diff --git a/syft/pkg/cataloger/java/parse_pom_xml.go b/syft/pkg/cataloger/java/parse_pom_xml.go index 8df295ea75e0..a641d1229bfa 100644 --- a/syft/pkg/cataloger/java/parse_pom_xml.go +++ b/syft/pkg/cataloger/java/parse_pom_xml.go @@ -163,8 +163,7 @@ func collectDependencies(ctx context.Context, r *maven.Resolver, resolved map[ma // we may have a reference to a package pointing to an existing pom on the filesystem, but we don't want to duplicate these entries depPkg := resolved[depID] if depPkg == nil { - var err error - depPkg, err = newPackageFromDependency( + p, err := newPackageFromDependency( ctx, r, pom, @@ -174,12 +173,30 @@ func collectDependencies(ctx context.Context, r *maven.Resolver, resolved map[ma if err != nil { log.WithFields("error", err, "pomLocation", loc, "mavenID", pomID, "dependencyID", depID).Debugf("error adding dependency") } + + if p == nil { + // we don't have a valid package, just continue to the next dependency + continue + } + depPkg = p + resolved[depID] = depPkg + + // only resolve transitive dependencies if we're not already looking these up for the specific package + if includeTransitiveDependencies && depID.Valid() { + depPom, err := r.FindPom(ctx, depID.GroupID, depID.ArtifactID, depID.Version) + if err != nil { + log.WithFields("mavenID", depID, "error", err).Debug("error finding pom") + } + if depPom != nil { + transitivePkgs, transitiveRelationships, transitiveErrs := collectDependencies(ctx, r, resolved, depPkg, depPom, loc, includeTransitiveDependencies) + pkgs = append(pkgs, transitivePkgs...) + relationships = append(relationships, transitiveRelationships...) + errs = unknown.Join(errs, transitiveErrs) + } + } } - if depPkg == nil { - continue - } - pkgs = append(pkgs, *depPkg) + pkgs = append(pkgs, *depPkg) if parentPkg != nil { relationships = append(relationships, artifact.Relationship{ From: *depPkg, @@ -187,20 +204,6 @@ func collectDependencies(ctx context.Context, r *maven.Resolver, resolved map[ma Type: artifact.DependencyOfRelationship, }) } - - if includeTransitiveDependencies { - depPom, err := r.FindPom(ctx, depID.GroupID, depID.ArtifactID, depID.Version) - if err != nil { - errs = unknown.Join(errs, err) - } - if depPom == nil { - continue - } - transitivePkgs, transitiveRelationships, transitiveErrs := collectDependencies(ctx, r, resolved, depPkg, depPom, loc, includeTransitiveDependencies) - pkgs = append(pkgs, transitivePkgs...) - relationships = append(relationships, transitiveRelationships...) - errs = unknown.Join(errs, transitiveErrs) - } } return pkgs, relationships, errs