Maven Model

[vorburger]

The pkg: scheme, à la pkg:maven/ch.vorburger.mariaDB4j/[email protected], is shown e.g. on https://central.sonatype.com/artifact/ch.vorburger.mariaDB4j/mariaDB4j.

But it's not "standard" (IANA), and also already used e.g. by the the uri-scheme package for Node.js as a prefix for custom URI schemes used by mobile apps, according to Google Gemini - although https://www.npmjs.com/package/uri-scheme does not mention it.

An Enola specific URL template may be simplest; I'm thinking e.g. something like https://enola.dev/java/maven/central/ch.vorburger.mariaDB4j/mariaDB4j-core/3.1.0 perhaps. (Where central could alternatively also be either an alias or an encoded full URL e.g. to an in-house repo.)

Unless Security (CVE) community already have a useful URI standard for packages, such as Maven? (And others, probably.)

https://spdx.dev might have something we could map to?

[vorburger]

https://maven.apache.org/repository/central-index.html

Unless Security (CVE) community already have a useful URI standard for packages, such as Maven? (And others, probably.)

CPE pkg:maven/com.google.protobuf/protobuf-java

• https://osv.dev/list?ecosystem=Maven
• https://docs.dependencytrack.org/datasources/routing/
• https://owasp.org/www-project-web-security-testing-guide/latest/5-Reporting/02-Naming_Schemes
• https://en.wikipedia.org/wiki/Common_Platform_Enumeration
• https://github.com/jeremylong/DependencyCheck/wiki/How-does-it-work%3F ?
• Java: Read CPE from MANIFEST jeremylong/DependencyCheck#4207
• https://csrc.nist.gov/projects/security-content-automation-protocol/specifications/cpe
• https://nvd.nist.gov/products/cpe
• https://mvnrepository.com/artifact/org.mitre.cpe/cpe/2.3.4
• https://sourceforge.net/projects/cpereferenceimp/

[vorburger]

dev.enola.model.enola.maven.GAV is just a Java record of type https://enola.dev/maven/GAV, which has:

• group
• artifact
• version
• packaging (open?) Enum pom, jar, ...
• repo

The dev.enola.model.enola.maven.PackageUriScheneGAVConverter is a BidiConverter<URI,GAV> for e.g. pkg:maven/ch.vorburger.mariaDB4j/[email protected]`.

The dev.enola.model.enola.maven.GradleGAVConverter is a BidiConverter<String,GAV> for e.g. ch.vorburger.mariaDB4j:mariaDB4j:3.1.0or (TBC)ch.vorburger.mariaDB4j:mariaDB4j:jar:3.1.0`.

An https://enola.dev/maven/Artifact is of course based on https://maven.apache.org/pom.html, but only a subset of it, namely:

• IRI is PURL, like pkg:maven/ch.vorburger.mariaDB4j/[email protected]
• name
• description
• group
• artifact
• version
• packaging: https://enola.dev/maven/pom, /jar
• repo (singular, not plural)
• sha1
• sha512
• signature (Initial Cryptographic Support to have (some parts of) models en/de/crypted #284)
• lineages (parent/s): Dependency
• dependencies: Dependency[]
• dependants
• rawPom: string (of XML, but just string, not a DOM; but http://maven.apache.org/POM/4.0.0, not rdf:XMLLiteral)
• effectivePom - same
• licenses
• projectUrl, from <url> in POM, e.g. https://github.com/vorburger/MariaDB4j
• artifactUrl (or just use enola:origin?) from fetch origin base, e.g. https://repo1.maven.org/maven2/ch/vorburger/mariaDB4j/mariaDB4j-core/3.1.0/
• developers
• contributors
• organization
• scm (developerConnection): e.g. scm:git:[email protected]:vorburger/[email protected]
• timestamp (https://enola.dev/timestamp; see ThingTimeProvider), from HTTP last modified header (not POM)

Dependency is:

• gav: GAV
• scope: https://enola.dev/maven/test
• classifier (?)
• exclusions

[vorburger]

dev.enola.model.enola.maven.MavenConnector is an AsyncConverter API, which (asynchronously) converts an (input) GAV, and optionally a list of repository URLs, into an (output) Artifact.

It's implemented using e.g. https://get-coursier.io/docs/api or https://maven.apache.org/resolver/.

#1062 tracks (the beginning of) doing this part.

[vorburger]

A "crawler" e.g. for https://repo1.maven.org/maven2/ (or any other Maven repo layout file or HTTP) would be cool. Can visualize as as Graph, Timeline, or individual things.

But this requires first writing a HTTP Directory Index HTML page parser (using JSoup, of course).