-
Story
-
Resolution: Done
-
Major
-
2.0.0.Beta5
-
None
-
None
We could improve ignoring by having a list of hashes and G:A:V for jars to skip.
We could ignore archives using G:A:V and hashes.
With data from jboss.org Maven repo, we could have semiauto-generated list of G:A:V's to ignore, and a reverse index of jar hashes, to match files that are renamed during client's app packaging.
Example:
Bundled data:
1) Ignore all javax.*
2) Hash a09876 belongs to javax.foo:1.0.1
3) Input:
foo.jar -> hash a09876
4) -> G:A:V javax.foo:1.0.1 -> ignore (from unzipping, scanning, decompiling, ...)
POSSIBLE SOLUTIONS:
a) Nexus Crawler
https://github.com/sonatype/nexus-example-plugins/tree/master/crawling/src/main/java/org/sonatype/nexus/examples/crawling
b) Taking the data from JBoss.org DCP (Distributed Contribution Platform)
https://github.com/searchisko/searchisko/tree/master/documentation/rest-api
http://docs.jbossorg.apiary.io
c) Nexus Rest API
https://repository.sonatype.org/nexus-restlet1x-plugin/default/docs/index.html
-----------------
Step 1: Hash to GAV mappings, and skipping of GAV's
1.1: Support ranges https://github.com/forge/furnace/blob/master/container-api/src/main/java/org/jboss/forge/furnace/versions/VersionRange.java
Step 2: Load the data from sources analogical to windup-ignore - see https://github.com/windup/windup/wiki/Performance-tuning
Step 3: Create the crawler for Nexus and ask JBoss.org to enable it
Step 4: Make the ruleset download fresh data each time?
Step 5: Operation to skip certan G:A:V from within a rule in different ruleset.
- incorporates
-
WINDUP-407 Rules request: Ability to identify libraries/artifacts by identifier and version.
-
- Closed
-