feat(java): wire scan.maven.mirrors to the pom analyzer

Author: DmitriyLewen

pkg/commands/artifact/run.go

@@ -653,6 +653,7 @@ func (r *runner) initScannerConfig(ctx context.Context, opts flag.Options) (Scan
 			AWSEndpoint:       opts.Endpoint,
 			FileChecksum:      fileChecksum,
 			DetectionPriority: opts.DetectionPriority,
+			MavenMirrors:      opts.MavenMirrors,
 
 			// For image scanning
 			ImageOption: ftypes.ImageOptions{

pkg/fanal/analyzer/analyzer.go

@@ -172,6 +172,9 @@ func (f FilePatterns) Match(filePath string) bool {
 type AnalysisOptions struct {
 	Offline      bool
 	FileChecksum bool
+
+	// MavenMirrors maps a Maven repository URL to an ordered list of fallback mirror URLs.
+	MavenMirrors map[string][]string
 }
 
 type AnalysisResult struct {

pkg/fanal/analyzer/language/java/pom/pom.go

@@ -25,7 +25,10 @@ type pomAnalyzer struct{}
 
 func (a pomAnalyzer) Analyze(ctx context.Context, input analyzer.AnalysisInput) (*analyzer.AnalysisResult, error) {
 	filePath := filepath.Join(input.Dir, input.FilePath)
-	p := pom.NewParser(filePath, pom.WithOffline(input.Options.Offline))
+	p := pom.NewParser(filePath,
+		pom.WithOffline(input.Options.Offline),
+		pom.WithConfigFileMirrors(input.Options.MavenMirrors),
+	)
 	res, err := language.Analyze(ctx, types.Pom, input.FilePath, input.Content, p)
 	if err != nil {
 		return nil, xerrors.Errorf("%s parse error: %w", input.FilePath, err)

pkg/fanal/artifact/artifact.go

@@ -33,6 +33,9 @@ type Option struct {
 	FileChecksum      bool // For SPDX
 	DetectionPriority types.DetectionPriority
 
+	// MavenMirrors maps a Maven repository URL to an ordered list of fallback mirror URLs.
+	MavenMirrors map[string][]string
+
 	// Original is the original target location, e.g. "github.com/aquasecurity/trivy"
 	// Currently, it is used only for remote git repositories
 	Original string

pkg/fanal/artifact/local/fs.go

@@ -201,6 +201,7 @@ func (a Artifact) Inspect(ctx context.Context) (artifact.Reference, error) {
 	opts := analyzer.AnalysisOptions{
 		Offline:      a.artifactOption.Offline,
 		FileChecksum: a.artifactOption.FileChecksum,
+		MavenMirrors: a.artifactOption.MavenMirrors,
 	}
 
 	// Prepare filesystem for post analysis