Dependency analysis through class file manipulation
A processing device may receive a request for dependency information indicative of one or more class files included in an archive file. The processing device may fetch the archive file from an upstream source, where the archive file may be associated with the dependency information indicative of the one or more class files. The processing device may apply a transformation to the archive file to indicate provenance information for each of the one or more class files included in the archive file. The archive file may be incorporated in an application or a library, such that a scan of the application or the library may be performed for the provenance information associated with the archive file. An indication of each of the one or more class files included in the archive file may be output in view of the provenance information.
1 . A method comprising:
receiving a request for dependency information indicative of one or more class files included in an archive file;
fetching the archive file from an upstream source, the archive file associated with the dependency information indicative of the one or more class files;
executing, by a processing device, a transformation process to the archive file, the transformation process being applied to indicate provenance information for each of the one or more class files included in the archive file, wherein the provenance information for each of the one or more class files included in the archive file corresponds to bytecode metadata, wherein the bytecode metadata is indicative of the provenance information embedded within the one or more class files;
scanning the archive file for the bytecode metadata to determine specific class files of the one or more class files utilized to build the archive file, wherein the bytecode metadata provides for a tracking of the one or more class files utilized to build the archive file; and
outputting the archive file to a build module in view of the transformation process that indicates the provenance information for each of the one or more class files included in the archive file.
2 . The method of claim 1 , wherein executing the transformation process to the archive file further comprises:
encoding the provenance information within the archive file for each of the one or more class files included in the archive file.
3 . The method of claim 1 , wherein the provenance information is indicated for each of the one or more class files in view of at least one of an annotation or an unreferenced object included in a constant pool.
4 . The method of claim 1 , wherein the provenance information indicates at least one of a group artifact version (GAV) of a module that includes the one or more class files, a repository of the one or more class files, a dependency associated with the one or more class files, or build information of the module that includes the one or more class files.
5 . The method of claim 1 , wherein executing the transformation process to the archive file transforms the archive file into a modified archive file having the provenance information for each of the one or more class files included in the modified archive file.
6 . The method of claim 5 , wherein the modified archive file is incorporated in a container.
7 . A system comprising:
a memory; and
a processing device, operatively coupled to the memory, to:
receive a request for dependency information indicative of one or more class files included in an archive file;
fetch the archive file from an upstream source, the archive file associated with the dependency information indicative of the one or more class files;
execute a transformation process to the archive file, the transformation process being applied to indicate provenance information for each of the one or more class files included in the archive file, wherein the provenance information for each of the one or more class files included in the archive file corresponds to bytecode metadata, wherein the bytecode metadata is indicative of the provenance information embedded within the one or more class files;
scan the archive file for the bytecode metadata to determine specific class files of the one or more class files utilized to build the archive file, wherein the bytecode metadata provides for a tracking of the one or more class files utilized to build the archive file; and
output the archive file to a build module in view of the transformation process that indicates the provenance information for each of the one or more class files included in the archive file.
8 . The system of claim 7 , wherein to execute the transformation process to the archive file the processing device is further to:
encode the provenance information within the archive file for each of the one or more class files included in the archive file.
9 . The system of claim 7 , wherein the provenance information is indicated for each of the one or more class files in view of at least one of an annotation or an unreferenced object included in a constant pool.
10 . The system of claim 7 , wherein the provenance information indicates at least one of a group artifact version (GAV) of a module that includes the one or more class files, a repository of the one or more class files, a dependency associated with the one or more class files, or build information of the module that includes the one or more class files.
11 . The system of claim 7 , wherein execution of the transformation process to the archive file transforms the archive file into a modified archive file having the provenance information for each of the one or more class files included in the modified archive file.
12 . The system of claim 11 , wherein the modified archive file is incorporated in a container.
13 . A non-transitory computer-readable storage medium including instructions that, when executed by a processing device, cause the processing device to:
receive a request for dependency information indicative of one or more class files included in an archive file;
fetch the archive file from an upstream source, the archive file associated with the dependency information indicative of the one or more class files;
execute, by the processing device, a transformation process to the archive file, the transformation process being applied to indicate provenance information for each of the one or more class files included in the archive file, wherein the provenance information for each of the one or more class files included in the archive file corresponds to bytecode metadata, wherein the bytecode metadata is indicative of the provenance information embedded within the one or more class files;
scan the archive file for the bytecode metadata to determine specific class files of the one or more class files utilized to build the archive file, wherein the bytecode metadata provides for a tracking of the one or more class files utilized to build the archive file; and
output the archive file to a build module in view of the transformation process that indicates the provenance information for each of the one or more class files included in the archive file.
14 . The non-transitory computer-readable storage medium of claim 13 , wherein to execute the transformation process to the archive file the processing device is further to:
encode the provenance information within the archive file for each of the one or more class files included in the archive file.
15 . The non-transitory computer-readable storage medium of claim 13 , wherein the provenance information is indicated for each of the one or more class files in view of at least one of an annotation or an unreferenced object included in a constant pool.