provenant/parsers/
gradle_lock.rs

1//! Parser for gradle.lockfile dependency lock files.
2//!
3//! Extracts resolved dependency information from Gradle's gradle.lockfile format.
4//! This format is used by Gradle to lock exact dependency versions.
5//!
6//! # Supported Formats
7//! - gradle.lockfile (text-based dependency declarations)
8//!
9//! # Key Features
10//! - Exact version resolution from lockfile
11//! - Group and artifact extraction
12//! - Dependency classification (direct/transitive)
13//! - Package URL (purl) generation for Maven packages
14//!
15//! # Implementation Notes
16//! - gradle.lockfile is a simple text format with dependency lines
17//! - Format: `<group>:<artifact>:<version>=<hash>` (one per line)
18//! - Comments and empty lines are skipped
19//! - All dependencies are pinned (is_pinned: true)
20
21use crate::models::{DatasourceId, Dependency, PackageData, PackageType, ResolvedPackage};
22use crate::parser_warn as warn;
23use packageurl::PackageUrl;
24use std::collections::HashMap;
25use std::fs::File;
26use std::io::{BufRead, BufReader};
27use std::path::Path;
28
29use super::PackageParser;
30
31/// Gradle gradle.lockfile parser.
32///
33/// Extracts pinned dependency versions from Gradle's dependency lock files.
34pub struct GradleLockfileParser;
35
36impl PackageParser for GradleLockfileParser {
37    const PACKAGE_TYPE: PackageType = PackageType::Maven;
38
39    fn is_match(path: &Path) -> bool {
40        path.file_name()
41            .and_then(|name| name.to_str())
42            .is_some_and(|name| name == "gradle.lockfile")
43    }
44
45    fn extract_packages(path: &Path) -> Vec<PackageData> {
46        let file = match File::open(path) {
47            Ok(f) => f,
48            Err(e) => {
49                warn!("Failed to open gradle.lockfile at {:?}: {}", path, e);
50                return vec![default_package_data()];
51            }
52        };
53
54        let reader = BufReader::new(file);
55        let dependencies = extract_dependencies(reader);
56
57        vec![PackageData {
58            package_type: Some(Self::PACKAGE_TYPE),
59            namespace: None,
60            name: None,
61            version: None,
62            qualifiers: None,
63            subpath: None,
64            primary_language: None,
65            description: None,
66            release_date: None,
67            parties: Vec::new(),
68            keywords: Vec::new(),
69            homepage_url: None,
70            download_url: None,
71            size: None,
72            sha1: None,
73            md5: None,
74            sha256: None,
75            sha512: None,
76            bug_tracking_url: None,
77            code_view_url: None,
78            vcs_url: None,
79            copyright: None,
80            holder: None,
81            declared_license_expression: None,
82            declared_license_expression_spdx: None,
83            license_detections: Vec::new(),
84            other_license_expression: None,
85            other_license_expression_spdx: None,
86            other_license_detections: Vec::new(),
87            extracted_license_statement: None,
88            notice_text: None,
89            source_packages: Vec::new(),
90            file_references: Vec::new(),
91            is_private: false,
92            is_virtual: false,
93            extra_data: None,
94            dependencies,
95            repository_homepage_url: None,
96            repository_download_url: None,
97            api_data_url: None,
98            datasource_id: Some(DatasourceId::GradleLockfile),
99            purl: None,
100        }]
101    }
102}
103
104/// Extract dependencies from gradle.lockfile
105fn extract_dependencies<R: BufRead>(reader: R) -> Vec<Dependency> {
106    let mut dependencies = Vec::new();
107
108    for line in reader.lines() {
109        let line = match line {
110            Ok(l) => l,
111            Err(e) => {
112                warn!("Failed to read line from gradle.lockfile: {}", e);
113                continue;
114            }
115        };
116
117        let line = line.trim();
118
119        // Skip empty lines and comments
120        if line.is_empty() || line.starts_with('#') {
121            continue;
122        }
123
124        // Parse dependency line format: group:artifact:version=hash
125        if let Some(dep) = parse_dependency_line(line) {
126            dependencies.push(dep);
127        }
128    }
129
130    dependencies
131}
132
133/// Parse a single dependency line from gradle.lockfile
134///
135/// Expected format: `group:artifact:version=hash`
136/// Example: `com.example:my-lib:1.0.0=abc123def456`
137fn parse_dependency_line(line: &str) -> Option<Dependency> {
138    // Split by = to separate GAV from hash
139    let (gav_part, hash_part) = line.split_once('=')?;
140    let hash = if hash_part.is_empty() {
141        None
142    } else {
143        Some(hash_part.to_string())
144    };
145
146    // Parse GAV (group:artifact:version)
147    let parts: Vec<&str> = gav_part.split(':').collect();
148    if parts.len() != 3 {
149        return None;
150    }
151
152    let group = parts[0].to_string();
153    let artifact = parts[1].to_string();
154    let version = parts[2].to_string();
155
156    // Generate purl
157    let purl = PackageUrl::new("maven", &artifact).ok().and_then(|mut p| {
158        p.with_namespace(&group).ok()?;
159        p.with_version(&version).ok()?;
160        Some(p.to_string())
161    });
162
163    // Build extra_data with group and artifact separately
164    let mut extra_data: Option<HashMap<String, serde_json::Value>> = None;
165    if !group.is_empty() || !artifact.is_empty() {
166        let mut map = HashMap::new();
167        if !group.is_empty() {
168            map.insert(
169                "group".to_string(),
170                serde_json::Value::String(group.clone()),
171            );
172        }
173        if !artifact.is_empty() {
174            map.insert(
175                "artifact".to_string(),
176                serde_json::Value::String(artifact.clone()),
177            );
178        }
179        if let Some(ref h) = hash {
180            map.insert("hash".to_string(), serde_json::Value::String(h.clone()));
181        }
182        extra_data = Some(map);
183    }
184
185    // Create resolved_package
186    let resolved_package = ResolvedPackage {
187        primary_language: None,
188        download_url: None,
189        sha1: None,
190        sha256: None,
191        sha512: None,
192        md5: None,
193        is_virtual: false,
194        extra_data: None,
195        dependencies: Vec::new(),
196        repository_homepage_url: None,
197        repository_download_url: None,
198        api_data_url: None,
199        datasource_id: Some(DatasourceId::GradleLockfile),
200        purl: purl.clone(),
201        ..ResolvedPackage::new(PackageType::Maven, group, artifact, version)
202    };
203
204    Some(Dependency {
205        purl,
206        extracted_requirement: None,
207        scope: None,
208        is_pinned: Some(true),
209        is_direct: None,
210        is_optional: Some(false),
211        is_runtime: Some(true),
212        resolved_package: Some(Box::new(resolved_package)),
213        extra_data,
214    })
215}
216
217/// Returns a default empty PackageData for error cases
218fn default_package_data() -> PackageData {
219    PackageData {
220        package_type: Some(GradleLockfileParser::PACKAGE_TYPE),
221        datasource_id: Some(DatasourceId::GradleLockfile),
222        ..Default::default()
223    }
224}
225
226#[cfg(test)]
227mod tests {
228    use super::*;
229    use std::io::Cursor;
230
231    #[test]
232    fn test_is_match_gradle_lockfile() {
233        assert!(GradleLockfileParser::is_match(Path::new("gradle.lockfile")));
234        assert!(GradleLockfileParser::is_match(Path::new(
235            "/path/to/gradle.lockfile"
236        )));
237    }
238
239    #[test]
240    fn test_is_match_not_gradle_lockfile() {
241        assert!(!GradleLockfileParser::is_match(Path::new("package.json")));
242        assert!(!GradleLockfileParser::is_match(Path::new("Cargo.lock")));
243        assert!(!GradleLockfileParser::is_match(Path::new("gradle.lock")));
244    }
245
246    #[test]
247    fn test_parse_dependency_line_simple() {
248        let line = "com.example:my-lib:1.0.0=abc123";
249        let dep = parse_dependency_line(line).expect("Failed to parse dependency");
250
251        assert_eq!(
252            dep.resolved_package.as_ref().unwrap().name,
253            "my-lib".to_string()
254        );
255        assert_eq!(
256            dep.resolved_package.as_ref().unwrap().version,
257            "1.0.0".to_string()
258        );
259        assert_eq!(
260            dep.resolved_package.as_ref().unwrap().namespace,
261            "com.example".to_string()
262        );
263        assert_eq!(
264            dep.resolved_package.as_ref().unwrap().package_type,
265            PackageType::Maven
266        );
267    }
268
269    #[test]
270    fn test_parse_dependency_line_complex_group() {
271        let line = "org.springframework.boot:spring-boot-starter-web:2.7.0=def456";
272        let dep = parse_dependency_line(line).expect("Failed to parse dependency");
273
274        assert_eq!(
275            dep.resolved_package.as_ref().unwrap().name,
276            "spring-boot-starter-web".to_string()
277        );
278        assert_eq!(
279            dep.resolved_package.as_ref().unwrap().version,
280            "2.7.0".to_string()
281        );
282        assert_eq!(
283            dep.resolved_package.as_ref().unwrap().namespace,
284            "org.springframework.boot".to_string()
285        );
286    }
287
288    #[test]
289    fn test_parse_dependency_line_no_hash() {
290        let line = "com.example:my-lib:1.0.0=";
291        let dep = parse_dependency_line(line).expect("Failed to parse dependency");
292
293        assert_eq!(
294            dep.resolved_package.as_ref().unwrap().name,
295            "my-lib".to_string()
296        );
297        assert_eq!(
298            dep.resolved_package.as_ref().unwrap().version,
299            "1.0.0".to_string()
300        );
301    }
302
303    #[test]
304    fn test_parse_dependency_line_invalid_format() {
305        // Missing version
306        let line = "com.example:my-lib=abc123";
307        assert!(parse_dependency_line(line).is_none());
308
309        // No hash separator
310        let line = "com.example:my-lib:1.0.0";
311        assert!(parse_dependency_line(line).is_none());
312    }
313
314    #[test]
315    fn test_extract_dependencies_multiple_lines() {
316        let content =
317            "com.example:lib1:1.0.0=hash1\ncom.example:lib2:2.0.0=hash2\ncom.test:lib3:3.0.0=hash3";
318        let reader = Cursor::new(content);
319        let deps = extract_dependencies(reader);
320
321        assert_eq!(deps.len(), 3);
322        assert_eq!(deps[0].resolved_package.as_ref().unwrap().name, "lib1");
323        assert_eq!(deps[1].resolved_package.as_ref().unwrap().name, "lib2");
324        assert_eq!(deps[2].resolved_package.as_ref().unwrap().name, "lib3");
325    }
326
327    #[test]
328    fn test_extract_dependencies_with_comments_and_empty_lines() {
329        let content = "# This is a comment\ncom.example:lib1:1.0.0=hash1\n\n# Another comment\ncom.example:lib2:2.0.0=hash2\n";
330        let reader = Cursor::new(content);
331        let deps = extract_dependencies(reader);
332
333        assert_eq!(deps.len(), 2);
334        assert_eq!(deps[0].resolved_package.as_ref().unwrap().name, "lib1");
335        assert_eq!(deps[1].resolved_package.as_ref().unwrap().name, "lib2");
336    }
337
338    #[test]
339    fn test_extract_dependencies_empty_file() {
340        let content = "";
341        let reader = Cursor::new(content);
342        let deps = extract_dependencies(reader);
343
344        assert_eq!(deps.len(), 0);
345    }
346
347    #[test]
348    fn test_extract_dependencies_only_comments() {
349        let content = "# Comment 1\n# Comment 2\n# Comment 3";
350        let reader = Cursor::new(content);
351        let deps = extract_dependencies(reader);
352
353        assert_eq!(deps.len(), 0);
354    }
355
356    #[test]
357    fn test_extract_first_package_returns_correct_package_type() {
358        let content = "com.example:lib:1.0.0=hash";
359        let reader = Cursor::new(content);
360        let deps = extract_dependencies(reader);
361
362        assert!(!deps.is_empty());
363        assert_eq!(
364            deps[0].resolved_package.as_ref().unwrap().package_type,
365            PackageType::Maven
366        );
367    }
368
369    #[test]
370    fn test_parse_dependency_generates_purl() {
371        let line = "com.google.guava:guava:30.1-jre=abc123";
372        let dep = parse_dependency_line(line).expect("Failed to parse dependency");
373
374        assert!(dep.purl.is_some());
375        let purl = dep.purl.unwrap();
376        assert!(purl.contains("maven"));
377        assert!(purl.contains("guava"));
378        assert!(purl.contains("30.1-jre"));
379    }
380
381    #[test]
382    fn test_parse_dependency_extra_data_contains_group_and_artifact() {
383        let line = "org.junit.jupiter:junit-jupiter-api:5.8.0=hash123";
384        let dep = parse_dependency_line(line).expect("Failed to parse dependency");
385
386        assert!(dep.extra_data.is_some());
387        let extra = dep.extra_data.unwrap();
388        assert!(extra.contains_key("group"));
389        assert!(extra.contains_key("artifact"));
390        assert!(extra.contains_key("hash"));
391    }
392
393    #[test]
394    fn test_extract_dependencies_malformed_lines_ignored() {
395        let content = "com.example:lib1:1.0.0=hash1\ninvalid-line\ncom.example:lib2:2.0.0=hash2";
396        let reader = Cursor::new(content);
397        let deps = extract_dependencies(reader);
398
399        // Only valid dependencies are extracted
400        assert_eq!(deps.len(), 2);
401        assert_eq!(deps[0].resolved_package.as_ref().unwrap().name, "lib1");
402        assert_eq!(deps[1].resolved_package.as_ref().unwrap().name, "lib2");
403    }
404
405    #[test]
406    fn test_dependency_has_correct_flags() {
407        let line = "com.example:lib:1.0.0=hash";
408        let dep = parse_dependency_line(line).expect("Failed to parse dependency");
409
410        assert_eq!(dep.is_pinned, Some(true));
411        assert_eq!(dep.is_optional, Some(false));
412        assert_eq!(dep.is_runtime, Some(true));
413    }
414}
415
416crate::register_parser!(
417    "Gradle lockfile",
418    &["**/gradle.lockfile"],
419    "maven",
420    "Java",
421    Some("https://docs.gradle.org/current/userguide/dependency_locking.html"),
422);
provenant/parsers/gradle_lock.rs

provenant/parsers/
gradle_lock.rs
