Function DownloadPomFromRepo

opensca/sca/java/mvn.go:482–526

DownloadPomFromRepo 从maven仓库下载pom dep: pom的dependency内容 do: 对http.Response.Body的操作 repos: 额外使用的maven仓库

(dep PomDependency, do func(r io.Reader), repos ...common.RepoConfig)

// do: 对http.Response.Body的操作
// repos: 额外使用的maven仓库
func DownloadPomFromRepo(dep PomDependency, do func(r io.Reader), repos ...common.RepoConfig) {

	if !dep.Check() {
		return
	}

	// 正式版本
	pom := fmt.Sprintf("%s/%s/%s/%s-%s.pom", strings.ReplaceAll(dep.GroupId, ".", "/"), dep.ArtifactId, dep.Version, dep.ArtifactId, dep.Version)
	common.DownloadUrlFromRepos(pom, func(repo common.RepoConfig, r io.Reader) { do(r) }, append(defaultMavenRepo, repos...)...)

	// 快照版本
	if !strings.HasSuffix(strings.ToLower(dep.Version), "-snapshot") {
		return
	}
	snap := fmt.Sprintf("%s/%s/%s/maven-metadata.xml", strings.ReplaceAll(dep.GroupId, ".", "/"), dep.ArtifactId, dep.Version)
	common.DownloadUrlFromRepos(snap, func(repo common.RepoConfig, r io.Reader) {

		metadata := struct {
			LastTime     string `xml:"versioning>lastUpdated"`
			SnapVersions []struct {
				Version string `xml:"value"`
				Time    string `xml:"updated"`
			} `xml:"versioning>snapshotVersions>snapshotVersion"`
		}{}

		err := xml.NewDecoder(r).Decode(&metadata)
		if err != nil {
			logs.Warn(err)
		}

		if metadata.LastTime == "" {
			return
		}

		for _, snap := range metadata.SnapVersions {
			if snap.Time == metadata.LastTime {
				snapom := fmt.Sprintf("%s/%s/%s/%s-%s.pom", strings.ReplaceAll(dep.GroupId, ".", "/"), dep.ArtifactId, snap.Version, dep.ArtifactId, snap.Version)
				common.DownloadUrlFromRepos(snapom, func(repo common.RepoConfig, r io.Reader) { do(r) }, repo)
				break
			}
		}

	}, append(defaultMavenRepo, repos...)...)

}

// MvnTree 调用mvn dependency:tree解析依赖
// pom: pom文件信息