sellersj / artifact-checker Goto Github PK

You can get the scm checkin date / time of the tag using a command like
git log --tags="*4.0.21.1" -n 1 --simplify-by-decoration --pretty="format:%ai"

Need to figure out the difference between "author date" and "committer date"
References
https://devhints.io/git-log
https://devhints.io/git-log-format

When running the tests, you get
Corrupted STDOUT by directly writing to native stream in forked JVM 1

This is due to surefire and the forked process.

Something similar to below might be the solution.
https://github.com/allegro/embedded-elasticsearch/pull/48/files

When the app is run under java 11, there are some date formats that fail.

See
https://stackoverflow.com/questions/50248220/java-time-format-datetimeparseexception-text-mi-mai-09-091724-2018-could-no
https://stackoverflow.com/questions/46244724/jdk-dateformatter-parsing-dayofweek-in-german-locale-java8-vs-java9

Failing tests
AppTest getDeploymentDateAsStringActualValueHasManySpacesInIt
AppTest getDeploymentDateAsStringActualValue
ArtifactAttributesTest getDeploymentDateHasAllValues

The issue is DateUtils#parseToDate
Example input: "Thu Mar 5 07:05:10 2015"

For projects that can do a successful clone, we can capture what artifacts are created. If we capture this, then we can create processes to clean up artifacts outside this project.

This can be done via command line like. We should put it into a standard maven format that matches dependency:tree or similar (below is an example, not the actual correct format)

mvn -q exec:exec -Dexec.executable='echo' -Dexec.args='${project.groupId} ${project.artifactId} ${project.version} ${project.packaging}'

Generate the java classes needed at build time.

Possible way:
Extract the schema out of the artifact
https://github.com/jeremylong/DependencyCheck/tree/master/core/src/main/resources/schema

Run a xsd to json schema

Generate the java classes from the json schema
https://github.com/joelittlejohn/jsonschema2pojo

Not sure what the best way to do this right now.

Options

• runtime arg for suppression files
• drop suppression file into a directory like target/owasp-dependency-check-suppression/ and auto detect if those files are there
• env var with file
• detect (somehow) if the value is set in the settings.xml

In order to use the info from this for artifact cleanup, we need to have an accurate timestamp for build date.

For the artifacts that don't have a build date, if they have enough GAV info, query nexus to get back the build timestamp.

The generated json has changed so it needs to be parsed differently

If the builds that generate the data fails, you'd have an idea of when the data is from if you can see the timestamp of the file.

Suggested solution.
https://stackoverflow.com/a/25064125/2055199

Currently there is an assumption that source code is either under tools host or in github. We need to put into place it linking to the cloud repo and have the source links pointing to the correct place.

It might make sense to have a fully different file that just has these corrections.