stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 3 Releases Wiki Activity

save checkpoint

Browse Source
This commit is contained in:
master
2026-02-14 09:11:48 +02:00
parent 9ca2de05df
commit e9aeadc040
1512 changed files with 30863 additions and 4728 deletions
Download Patch File Download Diff File Expand all files Collapse all files

38
docs/features/checked/scanner/java-osgi-bundle-manifest-parsing.md Normal file
View File

@@ -0,0 +1,38 @@
# Java OSGi Bundle Manifest Parsing
## Module
Scanner
## Status
VERIFIED
## Description
Parses OSGi bundle MANIFEST.MF headers (Bundle-SymbolicName, Import-Package, Export-Package, Require-Bundle) to discover embedded dependencies and version ranges in Eclipse/Karaf/Felix deployments.
## Implementation Details
- **OSGi Bundle Parsing**:
- `src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java/Internal/Osgi/OsgiBundleParser.cs` - `OsgiBundleParser` parses MANIFEST.MF headers including `Bundle-SymbolicName`, `Import-Package`, `Export-Package`, and `Require-Bundle` to discover embedded dependencies and version ranges
- **Signature Manifest Analysis**:
- `src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java/Internal/Signature/JavaSignatureManifestAnalyzer.cs` - Analyzes JAR signature manifests alongside bundle manifests
- **Entrypoint Resolution**:
- `src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java/Internal/Resolver/JavaEntrypointResolution.cs` - Resolves entrypoints from bundle exports
- **Language Analyzer**: `src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java/JavaLanguageAnalyzer.cs`
## E2E Test Plan
- [ ] Scan a container image with an OSGi-based deployment (Eclipse/Karaf/Felix) and verify bundles are discovered from MANIFEST.MF files
- [ ] Verify `Bundle-SymbolicName` is extracted and mapped to component identifiers in the SBOM
- [ ] Verify `Import-Package` and `Export-Package` headers are parsed to identify inter-bundle dependencies with version ranges
- [ ] Verify `Require-Bundle` declarations are resolved to concrete bundle dependencies
- [ ] Verify version ranges in OSGi format (e.g., `[1.0,2.0)`) are correctly parsed and represented
- [ ] Verify embedded JAR bundles within OSGi containers are detected and attributed
---
## Verification
| Check | Result |
|-------|--------|
| Tier 0 - Source files exist | PASS |
| Tier 1 - Build + code review | PASS |
| Tier 2 - Integration tests | PASS |
| Verified | 2026-02-13T18:10:00Z |