feat: java transitive search - added support for project pom aggregator

.tekton/on-pull-request.yaml

@@ -160,6 +160,8 @@ spec:
               env:
                 - name: TARGET_BRANCH_NAME
                   value: "{{target_branch}}"
+                - name: JAVA_MAVEN_DEFAULT_SETTINGS_FILE_PATH
+                  value: $(workspaces.source.path)/kustomize/base/settings.xml
               image: registry.access.redhat.com/ubi9/python-312:9.6
               workingDir: $(workspaces.source.path)
               script: |
@@ -184,8 +186,8 @@ spec:
 
                 # Install Java
                 JAVA_ARCH="x64"
-                JDK_URL="https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.2%2B9/OpenJDK22U-jdk_${JAVA_ARCH}_linux_hotspot_22.0.2_9.tar.gz"
-                JDK_DIR="jdk-22.0.2+9"
+                JDK_URL="https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.18%2B8/OpenJDK17U-jdk_${JAVA_ARCH}_linux_hotspot_17.0.18_8.tar.gz"
+                JDK_DIR="jdk-17.0.18+8"
 
                 echo ">> Downloading $JDK_URL"
                 mkdir -p /tekton/home/jdk

Dockerfile

@@ -66,8 +66,8 @@ ENV PATH="/opt/nodejs/bin:${PATH}"
 RUN node --version && npm --version
 
 # --- Temurin JDK 22 (amd64/x86_64) ---
-ARG JDK_URL="https://github.com/adoptium/temurin22-binaries/releases/download/jdk-22.0.2%2B9/OpenJDK22U-jdk_x64_linux_hotspot_22.0.2_9.tar.gz"
-ARG JDK_DIR="jdk-22.0.2+9"
+ARG JDK_URL="https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.18%2B8/OpenJDK17U-jdk_x64_linux_hotspot_17.0.18_8.tar.gz"
+ARG JDK_DIR="jdk-17.0.18+8"
 RUN mkdir -p /opt/jdk \
  && curl -fsSL -o /tmp/jdk.tgz "${JDK_URL}" \
  && tar -C /opt/jdk -xzf /tmp/jdk.tgz \

kustomize/base/exploit-iq-config.yml

@@ -67,6 +67,8 @@ functions:
     enable_functions_usage_search: true
   Function Locator:
     _type: package_and_function_locator
+  Function Library Version Finder:
+    _type: calling_function_library_version_finder
   Code Semantic Search:
     _type: local_vdb_retriever
     embedder_name: nim_embedder
@@ -98,6 +100,7 @@ functions:
       - Call Chain Analyzer
       - Function Caller Finder
       - Function Locator
+      - Function Library Version Finder
     max_concurrency: null
     max_iterations: 10
     prompt_examples: false

kustomize/base/exploit_iq_service.yaml

@@ -125,9 +125,13 @@ spec:
               value: /exploit-iq-package-cache/go/pkg/mod
             - name: ENABLE_MLOPS
               value: "true"
+            - name: JAVA_MAVEN_DEFAULT_SETTINGS_FILE_PATH
+              value: /maven-config/settings.xml
           volumeMounts:
             - name: config
               mountPath: /configs
+            - name: maven-settings-config
+              mountPath: /maven-config
             - name: cache
               mountPath: /exploit-iq-data
             - name: package-cache
@@ -139,6 +143,9 @@ spec:
         - name: config
           configMap:
             name: exploit-iq-config
+        - name: maven-settings-config
+          configMap:
+            name: exploit-iq-maven-settings-config
         - name: cache
           persistentVolumeClaim:
             claimName: exploit-iq-data

kustomize/base/kustomization.yaml

@@ -63,6 +63,9 @@ configMapGenerator:
     files:
       - excludes.json
       - includes.json
+  - name: exploit-iq-maven-settings-config
+    files:
+      - settings.xml
 
 patches:
   - path: ips-patch.json

kustomize/base/settings.xml

@@ -0,0 +1,62 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<settings xmlns="http://maven.apache.org/SETTINGS/1.2.0"
+          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.2.0
+                              https://maven.apache.org/xsd/settings-1.2.0.xsd">
+    <profiles>
+        <profile>
+            <id>red-hat</id>
+            <repositories>
+                <repository>
+                    <id>red-hat-ga</id>
+                    <url>https://maven.repository.redhat.com/ga</url>
+                </repository>
+                <repository>
+                    <id>jboss-public-repository-group</id>
+                    <name>JBoss Public Maven Repository Group</name>
+                    <url>https://repository.jboss.org/nexus/content/groups/public/</url>
+                    <layout>default</layout>
+                    <releases>
+                        <enabled>true</enabled>
+                        <updatePolicy>never</updatePolicy>
+                    </releases>
+                    <snapshots>
+                        <enabled>true</enabled>
+                        <updatePolicy>never</updatePolicy>
+                    </snapshots>
+                </repository>
+            </repositories>
+            <pluginRepositories>
+                <pluginRepository>
+                    <id>red-hat-ga</id>
+                    <url>https://maven.repository.redhat.com/ga</url>
+                    <releases>
+                        <enabled>true</enabled>
+                    </releases>
+                    <snapshots>
+                        <enabled>false</enabled>
+                    </snapshots>
+                </pluginRepository>
+            </pluginRepositories>
+        </profile>
+    </profiles>
+    <activeProfiles>
+        <activeProfile>red-hat</activeProfile>
+    </activeProfiles>
+
+    <mirrors>
+        <!-- Override Maven's built-in "maven-default-http-blocker" by reusing the same id,
+             but making it not match external:http:* anymore. -->
+        <mirror>
+            <id>maven-default-http-blocker</id>
+            <name>Disabled default HTTP blocker</name>
+
+            <!-- Make this mirror effectively never apply -->
+            <mirrorOf>__no_such_repo_id__</mirrorOf>
+
+            <!-- URL is irrelevant if mirrorOf never matches, but must be present -->
+            <url>https://repo1.maven.org/maven2</url>
+        </mirror>
+    </mirrors>
+
+</settings>

kustomize/config-http-openai-local.yml

@@ -83,6 +83,8 @@ functions:
      max_retries: 5
   Container Analysis Data:
     _type: container_image_analysis_data
+  Function Library Version Finder:
+    _type: calling_function_library_version_finder
   cve_agent_executor:
     _type: cve_agent_executor
     llm_name: cve_agent_executor_llm
@@ -94,6 +96,7 @@ functions:
       - Call Chain Analyzer
       - Function Caller Finder
       - Function Locator
+      - Function Library Version Finder
     max_concurrency: null
     max_iterations: 10
     prompt_examples: false