79b8e53441
Some checks failed
Docs CI / lint-and-preview (push) Has been cancelled
- Introduced `SbomService` tasks documentation. - Updated `StellaOps.sln` to include new projects: `StellaOps.AirGap.Time` and `StellaOps.AirGap.Importer`. - Added unit tests for `BundleImportPlanner`, `DsseVerifier`, `ImportValidator`, and other components in the `StellaOps.AirGap.Importer.Tests` namespace. - Implemented `InMemoryBundleRepositories` for testing bundle catalog and item repositories. - Created `MerkleRootCalculator`, `RootRotationPolicy`, and `TufMetadataValidator` tests. - Developed `StalenessCalculator` and `TimeAnchorLoader` tests in the `StellaOps.AirGap.Time.Tests` namespace. - Added `fetch-sbomservice-deps.sh` script for offline dependency fetching.
27 lines
1.7 KiB
Markdown
27 lines
1.7 KiB
Markdown
# Java Analyzer Prep — SCANNER-ANALYZERS-JAVA-21-005 (PREP)
|
|
|
|
Status: Draft (2025-11-20)
|
|
Owners: Java Analyzer Guild
|
|
Scope: Capture prerequisites and fixture expectations to unblock SCANNER-ANALYZERS-JAVA-21-005 once upstream build issues clear.
|
|
|
|
## Blocking issues observed
|
|
- Repository build fails in Concelier due to missing `CoreLinksets` Mongo interfaces; prevents running targeted Java analyzer tests.
|
|
- Targeted `dotnet test` stalls during restore/build on shared runner; needs clean CI slot or scoped solution.
|
|
|
|
## Required upstream artifacts
|
|
- Concelier/CoreLinksets packages or mocks to let Java analyzer tests restore/build.
|
|
- CI job or local script to run Java analyzer tests in isolation (`StellaOps.Scanner.Analyzers.Lang.Java.Tests.csproj`) without full solution restore.
|
|
|
|
## Expected outputs once unblocked
|
|
- Framework config extraction evidence covering Spring Boot imports, app/bootstrap configs, web.xml/fragments, JPA/CDI/JAXB configs, logging files, Graal native-image configs.
|
|
- JNI/native hint detection: System.load/Library literals, bundled native libs, Graal JNI configs with component metadata.
|
|
- Deterministic hashing of config evidence (SHA-256) with stable ordering.
|
|
|
|
## Test/fixture plan
|
|
- Fixtures under `src/Scanner/__Tests/Fixtures/java/21-005/*` capturing the above configs.
|
|
- Regression tests in `StellaOps.Scanner.Analyzers.Lang.Java.Tests/FrameworkConfigTests.cs` asserting evidence presence and hashes.
|
|
- Add CI note: prefer `dotnet test ...Java.Tests.csproj --filter Category=FrameworkConfig` once solutions restore cleanly.
|
|
|
|
## Handoff
|
|
Use this document as the published prep artefact for PREP-SCANNER-ANALYZERS-JAVA-21-005-TESTS-BLOC. Update once Concelier/CoreLinksets dependency is resolved or CI isolation is available.
|