github.com/vchain-us/vcn@v0.9.11-0.20210921212052-a2484d23c0b3/pkg/bom/java/java.go

/*
 * Copyright (c) 2018-2020 vChain, Inc. All Rights Reserved.
 * This software is released under GPL3.
 * The full license information can be found under:
 * https://www.gnu.org/licenses/gpl-3.0.en.html
 *
 */

package java

import (
	"archive/zip"
	"bufio"
	"bytes"
	"crypto/sha256"
	"encoding/base64"
	"encoding/hex"
	"encoding/xml"
	"errors"
	"fmt"
	"io"
	"io/ioutil"
	"os"
	"os/exec"
	"path/filepath"
	"strings"

	"golang.org/x/net/html/charset"

	"github.com/schollz/progressbar/v3"
	"github.com/sirupsen/logrus"

	"github.com/vchain-us/vcn/pkg/bom/artifact"
)

const AssetType = "java"

const mvn_version = 3
const mvn_artid = 0
const mvn_pkg_name = 1

const pom = "pom.xml"
const maven = "mvn"

type task struct {
	path    string
	name    string
	version string
}
type result struct {
	comp artifact.Dependency
	err  error
}

// javaMavenArtifact implements Artifact interface
type javaMavenArtifact struct {
	artifact.GenericArtifact
	folder  string
	dirName string
}

func (p *javaMavenArtifact) Path() string {
	return p.dirName
}

// New returns new JavaMavenPackage object
func New(path string) artifact.Artifact {
	f, err := GetPOM(path)
	if err != nil {
		return nil
	}

	return &javaMavenArtifact{folder: f, dirName: filepath.Dir(path)}
}

func (p *javaMavenArtifact) Type() string {
	return AssetType
}

// Dependencies returns list of java packages used during the build
func (a *javaMavenArtifact) ResolveDependencies(output artifact.OutputOptions) ([]artifact.Dependency, error) {
	if a.Deps != nil {
		return a.Deps, nil
	}

	xmlDepFn, err := ioutil.TempFile(os.TempDir(), "xml")
	if err != nil {
		return nil, err
	}
	defer xmlDepFn.Close()

	fname, err := exec.LookPath("mvn")
	if err != nil {
		return nil, fmt.Errorf("please install mvn tool follwing this link: https://maven.apache.org/install.html. Error reported: %w", err)
	}

	command := exec.Command(fname, "dependency:tree", "-DoutputType=graphml", "-f="+a.folder, "-DappendOutput=true", "-DoutputFile="+xmlDepFn.Name())
	_, err = command.Output()
	if err != nil {
		exit, ok := err.(*exec.ExitError)
		if ok {
			return nil, fmt.Errorf("cannot get Java dependencies:\n%s", string(exit.Stderr))
		}
		return nil, fmt.Errorf("cannot get Java dependencies: %w", err)
	}

	xmlDep, err := ioutil.ReadFile(xmlDepFn.Name())
	if err != nil {
		return nil, err
	}
	graph := GraphML{}
	err = xml.Unmarshal(xmlDep, &graph)
	if err != nil {
		return nil, err
	}

	cacheDir, err := MavenCacheDir()
	if err != nil {
		return nil, err
	}

	// worker pool
	tasks := make(chan task, len(graph.Graph.Nodes))
	results := make(chan result, len(graph.Graph.Nodes))
	for i := 0; i < artifact.MaxGoroutines; i++ {
		go worker(cacheDir, tasks, results)
	}

	for _, n := range graph.Graph.Nodes {
		fields := strings.Split(n.Data.ShapeNode.NodeLabel, ":")
		if fields[mvn_pkg_name] == "" {
			logrus.Errorf("unable to retrieve package name of component %s", n.Data.ShapeNode.NodeLabel)
			continue
		}
		if fields[mvn_version] == "" {
			logrus.Errorf("unable to retrieve package version of component %s", n.Data.ShapeNode.NodeLabel)
			continue
		}
		if fields[mvn_artid] == "" {
			logrus.Errorf("unable to retrieve package artifact ID of component %s", n.Data.ShapeNode.NodeLabel)
			continue
		}

		tasks <- task{
			path:    strings.Replace(fields[mvn_artid], ".", "/", -1),
			name:    fields[mvn_pkg_name],
			version: fields[mvn_version],
		}
	}

	res := make([]artifact.Dependency, 0)
	bar := progressbar.Default(int64(len(graph.Graph.Nodes)))
	for done := 0; done < len(graph.Graph.Nodes); done++ {
		result := <-results
		if result.err != nil {
			// it happens sometimes when dependency specified, but it doesn't exist
			continue
		}
		if result.comp.Hash != "" {
			res = append(res, result.comp)
		}
		switch output {
		case artifact.Progress:
			bar.Add(1)
		case artifact.Debug:
			fmt.Printf("%s@%s (%s)\n", result.comp.Name, result.comp.Version, result.comp.Hash)
		}
	}
	close(tasks)
	close(results)

	a.Deps = res
	return res, nil
}

type MavenPOM struct {
	License string `xml:"licenses>license>name"`
}

func worker(cacheDir string, tasks <-chan task, results chan<- result) {
	for task := range tasks {
		comp := artifact.Dependency{}

		basePath := filepath.Join(cacheDir, task.path, task.name, task.version, task.name+"-"+task.version)

		buf, err := ioutil.ReadFile(basePath + ".jar")
		if err != nil {
			results <- result{comp: comp, err: err}
			continue
		}
		rawHash := sha256.Sum256(buf)
		hash := hex.EncodeToString(rawHash[:])

		buf, err = ioutil.ReadFile(basePath + ".pom")
		if err != nil {
			results <- result{comp: comp, err: err}
			continue
		}

		var pom MavenPOM
		decoder := xml.NewDecoder(bytes.NewBuffer(buf))
		decoder.CharsetReader = charset.NewReaderLabel
		err = decoder.Decode(&pom)
		if err != nil {
			results <- result{comp: comp, err: err}
			continue
		}

		comp.Hash = hash
		comp.Version = task.version
		comp.Name = task.name
		comp.HashType = artifact.HashSHA256
		comp.License = pom.License

		results <- result{comp: comp}
	}
}

func GetPOM(path string) (string, error) {

	if strings.ToLower(filepath.Base(path)) == pom {
		return path, nil
	}

	fm := strings.ToLower(filepath.Join(path, pom))
	if _, err := os.Stat(fm); err == nil {
		return fm, nil
	}

	r, err := zip.OpenReader(path)

	if err != nil {
		return "", err
	}

	defer r.Close()
	for _, f := range r.File {
		if filepath.Base(f.Name) != "pom.xml" {
			continue
		}
		hash := sha256.Sum256([]byte(f.Name))
		tmpDirName := base64.RawURLEncoding.EncodeToString(hash[:])
		tempDir := filepath.Join(os.TempDir(), "vcn", tmpDirName)
		err := os.MkdirAll(tempDir, 0755)
		if err != nil {
			return "", err
		}
		tmp, err := ioutil.TempFile(tempDir, POM_name)
		if err != nil {
			return "", err
		}
		defer tmp.Close()
		rc, err := f.Open()
		if err != nil {
			return "", err
		}
		defer rc.Close()

		_, err = io.Copy(tmp, rc)
		if err != nil {
			return "", err
		}
		return tmp.Name(), nil
	}
	return "", errors.New("no pom is founded")
}

type MavenConfig struct {
	LocalRepo string `xml:"settings>localRepository"`
}

// local Maven package cache dir
func MavenCacheDir() (string, error) {
	command := exec.Command(maven, "-v")
	out, err := command.Output()
	if err != nil {
		exit, ok := err.(*exec.ExitError)
		if ok {
			return "", fmt.Errorf("cannot get Maven config:\n%s", string(exit.Stderr))
		}
		return "", fmt.Errorf("cannot get Maven config: %w", err)
	}

	var configDir string
	scanner := bufio.NewScanner(bytes.NewBuffer(out))
	for scanner.Scan() {
		fields := strings.SplitN(scanner.Text(), ": ", 2)
		if fields[0] == "Maven home" {
			configDir = fields[1]
			break
		}
	}

	if configDir == "" {
		return "", fmt.Errorf("cannot find Maven home dir")
	}

	buf, err := ioutil.ReadFile(filepath.Join(configDir, "conf", "settings.xml"))
	if err != nil {
		return "", fmt.Errorf("cannot read Maven config: %w", err)
	}

	var mvnConfig MavenConfig
	err = xml.Unmarshal(buf, &mvnConfig)
	if err != nil {
		return "", fmt.Errorf("cannot parse Maven config: %w", err)
	}

	if mvnConfig.LocalRepo != "" {
		return mvnConfig.LocalRepo, nil
	}

	// local repo path is not overridden in Maven config - use default path
	home, err := os.UserHomeDir()
	if err != nil {
		return "", fmt.Errorf("cannot get user home dir: %w", err)
	}

	return filepath.Join(home, ".m2", "repository"), nil
}