@cdxgen/cdxgen 13.3.0 → 13.5.0

package/lib/inventory/deps.js

@@ -1,20 +1,16 @@
-import { lstatSync, readFileSync } from "node:fs";
-import { homedir, tmpdir } from "node:os";
-import {
-  delimiter as _delimiter,
-  sep as _sep,
-  basename,
-  dirname,
-  join,
-} from "node:path";
+import { lstatSync, readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { delimiter as _delimiter, basename, dirname, join } from "node:path";
 
 import { build, Purl } from "@cdxgen/cdx-purl";
 import StreamZip from "node-stream-zip";
 
 import { DEBUG_MODE, readEnvironmentVariable } from "../core/activity.js";
+import { commandOutputText } from "../core/buildLedger.js";
 import { parseMavenArgs } from "../core/env.js";
 import {
   getAllFiles,
+  getTmpDir,
   multiChecksumFile,
   safeExistsSync,
   safeMkdtempSync,
@@ -23,15 +19,89 @@ import {
 } from "../core/fs.js";
 import { isWin } from "../core/paths.js";
 import { xml2js } from "../parsers/xml.js";
+import { noteBuildToolRateLimit } from "./buildToolRateLimit.js";
+import {
+  inferMavenCoordinatesFromPath,
+  mavenLocalRepositories,
+  splitArtifactFileName,
+} from "./jvmLocalRepos.js";
 import { pypiBomRef } from "./purl.js";
+import { findLicenseId, spdxLicenses } from "./spdx.js";
+
+const jarNSMapping_cache = new Map();
+
+/**
+ * Whether a jar holds sources or javadoc rather than classes.
+ *
+ * @param {string} jarName Jar file name.
+ * @returns {boolean}
+ */
+export function isDocumentationJar(jarName) {
+  return jarName.endsWith("-sources.jar") || jarName.endsWith("-javadoc.jar");
+}
 
-const jarNSMapping_cache = {};
+/**
+ * Size and modification time of a file, used to tell whether a memoised
+ * reading of it is still current.
+ *
+ * @param {string} file File path.
+ * @returns {string} Stamp, or an empty string when the file cannot be read.
+ */
+function jarFileStamp(file) {
+  try {
+    const stats = statSync(file);
+    return `${stats.size}:${stats.mtimeMs}`;
+  } catch (_err) {
+    return "";
+  }
+}
+
+/**
+ * Build the purl of a jar. Eclipse p2 artifacts mirrored into a Maven
+ * repository keep their dedicated purl type qualifiers.
+ *
+ * @param {string} group groupId.
+ * @param {string} name artifactId.
+ * @param {string} version Version.
+ * @param {string} [classifier] Classifier.
+ * @returns {string} Purl string.
+ */
+function jarPurl(group, name, version, classifier = undefined) {
+  let namespace = group || null;
+  let type = "jar";
+  // See https://github.com/CycloneDX/cyclonedx-maven-plugin/issues/137
+  // and https://github.com/cdxgen/cdxgen/pull/510#issuecomment-1702551615
+  for (const [prefix, p2Type] of [
+    ["p2.osgi.bundle", "osgi-bundle"],
+    ["p2.eclipse.plugin", "eclipse-plugin"],
+    ["p2.binary", "eclipse-executable"],
+    ["p2.org.eclipse.update.feature", "eclipse-feature"],
+  ]) {
+    if (namespace?.startsWith(prefix)) {
+      namespace = prefix;
+      type = p2Type;
+      break;
+    }
+  }
+  const qualifiers = { type };
+  if (classifier) {
+    qualifiers.classifier = classifier;
+  }
+  return new Purl({
+    type: "maven",
+    namespace,
+    name,
+    version: version || null,
+    qualifiers,
+  }).toString();
+}
 
 /**
  * Collect maven dependencies
  *
  * @param {string} mavenCmd Maven command to use
- * @param {string} basePath Path to the maven project
+ * @param {string} basePath Path to the maven project. Without it Maven is not
+ *   run, and only the local repository is read when includeCacheDir is set.
  * @param {boolean} cleanup Remove temporary directories
  * @param {boolean} includeCacheDir Include maven and gradle cache directories
  */
@@ -42,14 +112,20 @@ export async function collectMvnDependencies(
   includeCacheDir = false,
 ) {
   let jarNSMapping = {};
+  // MAVEN_CACHE_DIR when set, otherwise the local repository Maven itself
+  // uses for this project.
   const MAVEN_CACHE_DIR =
     readEnvironmentVariable("MAVEN_CACHE_DIR") ||
+    mavenLocalRepositories({ projectDir: basePath || undefined }).find((repo) =>
+      safeExistsSync(repo),
+    ) ||
     join(homedir(), ".m2", "repository");
-  const tempDir = safeMkdtempSync(join(tmpdir(), "mvn-deps-"));
+  const tempDir = safeMkdtempSync(join(getTmpDir(), "mvn-deps-"));
+  // No -U: forcing update checks re-requests every maven-metadata.xml and
+  // every artifact Maven already knows is missing, once per module.
   let copyArgs = [
     "dependency:copy-dependencies",
     `-DoutputDirectory=${tempDir}`,
-    "-U",
     "-Dmdep.copyPom=true",
     "-Dmdep.useRepositoryLayout=true",
     "-Dmdep.includeScope=compile",
@@ -66,31 +142,45 @@ export async function collectMvnDependencies(
       cwd: basePath,
       shell: isWin,
     });
+    const rateLimited = noteBuildToolRateLimit(
+      "maven",
+      commandOutputText(result),
+      {
+        command: `${basename(mavenCmd)} ${copyArgs.join(" ")}`,
+        exitCode: typeof result.status === "number" ? result.status : undefined,
+      },
+    );
     if (result.status !== 0 || result.error) {
-      console.error(result.stderr, result.error);
-      console.log(
-        "You can try the following remediation tips to resolve this error:\n",
-      );
-      console.log(
-        "1. Check if the correct version of maven is installed and available in the PATH. Check if the environment variable MVN_ARGS needs to be set.",
-      );
-      console.log(
-        "2. Perform 'mvn compile package' before invoking this command. Fix any errors found during this invocation.",
-      );
-      console.log(
-        "3. Ensure the temporary directory is available and has sufficient disk space to copy all the artifacts.",
-      );
+      if (!rateLimited) {
+        console.error(result.stderr, result.error);
+        console.log(
+          "You can try the following remediation tips to resolve this error:\n",
+        );
+        console.log(
+          "1. Check if the correct version of maven is installed and available in the PATH. Check if the environment variable MVN_ARGS needs to be set.",
+        );
+        console.log(
+          "2. Perform 'mvn compile package' before invoking this command. Fix any errors found during this invocation.",
+        );
+        console.log(
+          "3. Ensure the temporary directory is available and has sufficient disk space to copy all the artifacts.",
+        );
+      }
     } else {
       jarNSMapping = await collectJarNS(tempDir);
     }
   }
   if (includeCacheDir || basePath === MAVEN_CACHE_DIR) {
-    // slow operation
-    jarNSMapping = await collectJarNS(MAVEN_CACHE_DIR);
+    // slow operation. The project's own dependencies, copied above, take
+    // precedence over the rest of the cache.
+    jarNSMapping = {
+      ...(await collectJarNS(MAVEN_CACHE_DIR)),
+      ...jarNSMapping,
+    };
   }
 
   // Clean up
-  if (cleanup && tempDir?.startsWith(tmpdir())) {
+  if (cleanup && tempDir?.startsWith(getTmpDir())) {
     safeRmSync(tempDir, { recursive: true, force: true });
   }
   return jarNSMapping;
@@ -122,11 +212,18 @@ export async function collectJarNS(jarPath, pomPathMap = {}) {
     : getAllFiles(jarPath, "**/*.jar");
   if (jarFiles?.length) {
     for (const jf of jarFiles) {
+      const jarName = basename(jf);
+      // Sources and javadoc jars hold no runtime classes. Reading them would
+      // attach their hashes to the main artifact's purl.
+      if (isDocumentationJar(jarName)) {
+        continue;
+      }
       let pomname =
-        pomPathMap[basename(jf).replace(".jar", ".pom")] ||
+        pomPathMap[jarName.replace(".jar", ".pom")] ||
         jf.replace(".jar", ".pom");
       let pomData;
       let purl;
+      let manifestLicenses;
       // In some cases, the pom name might be slightly different to the jar name
       if (!safeExistsSync(pomname)) {
         let searchDir = dirname(jf);
@@ -144,92 +241,54 @@ export async function collectJarNS(jarPath, pomPathMap = {}) {
         // TODO: Replace with parsePom which contains pomPurl
         pomData = parsePomXml(readFileSync(pomname, { encoding: "utf-8" }));
         if (pomData) {
-          const purlObj = new Purl({
-            type: "maven",
-            namespace: pomData.groupId || "" || null,
-            name: pomData.artifactId,
-            version: pomData.version || null,
-            qualifiers: { type: "jar" } || null,
-          });
-          purl = purlObj.toString();
+          purl = jarPurl(
+            pomData.groupId,
+            pomData.artifactId,
+            pomData.version,
+            pomData.version
+              ? splitArtifactFileName(
+                  jarName,
+                  pomData.artifactId,
+                  pomData.version,
+                )?.classifier
+              : undefined,
+          );
+        }
+      } else {
+        const coordinates = inferMavenCoordinatesFromPath(jf);
+        if (coordinates?.extension === "jar") {
+          purl = jarPurl(
+            coordinates.group,
+            coordinates.name,
+            coordinates.version,
+            coordinates.classifier,
+          );
         }
-      } else if (jf.includes(join(".m2", "repository"))) {
-        // Let's try our best to construct a purl for .m2 cache entries of the form
-        // .m2/repository/org/apache/logging/log4j/log4j-web/3.0.0-SNAPSHOT/log4j-web-3.0.0-SNAPSHOT.jar
-        const tmpA = jf.split(join(".m2", "repository", ""));
-        if (tmpA?.length) {
-          const tmpJarPath = tmpA[tmpA.length - 1];
-          // This would yield log4j-web-3.0.0-SNAPSHOT.jar
-          const jarFileName = basename(tmpJarPath).replace(".jar", "");
-          const tmpDirParts = dirname(tmpJarPath).split(_sep);
-          // Retrieve the version
-          let jarVersion = tmpDirParts.pop();
-          if (jarVersion === "plugins") {
-            jarVersion = tmpDirParts.pop();
-            if (jarVersion === "eclipse") {
-              jarVersion = tmpDirParts.pop();
+        // No POM sits beside this jar, but the jar carries its own Maven
+        // descriptor, so its metadata and manifest licence are read here,
+        // before any remote lookup. Only a jar whose path names its
+        // coordinates is read: they choose its descriptor, and an entry
+        // without a purl never becomes a component.
+        if (purl) {
+          const embedded = await readEmbeddedJarMetadata(jf, coordinates);
+          if (embedded?.pomXml) {
+            try {
+              pomData = parsePomXml(embedded.pomXml);
+            } catch (_err) {
+              pomData = undefined;
             }
           }
-          // The result would form the group name
-          let jarGroupName = tmpDirParts.join(".").replace(/^\./, "");
-          let qualifierType = "jar";
-          // Support for p2 bundles and plugins
-          // See https://github.com/CycloneDX/cyclonedx-maven-plugin/issues/137
-          // See https://github.com/cdxgen/cdxgen/pull/510#issuecomment-1702551615
-          if (jarGroupName.startsWith("p2.osgi.bundle")) {
-            jarGroupName = "p2.osgi.bundle";
-            qualifierType = "osgi-bundle";
-          } else if (jarGroupName.startsWith("p2.eclipse.plugin")) {
-            jarGroupName = "p2.eclipse.plugin";
-            qualifierType = "eclipse-plugin";
-          } else if (jarGroupName.startsWith("p2.binary")) {
-            jarGroupName = "p2.binary";
-            qualifierType = "eclipse-executable";
-          } else if (jarGroupName.startsWith("p2.org.eclipse.update.feature")) {
-            jarGroupName = "p2.org.eclipse.update.feature";
-            qualifierType = "eclipse-feature";
-          }
-          const purlObj = new Purl({
-            type: "maven",
-            namespace: jarGroupName || null,
-            name: jarFileName.replace(`-${jarVersion}`, ""),
-            version: jarVersion || null,
-            qualifiers: { type: qualifierType } || null,
-          });
-          purl = purlObj.toString();
-        }
-      } else if (jf.includes(join(".gradle", "caches"))) {
-        // Let's try our best to construct a purl for gradle cache entries of the form
-        // .gradle/caches/modules-2/files-2.1/org.xmlresolver/xmlresolver/4.2.0/f4dbdaa83d636dcac91c9003ffa7fb173173fe8d/xmlresolver-4.2.0-data.jar
-        const tmpA = jf.split(join("files-2.1", ""));
-        if (tmpA?.length) {
-          const tmpJarPath = tmpA[tmpA.length - 1];
-          // This would yield xmlresolver-4.2.0-data.jar
-          const jarFileName = basename(tmpJarPath).replace(".jar", "");
-          const tmpDirParts = dirname(tmpJarPath).split(_sep);
-          // This would remove the hash from the end of the directory name
-          tmpDirParts.pop();
-          // Retrieve the version
-          const jarVersion = tmpDirParts.pop();
-          const pkgName = jarFileName.replace(`-${jarVersion}`, "");
-          // The result would form the group name
-          let jarGroupName = tmpDirParts.join(".").replace(/^\./, "");
-          if (jarGroupName.includes(pkgName)) {
-            jarGroupName = jarGroupName.replace(`.${pkgName}`, "");
+          if (embedded?.manifestLicenses?.length) {
+            manifestLicenses = embedded.manifestLicenses;
           }
-          const purlObj = new Purl({
-            type: "maven",
-            namespace: jarGroupName || null,
-            name: pkgName,
-            version: jarVersion || null,
-            qualifiers: { type: "jar" } || null,
-          });
-          purl = purlObj.toString();
         }
       }
-      // If we have a hit from the cache, use it.
-      if (purl && jarNSMapping_cache[purl]) {
-        jarNSMapping[purl] = jarNSMapping_cache[purl];
+      // If we have a hit from the cache, use it. The entry is reused only
+      // for the same file, unchanged, so a rebuilt SNAPSHOT is read again.
+      const fileStamp = jarFileStamp(jf);
+      const cached = purl ? jarNSMapping_cache.get(purl) : undefined;
+      if (cached && cached.jarFile === jf && cached.stamp === fileStamp) {
+        jarNSMapping[purl] = cached.entry;
       } else {
         if (DEBUG_MODE) {
           console.log(`Parsing ${jf}`);
@@ -254,10 +313,15 @@ export async function collectJarNS(jarPath, pomPathMap = {}) {
           pom: pomData,
           namespaces: nsList,
           hashes,
+          ...(manifestLicenses?.length ? { manifestLicenses } : {}),
         };
         // Retain in the global cache to speed up future lookups
         if (purl) {
-          jarNSMapping_cache[purl] = jarNSMapping[purl];
+          jarNSMapping_cache.set(purl, {
+            jarFile: jf,
+            stamp: fileStamp,
+            entry: jarNSMapping[purl],
+          });
         }
       }
     }
@@ -398,15 +462,24 @@ export function parseJarManifest(jarMetadata) {
   if (!jarMetadata) {
     return metadata;
   }
-  jarMetadata.split("\n").forEach((l) => {
-    l = l.replaceAll("\r", "");
-    if (l.includes(": ")) {
-      const tmpA = l.split(": ");
-      if (tmpA && tmpA.length === 2) {
-        metadata[tmpA[0]] = tmpA[1].replaceAll("\r", "");
+  // Manifests wrap at 72 bytes: a line that starts with a single space
+  // continues the header above it.
+  let name;
+  for (const rawLine of jarMetadata.split("\n")) {
+    const l = rawLine.replaceAll("\r", "");
+    if (l.startsWith(" ")) {
+      if (name !== undefined) {
+        metadata[name] += l.slice(1);
       }
+      continue;
     }
-  });
+    name = undefined;
+    const at = l.indexOf(": ");
+    if (at > 0) {
+      name = l.slice(0, at);
+      metadata[name] = l.slice(at + 2);
+    }
+  }
   return metadata;
 }
 
@@ -505,22 +578,328 @@ export function parsePomProperties(pomProperties) {
 /**
  * Method to get pom properties from maven directory
  *
+ * A shaded or fat jar carries a `pom.properties` for every artifact folded
+ * into it. When the jar's file name is known, the descriptor whose
+ * `artifactId-version` (or `artifactId`) starts the file name is the jar's
+ * own; otherwise the first descriptor is used, as before.
+ *
  * @param {string} mavenDir Path to maven directory
+ * @param {string} [jarName] File name of the jar the directory came from
  *
  * @return array with pom properties
  */
-export function getPomPropertiesFromMavenDir(mavenDir) {
-  let pomProperties = {};
-  if (safeExistsSync(mavenDir) && lstatSync(mavenDir).isDirectory()) {
-    const pomPropertiesFiles = getAllFiles(mavenDir, "**/pom.properties");
-    if (pomPropertiesFiles?.length) {
-      const pomPropertiesString = readFileSync(pomPropertiesFiles[0], {
-        encoding: "utf-8",
-      });
-      pomProperties = parsePomProperties(pomPropertiesString);
+export function getPomPropertiesFromMavenDir(mavenDir, jarName = undefined) {
+  return selectEmbeddedDescriptor(mavenDir, jarName)?.properties ?? {};
+}
+
+/**
+ * Choose the embedded Maven descriptor of one jar from every descriptor an
+ * extracted `META-INF/maven` directory holds.
+ *
+ * @param {string} mavenDir Path to the extracted META-INF/maven directory
+ * @param {string} [jarName] File name of the jar the directory came from
+ * @returns {{file: string, properties: Object}|undefined} The chosen
+ *   descriptor, or undefined when the directory holds none.
+ */
+function selectEmbeddedDescriptor(mavenDir, jarName = undefined) {
+  if (!safeExistsSync(mavenDir) || !lstatSync(mavenDir).isDirectory()) {
+    return undefined;
+  }
+  const pomPropertiesFiles = getAllFiles(mavenDir, "**/pom.properties").sort();
+  if (!pomPropertiesFiles?.length) {
+    return undefined;
+  }
+  const candidates = pomPropertiesFiles.map((f) => ({
+    file: f,
+    properties: parsePomProperties(readFileSync(f, { encoding: "utf-8" })),
+  }));
+  const parsed = candidates.map((c) => c.properties);
+  if (parsed.length > 1 && jarName) {
+    const stem = jarName.replace(/\.[jwe]ar$/, "");
+    const exact = candidates.find(
+      (c) =>
+        c.properties.artifactId &&
+        c.properties.version &&
+        (stem === `${c.properties.artifactId}-${c.properties.version}` ||
+          stem.startsWith(
+            `${c.properties.artifactId}-${c.properties.version}-`,
+          )),
+    );
+    if (exact) {
+      return exact;
+    }
+    // The longest matching artifactId wins: netty-common-4.1.jar belongs to
+    // netty-common, not to an embedded netty descriptor.
+    const byName = candidates
+      .filter(
+        (c) =>
+          c.properties.artifactId &&
+          (stem === c.properties.artifactId ||
+            stem.startsWith(`${c.properties.artifactId}-`)),
+      )
+      .sort(
+        (a, b) =>
+          b.properties.artifactId.length - a.properties.artifactId.length,
+      );
+    if (
+      byName.length === 1 ||
+      (byName.length > 1 &&
+        byName[0].properties.artifactId.length >
+          byName[1].properties.artifactId.length)
+    ) {
+      return byName[0];
+    }
+  }
+  return candidates[0];
+}
+
+/** Per-entry size bounds for the Maven descriptor files read out of a jar.
+ * The jar is untrusted input, and its declared entry sizes are the only cheap
+ * defence against an archive that expands without bound. */
+const EMBEDDED_POM_PROPERTIES_LIMIT = 64 * 1024;
+const EMBEDDED_POM_XML_LIMIT = 1024 * 1024;
+const EMBEDDED_MANIFEST_LIMIT = 256 * 1024;
+/** A shaded jar can fold in thousands of descriptors; reading a bounded
+ * number keeps a hostile archive from turning one zip listing into
+ * unbounded work. */
+const EMBEDDED_DESCRIPTOR_LIMIT = 500;
+
+/**
+ * Read a file, refusing anything larger than the bound, so a jar whose
+ * descriptor declares a huge size is never fully read.
+ *
+ * @param {string} file File path.
+ * @param {number} limit Size bound in bytes.
+ * @returns {string|undefined} File contents, or undefined when missing or too large.
+ */
+function readBoundedFile(file, limit) {
+  try {
+    if (!safeExistsSync(file) || statSync(file).size > limit) {
+      return undefined;
+    }
+    return readFileSync(file, { encoding: "utf-8" });
+  } catch (_err) {
+    return undefined;
+  }
+}
+
+/**
+ * Split a manifest header value on a separator that is not inside double
+ * quotes. Quoted strings hold commas and semicolons of their own, as in
+ * `description="Apache License, Version 2.0"`.
+ *
+ * @param {string} value Header value.
+ * @param {string} separator One character.
+ * @returns {string[]} The parts, quotes kept.
+ */
+function splitOutsideQuotes(value, separator) {
+  const parts = [];
+  let current = "";
+  let quoted = false;
+  for (const ch of value) {
+    if (ch === '"') {
+      quoted = !quoted;
+    } else if (ch === separator && !quoted) {
+      parts.push(current);
+      current = "";
+      continue;
+    }
+    current += ch;
+  }
+  parts.push(current);
+  return parts;
+}
+
+/**
+ * Trim a manifest value and remove one pair of surrounding double quotes.
+ *
+ * @param {string} value Value.
+ * @returns {string} The bare value.
+ */
+function unquoteManifestValue(value) {
+  const trimmed = value.trim();
+  return trimmed.length >= 2 && trimmed.startsWith('"') && trimmed.endsWith('"')
+    ? trimmed.slice(1, -1).trim()
+    : trimmed;
+}
+
+/**
+ * The licences a MANIFEST.MF `Bundle-License` value names. The value is a
+ * comma-separated list; each item is an SPDX id, a licence name or a URL,
+ * optionally followed by `;link=` and `;description=` attributes, and any
+ * part may be quoted. Each item is mapped through findLicenseId; an item it
+ * cannot map is replaced by its `link` URL when one is given, which the
+ * licence URL lookup resolves later. `<<EXTERNAL>>` names no licence.
+ *
+ * @param {string} value Raw Bundle-License value.
+ * @returns {string[]} Licence ids, names or URLs, without duplicates.
+ */
+export function parseManifestLicenseList(value) {
+  if (!value || typeof value !== "string") {
+    return [];
+  }
+  const licenses = [];
+  for (const clause of splitOutsideQuotes(value, ",")) {
+    const [rawName, ...attributes] = splitOutsideQuotes(clause, ";");
+    const name = unquoteManifestValue(rawName);
+    if (!name || name === "<<EXTERNAL>>") {
+      continue;
+    }
+    let link;
+    for (const attribute of attributes) {
+      const at = attribute.indexOf("=");
+      if (at > 0 && attribute.slice(0, at).trim() === "link") {
+        link = unquoteManifestValue(attribute.slice(at + 1));
+      }
+    }
+    const id = findLicenseId(name);
+    const mapped = id !== name || spdxLicenses.includes(name);
+    const license = mapped ? id : link?.startsWith("http") ? link : name;
+    if (license && !licenses.includes(license)) {
+      licenses.push(license);
+    }
+  }
+  return licenses;
+}
+
+/**
+ * The Maven descriptor a jar carries for itself, read from an extracted
+ * `META-INF/maven` directory: the pom.properties that names the jar's own
+ * coordinates and the pom.xml stored beside it.
+ *
+ * @param {string} mavenDir Path to the extracted META-INF/maven directory
+ * @param {string} [jarName] File name of the jar the directory came from
+ * @returns {{properties: Object, pomXml?: string}|undefined} The chosen
+ *   descriptor, with its pom.xml text when one is stored beside it.
+ */
+export function readEmbeddedMavenDescriptor(mavenDir, jarName = undefined) {
+  const selected = selectEmbeddedDescriptor(mavenDir, jarName);
+  if (!selected) {
+    return undefined;
+  }
+  const pomXml = readBoundedFile(
+    join(dirname(selected.file), "pom.xml"),
+    EMBEDDED_POM_XML_LIMIT,
+  );
+  return pomXml
+    ? { properties: selected.properties, pomXml }
+    : { properties: selected.properties };
+}
+
+/**
+ * Choose the descriptor of the jar itself from the descriptors held inside
+ * its zip: the one whose pom.properties names the jar's own group and
+ * artifact, the matching version first. A shaded jar holds many descriptors
+ * whose coordinates belong to the folded-in artifacts, so when none matches,
+ * nothing is chosen rather than a dependency's descriptor.
+ *
+ * @param {Array<{name: string, properties: Object}>} descriptors Descriptors found in the zip.
+ * @param {{group: string, name: string, version: string}} coordinates The jar's own coordinates.
+ * @returns {{name: string, properties: Object}|undefined}
+ */
+function chooseZipDescriptor(descriptors, coordinates) {
+  if (!coordinates?.group || !coordinates.name) {
+    return undefined;
+  }
+  const byCoordinates = descriptors.filter(
+    (d) =>
+      d.properties.groupId === coordinates.group &&
+      d.properties.artifactId === coordinates.name,
+  );
+  const byVersion = byCoordinates.find(
+    (d) => coordinates.version && d.properties.version === coordinates.version,
+  );
+  return byVersion || byCoordinates[0];
+}
+
+/**
+ * The Maven descriptor and manifest licence a jar carries for itself, read
+ * from its zip without extracting it. Entry names are only matched and
+ * paired, never used as paths, and each entry is read only under a size
+ * bound, because the archive is untrusted input.
+ *
+ * @param {string} jarFile Path to the jar.
+ * @param {{group: string, name: string, version: string}} coordinates The jar's own coordinates, which choose its descriptor.
+ * @returns {Promise<{properties?: Object, pomXml?: string, manifestLicenses?: string[]}|undefined>}
+ */
+export async function readEmbeddedJarMetadata(jarFile, coordinates) {
+  let zip;
+  try {
+    zip = new StreamZip.async({ file: jarFile });
+    const entries = await zip.entries();
+    const decoder = new TextDecoder("utf-8");
+    const descriptors = [];
+    const pomEntries = new Map();
+    let manifestEntry;
+    for (const entry of Object.values(entries)) {
+      if (entry.isDirectory) {
+        continue;
+      }
+      if (
+        !manifestEntry &&
+        entry.name === "META-INF/MANIFEST.MF" &&
+        entry.size <= EMBEDDED_MANIFEST_LIMIT
+      ) {
+        manifestEntry = entry;
+        continue;
+      }
+      if (!entry.name.startsWith("META-INF/maven/")) {
+        continue;
+      }
+      if (entry.name.endsWith("/pom.properties")) {
+        if (
+          descriptors.length >= EMBEDDED_DESCRIPTOR_LIMIT ||
+          entry.size > EMBEDDED_POM_PROPERTIES_LIMIT
+        ) {
+          continue;
+        }
+        const text = decoder.decode(
+          Buffer.from(await zip.entryData(entry.name)),
+        );
+        descriptors.push({
+          name: entry.name,
+          properties: parsePomProperties(text),
+        });
+      } else if (entry.name.endsWith("/pom.xml")) {
+        const dir = entry.name.slice(0, -"pom.xml".length);
+        if (!pomEntries.has(dir)) {
+          pomEntries.set(dir, entry);
+        }
+      }
+    }
+    const chosen = chooseZipDescriptor(descriptors, coordinates);
+    const result = {};
+    if (chosen) {
+      result.properties = chosen.properties;
+      const dir = chosen.name.slice(0, -"pom.properties".length);
+      const pomEntry = pomEntries.get(dir);
+      if (pomEntry && pomEntry.size <= EMBEDDED_POM_XML_LIMIT) {
+        result.pomXml = decoder.decode(
+          Buffer.from(await zip.entryData(pomEntry.name)),
+        );
+      }
+    }
+    if (manifestEntry) {
+      const manifest = parseJarManifest(
+        decoder.decode(
+          Buffer.from(await zip.entryData("META-INF/MANIFEST.MF")),
+        ),
+      );
+      const licenses = parseManifestLicenseList(manifest["Bundle-License"]);
+      if (licenses.length) {
+        result.manifestLicenses = licenses;
+      }
+    }
+    return chosen || manifestEntry ? result : undefined;
+  } catch (_err) {
+    return undefined;
+  } finally {
+    try {
+      await zip.close();
+    } catch (_err) {
+      // An already-failed zip reports its close as well.
     }
   }
-  return pomProperties;
 }
 
 /**