maven-heaven: Design and implement code matching of one Maven JAR against all other Maven JAR (source and binary).

[pombredanne]

Enhanced code matching to focus matching only against a specified subset of the whole index (e.g. Apache Java and Maven JARs and repos) and exclude matches to self to find borrowed, vendored, and copied code. NOTE: The assumption is that the base work is done with Rust and this is only incremental work for Maven.

[chinyeungli]

@pombredanne
Is the task to search for all other projects (excluding the input project itself) that use the same JAR file?
For example, if the input is commons-logging-1.2.jar, the code should check whether any other Maven projects also depend on/use commons-logging-1.2.jar?

[TG1999]

@pombredanne gentle reminder on this, please clarify on

@pombredanne Is the task to search for all other projects (excluding the input project itself) that use the same JAR file? For example, if the input is commons-logging-1.2.jar, the code should check whether any other Maven projects also depend on/use commons-logging-1.2.jar?

[pombredanne]

the goal is here to ensure that we do the code matching correctly for Maven

[chinyeungli]

I believe the matching happens in api/matching/ , and we have 3 input fields:

{
    "upload_file": null,
    "input_urls": [],
    "webhook_url": ""
}

I am wondering should we also take PURL as an input?

[chinyeungli]

From https://github.com/aboutcode-org/purldb/blob/main/matchcode/pipelines/matching.py#L50 , the code takes a SCIO/SCTK scanned JSON file as input. My question is do we also want to add support for taking a PURL as input?