:
Syft shows the current version of every package listed on pom.xml when scanning a maven project.
How to reproduce it (as minimally and precisely as possible):
On a maven project with some dependencies run
syft dir:.. The output of the command is the following:Anything else we need to know?:
I also tried running
syft dir:. -o jsonto check if the issue was with one specific report format. The version field on some dependencies is also empty (example below).Environment:
syft version:cat /etc/os-releaseor similar): Tested on Ubuntu 20.04.4 LTS using WSL on top of Windows 11The text was updated successfully, but these errors were encountered: