feat(java): capture licenses from pom.xml

.gitignore

@@ -15,3 +15,5 @@
 .idea
 
 /vendor
+
+**/.DS_Store

pkg/java/pom/artifact.go

@@ -18,18 +18,20 @@ type artifact struct {
 	GroupID    string
 	ArtifactID string
 	Version    version
+	License    string
 
 	Exclusions map[string]struct{}
 
 	Module bool
 	Root   bool
 }
 
-func newArtifact(groupID, artifactID, version string, props map[string]string) artifact {
+func newArtifact(groupID, artifactID, version, license string, props map[string]string) artifact {
 	return artifact{
 		GroupID:    evaluateVariable(groupID, props, nil),
 		ArtifactID: evaluateVariable(artifactID, props, nil),
 		Version:    newVersion(evaluateVariable(version, props, nil)),
+		License:    license,
 	}
 }
 

pkg/java/pom/parse.go

@@ -114,7 +114,7 @@ func (p *parser) parseRoot(root artifact) ([]types.Library, []types.Dependency,
 		libs              []types.Library
 		deps              []types.Dependency
 		rootDepManagement []pomDependency
-		uniqArtifacts     = map[string]version{}
+		uniqArtifacts     = map[string]artifact{}
 	)
 
 	// Iterate direct and transitive dependencies
@@ -136,8 +136,8 @@ func (p *parser) parseRoot(root artifact) ([]types.Library, []types.Dependency,
 		}
 
 		// For soft requirements, skip dependency resolution that has already been resolved.
-		if v, ok := uniqArtifacts[art.Name()]; ok {
-			if !v.shouldOverride(art.Version) {
+		if uniqueArt, ok := uniqArtifacts[art.Name()]; ok {
+			if !uniqueArt.Version.shouldOverride(art.Version) {
 				continue
 			}
 		}
@@ -169,15 +169,19 @@ func (p *parser) parseRoot(root artifact) ([]types.Library, []types.Dependency,
 		// Offline mode may be missing some fields.
 		if !art.IsEmpty() {
 			// Override the version
-			uniqArtifacts[art.Name()] = art.Version
+			uniqArtifacts[art.Name()] = artifact{
+				Version: art.Version,
+				License: art.License,
+			}
 		}
 	}
 
 	// Convert to []types.Library
-	for name, ver := range uniqArtifacts {
+	for name, art := range uniqArtifacts {
 		libs = append(libs, types.Library{
 			Name:    name,
-			Version: ver.String(),
+			Version: art.Version.String(),
+			License: art.License,
 		})
 	}
 
@@ -336,7 +340,7 @@ func (p *parser) resolveDepManagement(props map[string]string, depManagement []p
 	// Managed dependencies with a scope of "import" should be processed after other managed dependencies.
 	// cf. https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#importing-dependencies
 	for _, imp := range imports {
-		art := newArtifact(imp.GroupID, imp.ArtifactID, imp.Version, props)
+		art := newArtifact(imp.GroupID, imp.ArtifactID, imp.Version, "", props)
 		result, err := p.resolve(art, nil)
 		if err != nil {
 			continue
@@ -386,7 +390,7 @@ func excludeDep(exclusions map[string]struct{}, art artifact) bool {
 
 func (p *parser) parseParent(currentPath string, parent pomParent) (analysisResult, error) {
 	// Pass nil properties so that variables in <parent> are not evaluated.
-	target := newArtifact(parent.GroupId, parent.ArtifactId, parent.Version, nil)
+	target := newArtifact(parent.GroupId, parent.ArtifactId, parent.Version, "", nil)
 	if target.IsEmpty() {
 		return analysisResult{}, nil
 	}

pkg/java/pom/parse_test.go

@@ -32,6 +32,7 @@ func TestPom_Parse(t *testing.T) {
 				{
 					Name:    "com.example:happy",
 					Version: "1.0.0",
+					License: "BSD-3-Clause",
 				},
 				{
 					Name:    "org.example:example-api",
@@ -47,6 +48,7 @@ func TestPom_Parse(t *testing.T) {
 				{
 					Name:    "com.example:happy",
 					Version: "1.0.0",
+					License: "BSD-3-Clause",
 				},
 				{
 					Name:    "org.example:example-api",
@@ -74,6 +76,7 @@ func TestPom_Parse(t *testing.T) {
 				{
 					Name:    "com.example:child",
 					Version: "1.0.0",
+					License: "Apache 2.0",
 				},
 				{
 					Name:    "org.example:example-api",
@@ -138,6 +141,7 @@ func TestPom_Parse(t *testing.T) {
 				{
 					Name:    "com.example:child",
 					Version: "1.0.0-SNAPSHOT",
+					License: "Apache 2.0",
 				},
 				{
 					Name:    "org.example:example-api",
@@ -153,6 +157,7 @@ func TestPom_Parse(t *testing.T) {
 				{
 					Name:    "com.example:child",
 					Version: "3.0.0",
+					License: "Apache 2.0",
 				},
 				{
 					Name:    "org.example:example-api",
@@ -168,6 +173,7 @@ func TestPom_Parse(t *testing.T) {
 				{
 					Name:    "com.example:base",
 					Version: "4.0.0",
+					License: "Apache 2.0",
 				},
 				{
 					Name:    "org.example:example-api",
@@ -187,6 +193,7 @@ func TestPom_Parse(t *testing.T) {
 				{
 					Name:    "com.example:child",
 					Version: "1.0.0",
+					License: "Apache 2.0",
 				},
 				{
 					Name:    "org.example:example-api",
@@ -202,6 +209,7 @@ func TestPom_Parse(t *testing.T) {
 				{
 					Name:    "org.example:child",
 					Version: "1.0.0",
+					License: "Apache 2.0",
 				},
 				{
 					Name:    "org.example:example-api",
@@ -217,6 +225,7 @@ func TestPom_Parse(t *testing.T) {
 				{
 					Name:    "com.example:soft",
 					Version: "1.0.0",
+					License: "Apache 2.0",
 				},
 				{
 					Name:    "org.example:example-api",
@@ -259,6 +268,7 @@ func TestPom_Parse(t *testing.T) {
 				{
 					Name:    "com.example:hard",
 					Version: "1.0.0",
+					License: "Apache 2.0",
 				},
 				{
 					Name:    "org.example:example-api",
@@ -278,6 +288,7 @@ func TestPom_Parse(t *testing.T) {
 				{
 					Name:    "com.example:hard",
 					Version: "1.0.0",
+					License: "Apache 2.0",
 				},
 			},
 		},
@@ -289,6 +300,7 @@ func TestPom_Parse(t *testing.T) {
 				{
 					Name:    "com.example:import",
 					Version: "2.0.0",
+					License: "Apache 2.0",
 				},
 				{
 					Name:    "org.example:example-api",
@@ -304,6 +316,7 @@ func TestPom_Parse(t *testing.T) {
 				{
 					Name:    "com.example:import",
 					Version: "2.0.0",
+					License: "Apache 2.0",
 				},
 				{
 					Name:    "org.example:example-api",
@@ -361,10 +374,12 @@ func TestPom_Parse(t *testing.T) {
 				{
 					Name:    "com.example:aggregation",
 					Version: "1.0.0",
+					License: "Apache 2.0",
 				},
 				{
 					Name:    "com.example:module",
 					Version: "1.1.1",
+					License: "Apache 2.0",
 				},
 				{
 					Name:    "org.example:example-api",
@@ -457,6 +472,7 @@ func TestPom_Parse(t *testing.T) {
 				{
 					Name:    "com.example:no-parent",
 					Version: "1.0-SNAPSHOT",
+					License: "Apache 2.0",
 				},
 				{
 					Name:    "org.example:example-api",
@@ -472,6 +488,7 @@ func TestPom_Parse(t *testing.T) {
 				{
 					Name:    "com.example:not-found-dependency",
 					Version: "1.0.0",
+					License: "Apache 2.0",
 				},
 				{
 					Name:    "org.example:example-not-found",
@@ -487,6 +504,19 @@ func TestPom_Parse(t *testing.T) {
 				{
 					Name:    "com.example:aggregation",
 					Version: "1.0.0",
+					License: "Apache 2.0",
+				},
+			},
+		},
+		{
+			name:      "multiply licenses",
+			inputFile: filepath.Join("testdata", "multiply-licenses", "pom.xml"),
+			local:     true,
+			want: []types.Library{
+				{
+					Name:    "com.example:multiply-licenses",
+					Version: "1.0.0",
+					License: "MIT, Apache 2.0",
 				},
 			},
 		},

pkg/java/pom/pom.go

@@ -91,7 +91,17 @@ func (p pom) listProperties(val reflect.Value) map[string]string {
 }
 
 func (p pom) artifact() artifact {
-	return newArtifact(p.content.GroupId, p.content.ArtifactId, p.content.Version, p.content.Properties)
+	return newArtifact(p.content.GroupId, p.content.ArtifactId, p.content.Version, p.joinLicenses(), p.content.Properties)
+}
+
+func (p pom) joinLicenses() string {
+	var licenses []string
+	for _, license := range p.content.Licenses.License {
+		if license.Name != "" {
+			licenses = append(licenses, license.Name)
+		}
+	}
+	return strings.Join(licenses, ", ")
 }
 
 func (p pom) repositories() []string {
@@ -109,7 +119,12 @@ type pomXML struct {
 	GroupId    string    `xml:"groupId"`
 	ArtifactId string    `xml:"artifactId"`
 	Version    string    `xml:"version"`
-	Modules    struct {
+	Licenses   struct {
+		License []struct {
+			Name string `xml:"name"`
+		} `xml:"license"`
+	} `xml:"licenses"`
+	Modules struct {
 		Text   string   `xml:",chardata"`
 		Module []string `xml:"module"`
 	} `xml:"modules"`

pkg/java/pom/testdata/happy/pom.xml

@@ -11,8 +11,8 @@
 
     <licenses>
         <license>
-            <name>Apache 2.0</name>
-            <url>http://www.apache.org/licenses/LICENSE-2.0.html</url>
+            <name>BSD-3-Clause</name>
+            <url>https://opensource.org/licenses/BSD-3-Clause</url>
             <distribution>repo</distribution>
         </license>
     </licenses>

pkg/java/pom/testdata/multiply-licenses/pom.xml

@@ -0,0 +1,23 @@
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>com.example</groupId>
+    <artifactId>multiply-licenses</artifactId>
+    <version>1.0.0</version>
+
+    <name>multiply-licenses</name>
+    <description>Example</description>
+
+    <licenses>
+        <license>
+            <name>MIT</name>
+            <comments>All source code is under the MIT license.</comments>
+        </license>
+        <license>
+            <name>Apache 2.0</name>
+            <url>http://www.apache.org/licenses/LICENSE-2.0.html</url>
+            <distribution>repo</distribution>
+        </license>
+    </licenses>
+</project>