feat(echo): support Echo Maven package scanning

Extends the Echo vendor to match Maven packages carrying the +echo.N
suffix. The default Maven comparer already orders +echo.N correctly, so
no custom comparer is needed.

Depends on #10555 (Echo pip language package scanning).

Signed-off-by: Laiza Angrest <laiza.angrest@echo.ai>

Author: LaizaAngrest

pkg/detector/library/driver_test.go

@@ -392,6 +392,31 @@ func TestDriver_Detect(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "echo maven package",
+			fixtures: []string{
+				"testdata/fixtures/echo.yaml",
+				"testdata/fixtures/data-source.yaml",
+			},
+			libType: ftypes.Jar,
+			args: args{
+				pkgName: "org.apache.commons:commons-lang3",
+				pkgVer:  "3.14.0+echo.1",
+			},
+			want: []types.DetectedVulnerability{
+				{
+					VulnerabilityID:  "CVE-2024-88888",
+					PkgName:          "org.apache.commons:commons-lang3",
+					InstalledVersion: "3.14.0+echo.1",
+					FixedVersion:     "3.14.0+echo.999",
+					DataSource: &dbTypes.DataSource{
+						ID:   "echo-osv",
+						Name: "Echo OSV",
+						URL:  "https://advisory.echohq.com/osv",
+					},
+				},
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {

pkg/detector/library/echo/echo.go

@@ -10,8 +10,9 @@ import (
 	"github.com/aquasecurity/trivy/pkg/detector/library/compare/pep440"
 )
 
-// echoLocalSegmentRe matches the Echo-specific PEP 440 local version segment,
-// e.g. "+echo.1" in "2.14.2+echo.1".
+// echoLocalSegmentRe matches the Echo-specific version segment "+echo.N",
+// e.g. "+echo.1" in "2.14.2+echo.1". This appears both as a PEP 440 local
+// version (pip) and as a Maven build suffix (maven).
 var echoLocalSegmentRe = regexp.MustCompile(`\+echo\.\d+`)
 
 func init() {
@@ -20,10 +21,10 @@ func init() {
 	})
 }
 
-// echoVendor matches pip packages patched by Echo.
-// Echo provides patched versions of Python packages with their own vulnerability
-// advisories. Their packages are identified by a PEP 440 local version suffix
-// of the form "+echo.N" (e.g. "2.14.2+echo.1").
+// echoVendor matches language packages patched by Echo.
+// Echo provides patched versions of Python (pip) and Java (maven) packages with
+// their own vulnerability advisories. Their packages are identified by a version
+// suffix of the form "+echo.N" (e.g. "2.14.2+echo.1").
 type echoVendor struct {
 	pipComparer compare.Comparer
 }
@@ -35,12 +36,15 @@ func (echoVendor) Name() string {
 // Match determines whether a package is provided by Echo.
 // It expects a normalized package name (see vulnerability.NormalizePkgName).
 // Echo packages are identified by a "+echo.N" segment in the version string,
-// where N is a numeric revision (e.g. "2.14.2+echo.1").
+// where N is a numeric revision (e.g. "2.14.2+echo.1"). Echo patches both
+// Python (pip) and Java (maven) packages using this same suffix convention.
 func (echoVendor) Match(eco ecosystem.Type, _, pkgVer string) bool {
-	if eco != ecosystem.Pip {
+	switch eco {
+	case ecosystem.Pip, ecosystem.Maven:
+		return echoLocalSegmentRe.MatchString(pkgVer)
+	default:
 		return false
 	}
-	return echoLocalSegmentRe.MatchString(pkgVer)
 }
 
 // BucketPrefix returns the vendor-specific advisory bucket prefix.
@@ -49,9 +53,10 @@ func (e echoVendor) BucketPrefix(eco ecosystem.Type) string {
 }
 
 // Comparer returns a version comparer for the given ecosystem.
-// For pip (Python), it enables local version specifiers to correctly handle
-// Echo version suffixes (e.g. "2.14.2+echo.1").
-// For other ecosystems, it returns the default comparer unchanged.
+// For pip (Python), it enables local version specifiers so PEP 440 ordering
+// keeps the Echo suffix (e.g. "2.14.2+echo.1") instead of discarding it.
+// For maven (and other ecosystems) the default comparer already orders the
+// "+echo.N" suffix correctly, so it is returned unchanged.
 func (e echoVendor) Comparer(eco ecosystem.Type, defaultComparer compare.Comparer) compare.Comparer {
 	if eco == ecosystem.Pip {
 		return e.pipComparer

pkg/detector/library/echo/echo_test.go

@@ -66,10 +66,24 @@ func TestEchoVendor_Match(t *testing.T) {
 			want:    false,
 		},
 		{
-			name:    "maven package is not supported",
+			name:    "maven package with +echo.1 suffix",
 			eco:     ecosystem.Maven,
 			pkgName: "org.apache.logging.log4j:log4j-core",
 			pkgVer:  "2.13.3+echo.1",
+			want:    true,
+		},
+		{
+			name:    "maven package with +echo.999 suffix",
+			eco:     ecosystem.Maven,
+			pkgName: "org.apache.commons:commons-lang3",
+			pkgVer:  "3.14.0+echo.999",
+			want:    true,
+		},
+		{
+			name:    "maven package without echo suffix",
+			eco:     ecosystem.Maven,
+			pkgName: "org.apache.commons:commons-lang3",
+			pkgVer:  "3.14.0",
 			want:    false,
 		},
 		{

pkg/detector/library/testdata/fixtures/data-source.yaml

@@ -65,3 +65,8 @@
         ID: "echo-osv"
         Name: "Echo OSV"
         URL: "https://advisory.echohq.com/osv"
+    - key: "echo maven::Echo OSV"
+      value:
+        ID: "echo-osv"
+        Name: "Echo OSV"
+        URL: "https://advisory.echohq.com/osv"

pkg/detector/library/testdata/fixtures/echo.yaml

@@ -8,3 +8,13 @@
               - "2.14.2+echo.999"
             VulnerableVersions:
               - ">= 2.14.2+echo.1, < 2.14.2+echo.999"
+- bucket: "echo maven::Echo OSV"
+  pairs:
+    - bucket: "org.apache.commons:commons-lang3"
+      pairs:
+        - key: CVE-2024-88888
+          value:
+            PatchedVersions:
+              - "3.14.0+echo.999"
+            VulnerableVersions:
+              - ">= 3.14.0+echo.1, < 3.14.0+echo.999"