feat(java): read Jenkins plugin manifest licenses

[0xTaoZ]

Summary

• read Jenkins plugin Plugin-License-Name manifest attributes as a JAR license fallback
• support suffixed multi-license attributes such as Plugin-License-Name-2
• preserve the existing precedence: embedded pom.xml licenses win before manifest licenses, and packed LICENSE files remain the final fallback

Closes #10936

Validation

• go test ./pkg/dependency/parser/java/jar -run TestParseJenkinsPluginManifestLicenses -count=1
• go test ./pkg/dependency/parser/java/jar -count=1
• go test ./pkg/dependency/parser/java/... -count=1
• git diff --check HEAD~1..HEAD

[CLAassistant]

All committers have signed the CLA.

[DmitriyLewen]

Hello
Thanks for your work!
I left a few comments.
Also, you need to update the docs and sign the CLA.

[DmitriyLewen]

This comment isn't related to the new attachManifestLicenses().

[DmitriyLewen]

It makes sense to add a comment about the priority.
Classifying a license from a file is an expensive operation, so we first try to detect licenses from the manifest file.

[DmitriyLewen]

A lot of duplicate code.
You can create a common function for attachFileLicenses() and attachManifestLicenses().
something like that:

 // ownJarPackage returns the single package that belongs to filePath and still
  // needs a license, or nil when there is none, the owner already has a license,
  // or the owner is ambiguous (multiple packages share the jar's file path, e.g.
  // an uber jar).
  func ownJarPackage(pkgs []ftypes.Package, filePath string) *ftypes.Package {
        var pkg *ftypes.Package
        for i := range pkgs {
                if pkgs[i].FilePath != filePath {
                        continue
                }
                if pkg != nil {
                        return nil // more than one package belongs to this jar
                }
                pkg = &pkgs[i]
        }
        if pkg == nil || len(pkg.Licenses) > 0 {
                return nil
        }
        return pkg
  }

[DmitriyLewen]

Add a new case for Plugin-License-Name (don't use the default here).

[DmitriyLewen]

I don't think there's any chance that there won't be a number here. Let's simplify the check. And if users do report such a case, we'll add it in a separate PR.

[DmitriyLewen]

I'd create a separate function for getting the license, and inside it do the Plugin-License-Name- check, trim the Plugin-License-Name* prefix, and return the licenses. If no licenses are found, return nil.

e.g. m.licenses = parseManifestLicenses(line)

[DmitriyLewen]

I don't think we need a separate test that builds a jar file. Let's add one test case to TestParse. And also create a new test function for parseManifestLicenses() (use the export_test.go file).

[0xTaoZ]

Thanks for the review. I’ll clean up the manifest parsing, reuse the package lookup logic, move the coverage into the existing parser tests, and update the docs.

[0xTaoZ]

Updated this now. I cleaned up the manifest license parsing, reused the jar package lookup, moved the parser coverage into the existing test table, added focused tests for parseManifestLicenses, and updated the Java license docs.\n\nLocal check: go test ./pkg/dependency/parser/java/... -count=1\n\nPlease take another look when you have time.

[0xTaoZ]

@DmitriyLewen thanks again for the clear review. I pushed the updates, and the CLA check is green now too. Happy to adjust anything else if needed. I’d be glad to keep contributing to Trivy, and would appreciate another look when you have time.

[DmitriyLewen]

Thanks for your work!

I refactored a bit.
Can you recheck?

[0xTaoZ]

I rechecked the refactor and it looks good to me. I also ran go test ./pkg/dependency/parser/java/... -count=1 locally.