From 380ebb31c8942f0c29f1912eabed2fbeee6c73d3 Mon Sep 17 00:00:00 2001
From: Karsten Klein <karsten.klein@metaeffekt.com>
Date: Thu, 27 Jun 2024 08:56:11 +0200
Subject: [PATCH] Providing template for integrated scanner configuration

---
 scanners/example-scanner/pom.xml              |  29 ++--
 scanners/scanner-template/pom.xml             | 161 ++++++++++++++++++
 .../src/analysis/component-patterns.xls       | Bin 0 -> 24576 bytes
 .../src/analysis/reference-inventory.xls      | Bin 0 -> 24064 bytes
 .../src/analysis/scan-control.properties      |  34 ++++
 5 files changed, 208 insertions(+), 16 deletions(-)
 create mode 100755 scanners/scanner-template/pom.xml
 create mode 100755 scanners/scanner-template/src/analysis/component-patterns.xls
 create mode 100755 scanners/scanner-template/src/analysis/reference-inventory.xls
 create mode 100755 scanners/scanner-template/src/analysis/scan-control.properties

diff --git a/scanners/example-scanner/pom.xml b/scanners/example-scanner/pom.xml
index 4f55071..2f110cc 100755
--- a/scanners/example-scanner/pom.xml
+++ b/scanners/example-scanner/pom.xml
@@ -14,28 +14,26 @@
     <packaging>pom</packaging>
 
     <properties>
-        <!-- example uses output dir of ae-dependency-extractor; overwrite on command line -->
-        <source.dir>${project.basedir}/../../extractors/dependency-extractors/ae-dependency-extractor/target/scan</source.dir>
-
+        <ae.core.version>0.113.0</ae.core.version>
+        <ae.artifact.analysis.version>0.106.0</ae.artifact.analysis.version>
         <ae.universe.version>1.7.0</ae.universe.version>
 
+        <!-- the directory to scan; supply on command line -->
+        <source.dir></source.dir>
     </properties>
 
     <build>
         <plugins>
-            <plugin>
-                <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-dependency-plugin</artifactId>
-            </plugin>
+            <!-- plugin to scan the input directory for files -->
             <plugin>
                 <groupId>org.metaeffekt.core</groupId>
                 <artifactId>ae-inventory-maven-plugin</artifactId>
             </plugin>
 
+            <!-- plugin performing the license scan on the identified items -->
             <plugin>
                 <groupId>com.metaeffekt.artifact.analysis</groupId>
                 <artifactId>ae-artifact-analysis-plugin</artifactId>
-                <version>${ae.artifact.analysis.version}</version>
             </plugin>
 
         </plugins>
@@ -77,20 +75,20 @@
                                 <scanDirectory>${project.build.directory}/scan</scanDirectory>
 
                                 <enableImplicitUnpack>false</enableImplicitUnpack>
-                                <enableComponentPatternDetection>true</enableComponentPatternDetection>
+                                <includeEmbedded>true</includeEmbedded>
+                                <enableDetectComponentPatterns>true</enableDetectComponentPatterns>
 
                                 <failOnError>false</failOnError>
                                 <failOnBanned>false</failOnBanned>
-                                <failOnInternal>false</failOnInternal>
-                                <failOnUnknownVersion>false</failOnUnknownVersion>
-                                <failOnUnknown>false</failOnUnknown>
-                                <failOnUpgrade>false</failOnUpgrade>
                                 <failOnDowngrade>false</failOnDowngrade>
+                                <failOnUnknown>false</failOnUnknown>
+                                <failOnUnknownVersion>false</failOnUnknownVersion>
                                 <failOnDevelopment>false</failOnDevelopment>
+                                <failOnInternal>false</failOnInternal>
+                                <failOnUpgrade>false</failOnUpgrade>
                                 <failOnMissingLicense>false</failOnMissingLicense>
                                 <failOnMissingLicenseFile>false</failOnMissingLicenseFile>
                                 <failOnMissingNotice>false</failOnMissingNotice>
-                                <failOnMissingSources>false</failOnMissingSources>
 
                                 <!-- REMARKS:
                                     - the inventory may also consist of controls to further unpack archives in the
@@ -103,7 +101,6 @@
                                 <scanIncludes>**/*</scanIncludes>
                                 <scanExcludes>-none-</scanExcludes>
 
-
                                 <targetInventoryDir>${project.build.directory}/inventory</targetInventoryDir>
                             </configuration>
                         </execution>
@@ -113,7 +110,7 @@
                 <plugin>
                     <groupId>com.metaeffekt.artifact.analysis</groupId>
                     <artifactId>ae-artifact-analysis-plugin</artifactId>
-                    <version>${version.ae.artifact.analysis}</version>
+                    <version>${ae.artifact.analysis.version}</version>
                     <executions>
                         <execution>
                             <id>extract</id>
diff --git a/scanners/scanner-template/pom.xml b/scanners/scanner-template/pom.xml
new file mode 100755
index 0000000..d93a99d
--- /dev/null
+++ b/scanners/scanner-template/pom.xml
@@ -0,0 +1,161 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>org.metaeffekt.example.documentation</groupId>
+    <artifactId>scanner-template</artifactId>
+    <version>1.0.0-SNAPSHOT</version>
+
+    <description>Self-contained template pom.xml for integrated license scanning.</description>
+
+    <packaging>jar</packaging>
+
+    <properties>
+        <ae.core.version>0.113.0</ae.core.version>
+        <ae.artifact.analysis.version>0.104.0</ae.artifact.analysis.version>
+        <ae.universe.version>1.7.0</ae.universe.version>
+
+        <!-- the directory to scan; supply on command line -->
+        <source.dir></source.dir>
+
+        <!-- access to the metaeffekt universe requires a license key protected by password; supplied by metaeffekt; provide on command line -->
+        <universe.consumer.password></universe.consumer.password>
+        <universe.consumer.keys></universe.consumer.keys>
+    </properties>
+
+    <build>
+        <plugins>
+            <!-- plugin to scan the input directory for files -->
+            <plugin>
+                <groupId>org.metaeffekt.core</groupId>
+                <artifactId>ae-inventory-maven-plugin</artifactId>
+            </plugin>
+
+            <!-- plugin performing the license scan on the identified items -->
+            <plugin>
+                <groupId>com.metaeffekt.artifact.analysis</groupId>
+                <artifactId>ae-artifact-analysis-plugin</artifactId>
+            </plugin>
+
+        </plugins>
+
+        <pluginManagement>
+            <plugins>
+
+                <plugin>
+                    <groupId>org.metaeffekt.core</groupId>
+                    <artifactId>ae-inventory-maven-plugin</artifactId>
+                    <version>${ae.core.version}</version>
+                    <executions>
+
+                        <execution>
+                            <id>prepare-scan-directory</id>
+                            <goals>
+                                <goal>prepare-scan-directory</goal>
+                            </goals>
+                            <phase>generate-sources</phase>
+                            <configuration>
+                                <inputDirectory>${source.dir}</inputDirectory>
+                                <scanDirectory>${project.build.directory}/scan</scanDirectory>
+                                <scanIncludes>
+                                    <include>**/*</include>
+                                </scanIncludes>
+                                <scanExcludes>
+                                    <exclude>---nothing---</exclude>
+                                </scanExcludes>
+                            </configuration>
+                        </execution>
+
+                        <execution>
+                            <id>create-scan-report</id>
+                            <goals>
+                                <goal>create-directory-report</goal>
+                            </goals>
+                            <phase>process-sources</phase>
+                            <configuration>
+                                <scanDirectory>${project.build.directory}/scan</scanDirectory>
+
+                                <enableImplicitUnpack>false</enableImplicitUnpack>
+                                <includeEmbedded>true</includeEmbedded>
+                                <enableDetectComponentPatterns>true</enableDetectComponentPatterns>
+
+                                <failOnError>false</failOnError>
+                                <failOnBanned>false</failOnBanned>
+                                <failOnDowngrade>false</failOnDowngrade>
+                                <failOnUnknown>false</failOnUnknown>
+                                <failOnUnknownVersion>false</failOnUnknownVersion>
+                                <failOnDevelopment>false</failOnDevelopment>
+                                <failOnInternal>false</failOnInternal>
+                                <failOnUpgrade>false</failOnUpgrade>
+                                <failOnMissingLicense>false</failOnMissingLicense>
+                                <failOnMissingLicenseFile>false</failOnMissingLicenseFile>
+                                <failOnMissingNotice>false</failOnMissingNotice>
+
+                                <!-- REMARKS:
+                                    - the inventory may also consist of controls to further unpack archives in the
+                                      source tree. It can be more than component patterns
+                                -->
+                                <!-- NOTE: dedicated definition for component patterns -->
+                                <sourceInventoryDir>${project.basedir}/src/analysis</sourceInventoryDir>
+                                <sourceInventoryIncludes>component-patterns.xls</sourceInventoryIncludes>
+
+                                <scanIncludes>**/*</scanIncludes>
+                                <scanExcludes>-none-</scanExcludes>
+
+
+                                <targetInventoryDir>${project.build.directory}/inventory</targetInventoryDir>
+                            </configuration>
+                        </execution>
+                    </executions>
+                </plugin>
+
+                <plugin>
+                    <groupId>com.metaeffekt.artifact.analysis</groupId>
+                    <artifactId>ae-artifact-analysis-plugin</artifactId>
+                    <version>${ae.artifact.analysis.version}</version>
+                    <executions>
+                        <execution>
+                            <id>extract</id>
+                            <goals>
+                                <goal>extract-artifacts</goal>
+                            </goals>
+                            <phase>compile</phase>
+                            <configuration>
+                                <!-- NOTE: dedicated definition for component patterns -->
+                                <referenceInventoryDir>${project.basedir}/src/analysis/</referenceInventoryDir>
+                                <referenceInventoryIncludes>component-patterns.xls</referenceInventoryIncludes>
+                            </configuration>
+                        </execution>
+                        <execution>
+                            <id>scan</id>
+                            <goals>
+                                <goal>scan-artifacts</goal>
+                                <goal>report-artifacts</goal>
+                            </goals>
+                            <phase>compile</phase>
+                            <configuration>
+                                <!-- NOTE: for scanning and reporting we use the reference inventory -->
+                                <referenceInventoryDir>${project.basedir}/src/analysis</referenceInventoryDir>
+                                <referenceInventoryIncludes>reference-inventory.xls</referenceInventoryIncludes>
+                            </configuration>
+                        </execution>
+                    </executions>
+                    <configuration>
+                        <id>${project.artifactId}</id>
+
+                        <scanControlPropertiesFile>${project.basedir}/src/analysis/scan-control.properties</scanControlPropertiesFile>
+
+                        <tmdGroupId>com.metaeffekt.universe</tmdGroupId>
+                        <tmdArtifactId>ae-metaeffekt-universe</tmdArtifactId>
+                        <tmdVersion>${ae.universe.version}</tmdVersion>
+
+                        <userPassword>${universe.consumer.password}</userPassword>
+                        <userKeysFile>${universe.consumer.keys}</userKeysFile>
+                    </configuration>
+                </plugin>
+            </plugins>
+        </pluginManagement>
+    </build>
+
+</project>
diff --git a/scanners/scanner-template/src/analysis/component-patterns.xls b/scanners/scanner-template/src/analysis/component-patterns.xls
new file mode 100755
index 0000000000000000000000000000000000000000..62b64c35aacac1413b568bcd6d3f9004d9c7fe7e
GIT binary patch
literal 24576
zcmeHPdvH|OdH?S2O1k1HiHCWLMLZ-xB0`ce36B+E96JWg_z^ocj;zNnQV}b<l02A(
zvb0J6u-!BjE{u$lG)>$zv4ex{j?)PV@{A`=X5_TfiR*?ksnemEX6z=Iwv#5sx&8gl
z*|U51-rXy!#+_-iXXo5|&v(xEIN$lscOLiL{hPn8e&Y-07X4T}VVi{I*G{FByWkd{
z*PC>eAm4GAH1{Sv15^tChcr-Wqan-7<o-Ket@xgVq}&$yG45ZFyo9UBKOydy!!lFk
z_RiGcP&^sEy+7WUjK0rdhmxVwq736OysdZ&%NU^5vQSA@qpow*^;uQ!yt;0c8hN>W
zyykr8<!zgQEn>-ip>|d757o6!U1#BH$%_i-qJnIYMe<#gcaDFCrjAf%ZI_hvNvHJ7
z|5`4poX>ZyL?BN_D&)?zcFVAIL#`f37L^Y}#!g8h70*g(i>iZ<mabuCK&~Y*IZw40
z#I>X?AU7g&6=f<lzYd!3wm`mi0OgR}5P&PNisJQ+$c#X#wglixrbd2k)Jm^q$)>E#
z71mC)!XfF(SPbo@F|UMIBay(|OR&xybuTXMv@KBXX#u&GRA%LNQ?89HkuqpnRy3|y
z(Y!xex3X^Y{-#`_HnJQe!jioF2kwmbJeXgoPAX(+rqKH4d^#pw8>tst>b#}g)N(~P
z%Uane($TawniHm@39@+rEK%1~rzA&yM^k%8Q*ESC)=0ez-HoYADWqKaozf`VT;+`*
zZafz(!!#E2ux*od@_~FZ9tt_;u~?3Mt9%J<V6A`@EAVTE1CByd&qV8FGoG6O^XJq?
zw#rjznj&Zq$er*GJ@Q}xftdU`n$1OEJ$MIk_vY6|Zj&!V(m)c$B=HmbZTSndy48Ui
zuZ0E*)tY%)C&48QjXIRCbLms#^V%-F)<#aqSJ3tan0n>YsBDgW)`iQlG|OoLV(_uK
zM%9#fH9{PeuS#nnA&ArgODM)XKR=(TKhLoH9eEmB46Jhy(_D>nrSe&u`sU{w_Dkd$
z`W!eL)ww&?Y~J5s68qQC=X{Mm$AFNpy+mH2Iyp<9V+x^r=Fwqy1*v*@7ERzO<)M}-
zx?a8xw;>%385aX`eBR%nJ&;bp*C=><2Z-M!=cI)g5W<b5l5RW&$U}|EbMm2lR9%A%
zu?)5n4PqDq@EVjuao;G<WAx9-Yw)uo8)W6|a+q&mgk$&*C#vrHG9D$|GVp&lS;6p7
zk@Cghq^kIO=>LC)Tj;{Mp!Hb+fYQSYnViVymHz$kuN8rRwFvxd5%`%R@Mnv_pD6<W
zY!UclMc~EcDMtT!MF)!#kA6N^1g_=rm)G+6;a@63=Ufr^3q|1HE&_kF2>h>#z^5wD
zUn)A4Mn6wfS6^6mVVOiuDfl!O{PgtG(+zyOfqVL$1rMg|@IO&N1#O=*@T}mVujyzz
z!KzThe}Jj4Y+Hu4n&Lalz&-S58+g{vwcT3qU4{5!ZK~lOI@JcArSr7nTV~*6)z$N-
z&qsZqRB+CB3(>DJ<+F5j|C(dq9=>x8{0FiRkJ<Xp%ZEd~S`YJc@F*TpeGlA2AEThr
z=R<g0WXf9@9tz2CVT>vSUts8X=r1(zClU#5Cog98W=Vs{eJH>XX;g4Ndf}h2=gKG8
zk+NZjocphj*B`UD$gw;)TQ7v2gSisM6UPz`!W>1pP7F&t5do}YjUL4O_-y51e71LS
ze70^dK6kf@<I@U)@hbxHX)VF{R9A8Sw5niy_WR=aw7wwxiQU2ar!@xS2kW0!7>pmR
ze_CrWez5-0eI~&V*8k#3@q_h`Ijf655+3_+X${strn8ga2kXCfQv6{3!@W(yKUn|K
zN%4dAzkE{sVEtpFA1FWE97+`LKPx8157z(6N%4dAziLwaVEwP26hB!1^^@WU>;J|q
zKIi{qQtr6@KVi-*-*<BQf7~;EtU-x#HGZ({ua1ci|LWDNS^Nr&DJ*yV_;JUqkZm`t
z4vTIqyDQzW%%Xdm8wMH-$84`WF+jCE9M2fM^?B;4r+o6nVlkgQ3g(eV!94OPm}Uie
z8a(>pyBI60AJ*H*<1f25Tb8nO{+BE39k;P(mFYLsCuVk8x*WF&`_9kZ?dHY5DT_~D
zjD{E6gX!RYw`mf5Cl-wV!AbDFe%Gs4EW|T<^~&$pD^}dDvYc<5y87*>5xF^gj>R7K
z>D8GS_1Vw$vuAHRZH7F0eD(G(({G%#m6gXoKf_*!3x6!`w-e{hF&F+3kNvg+zYMmZ
zZOU;bvidN6`MKww%i<fE2s8cL^koIh^e5Ao6)e-A{B6<TX^U8vw~?oiZ@GSbxyhpo
z>~3dt>9x68(2;e_-seH!%hqtg$u*Vd?PTtbXO!nRX6$*p9Et<~Y>fG2XpU3~mUS)7
z(N)o===Ot0<H?~7BlbsRgo8*XSdm(17WTlJvB$9ru?caz9F(Kjdrry__oq-x3-4np
zBJsqfpS<mq@!3-74w+Q@n6&tr)CDrpW~rEz#S>RA{ezE5jgLvIpULV#CbZp5P0Hhm
zH{bq|kI5V#lQut-wSi39a!e}XiOc`^mXFC?ACnvXOx6c7(WA6dmmN=B{Mo<xn9TDr
z+307|639fGw_;KmPrUQfANrWgCzG~GtZNyVw7o0qn%Mn~iOW7FH~5$ou&xz>Ox)Hr
zvHK_Ac+tmXfsaW6>#7fA;<m1d-G6`iypPF3ACm&swJwl}+qx!pPmEvmF<IneQoy=C
z5Xi)BT@$-s{L#Pom@M`&DPUc#flS=iHL?5JYcKeiEFqJPlUP?2Og6qN>uPEJljmR8
zOwdJn+=ISrsgFqk>slGe#BE(Itrt%{;bT(kV^YAn8UmTPt*fQ=<=4;nm@M-#DPUcV
zflS=i)zW(IPhasdiTaonu&(AnCT{C$X&rg>l8?!9ACm&s)fULaZCx#`zq;^89wsyJ
zMhOeC?2x#{GbAo`DvAz*B6pnlmXF?w96eZ&m)>#@J-5wZ!*JgoAH9`1dN39*y;UB1
zZu1a1^UaU>=&j1pgI##(t?|%vTY^Zs=g)lfR_Ex!1ibW`JoMa+j#Ej`e8)$xK1UC&
z?WMQDL(kp5BEL9wi;rG|qBlHvptCDJVh`oFZ)l#PH!Op40BfZ#Om#TT=U7*UDHNxX
zoaFGC)5mfcq<OYL*PXKSQk8kBlcCvo9f<|Tj(95G-J2Xv9vHEYdPJG;Op_fDAcfd1
zy_j<iBOWL!5ZBa3Ag(iV0_l_yNT-ZII(0G>k+tbcXT-kMBSob%M@ccLPAT<b-baa|
za;rRolVp7E$JwPM=7pSYsu>^_q-jaRi$-K!x*Rkc^J$iqJJaQ6;2s6$A*i_@^d5k(
zeh@T7PKIXSNCZ0JuD)d9Mw*L8+NHP_Y9y|^a*g!xd(g>D%y}^(-jzBK?@IO!j@Wzi
zD-vGl*bpRzMv22#k`QSS6$ooJWG2FFk_xPG=^J#Dm{d8cIuD01v9-P{b+G?(DxU0#
zr=oYqj|`32JMvkDZgi>?tAo(iWn~lkj2PSEZm>UsmN6|rlVrP|4B0rdg5|@9he5F|
zpQ5$M3FEZcu)@=`U*d5$z-W)V1#HFUbQrA|&BrebqulK>fEHvMGO+B1w2iWB^UH>8
zCnCGOcESZV##^>`3)_2de0V6;+3)M*))KV$UeuAY@^oB3@NyD!U1}sA!@BikXd2F2
zU^j2?z);`O5xd7D%QTeU3%Q3N&rwjqiY(KmxoR~%h%3%q57H^qgLKODAe~~}+tOvI
z`^tQNWo3|lALJg$uAEr!lcAY%BdzPM?%sa*05s6Hd_-$8tm`h-_4`qIx&St@tK!&j
z%T^p4aufkQ4<fAgP!dIH2&$vebV8UO$^ap%FiApxz0?&?4R-gY`Vx?1Yd&^(HoEI2
z<qK1=Z_2@Al!=Tql%N7Ow(PcJ&MGSNWT-}N!eZ7<H0obnhO3;JMaV`oYfCq2I#<(i
z${=_R&eM5#_$O%L>Hr>ksP*%3Vqd<%6(D(h(96R=KMU6c@X*7rpNF1vh7^wvd3m(?
zdO&zi01pny8PA((2D+8abSoc?rw%5s9Zn3zqxZ-A`!U|_%WvDz0=Sir!n#s$;7Pd#
zm(F&L!>QblYd?M*0Yl28(LHdGG2<LJl<31EvLziUVE7S~ycf=j_F{%E?IgCQD^T7$
zEL6bG^2_HB3v+Om3p4+FJ5x!wr}T82&~!`y?^Q;ggz&*$5;a1%nTM@pXiKRmdJSFS
zaOzqjo*c3Nz@x1jpsk!<qR<y-2q|bSh3AA~=bkTc3t2TjbjXE;aV~o9VDzX{#<}Q}
zaV|RbY5P9;v}<eTGoV+E-`%KYmujQC&}xsUr#+CO2mNyxZn*`Hr%xVM&MsGij`)D`
zCL7TEM{q2ho3u(ofkN=0FZ>|DVFC|nf-;vh?ik>4Nz3^7IBsbf9d%^1HG!fNGJ*05
z{2ag~f%F6krWGyH)btbuMT1;`r0^zy?>M6}inKEdT+qdUF0BbiS|=s|M`^}U#01DE
zM&;D0Q-T80Itl=KTr1+Jih#8O7l8d$v(!Esu#^ZQ4_VwO{S@BIZ|6=H4w~;AICOXb
zrZp7Z*Euv4PbCMRv=_*eF1_m^o!w33i#TlmMOPkaJT4dj@jGipP{xYf00(by7RX{*
z4peT}XJ9kAX{$noykyykBCl-<$(t}I951-?TPm;oN;B@(T#i(NvkzHxj+rV@3X&vg
z2Hsm``jr~oFF*uaPFUMT>~X6d*LJCW8`e&*W6waun_>GGB30MqG{++qK^fXO1YJOm
z+mhY=!##1M6+m_!$%CL%=5)8W^H4kwu&*;Ugtz~>67WiceFI4p$~;B4C%bzGQV=8`
z5Z&1u?>;y<e8|CE*_Mw$4-i<o?fHm!$b|Wsdq_^9O-{LTcKov?X8=3nf>BYA1NOKJ
zMgp9T=np8+$6X&#Ob<cxnLyk}Fm9ZHb<NC-#3A&y+3L9(SLhLvUi-@1f4iq^U#vsH
z*DClrb^SdBNh>95qN_M+<D-BR$ayJ3Uh@!tUzPr(x~@j)2ineluczgwF`lzF&kcBf
zbm^9B@BHr1V{2T`d!$yvQOe5LgV=}%Mg#i-R=E~(V59hjkjGqxH)7^)$r$DlV;(K(
zTz#e7I@|*q)8v?H9YEGlA9(48GzX@8=H=4mSWVrtFqf`?5vS{OX|S_co?*zYK~#_G
zLLQa!S<nVB1oJ`AVzZEqxeS9X&18<O+47ERRgrd8PNyuSSU{&jNMY2>q{2wCRyr?&
z6uX>Gl_6E0O_d|X?x*v(C&2JJN_<j1y@f-+sMVDPAP$STLJ8S*r@??{OZW<z&X&lP
z2EcHj>57(Jp$g{Z^oWphn!=-6DF@5niTlV54Y$}CV75Ea)p<PQIIJjQ=?;&%D>QKd
zltRd<Qm!D=#7Of=r>d{u5eu(dV0ATk*8qE1PKXIJ05gI1!d_B^`yBb%GQ#2K6c5&q
z;Vq1hUO6$ppQ4;bQp#RfPRxR@yPV-E%Srhdpn@WDhTjJ{BU6@>@-fi13+of@c-{3`
zHf1@DN1?SBmJ{oX>n>;cl;xy+4D<(u<;0%Rb(gbZ%5qXZ270Q(a#p+#a&lHNHNWJY
z$Y6Hs@k^LTy(fKc!(#5+icLF&GvP7J10FN3O94ah<n(bI7wJ2f(p&4|T7jZKA)R2U
zm1;5?!YFqDQ>g<kYVc8<^oMU&+R#Ma*Xyq_YRn27IdiNCdE--`zxvBNdaIuPV_VkM
zKmWsKz|JEY(`d&tyWg#dtiwZyoIf5xWP6SwV#bKCcm&R0<OM`EwA2fx8ypm{eanwY
z8>5+TOI>jH$EGO9@;pzsr>{FTFgTDHitg#`?n@304E9DbwT$;8uN^Tx@9Haey!>~T
zdj8k(mXCe+B1fB2C~2UifszJF8YpR?q=AwKN*X9>prnD421*(zY2Y_n13~Nm&}*;0
zHnx6o)ydOX|2O{fEZ6_zh+OM)e}L<Lynw+AL;e2fKHRyce+ZH5{a!@AXgQ3?eE_pB
za2n5MA3(3otMcAMA={U(1!3|e-P~&-^U_UbAe$t)O~5w++f!ZfzM;Xc{zv&%&b8T!
zyizD>prnD421*(zX`rNmk_Ji|C~2UifszJF8YpStH%<dwQ*+_WbvWPU^Oy>cfbbnZ
z*ZJxI8tyzF%6Ix)$MYB+7uj6v<CLa)=g)PyIf%$LKlcTAz>NRl!~fyof9df3J^w45
zi*%j@iy|&ZtV3LZh+`2de>LtnBEbKn;y*Cre=`ODq>AH+h{S&fk@r$~?;5xh2fg`S
zOB7!U@eBPFj)YGo%*X#c8!2c<QJYu2PlVeoD&e`9|BEO1UU27!1YJswgPxL;C-E=f
zS^kt`atvMKbNrJKgfe_C!(;FK9*K3o4O&PjnF!(cJ_CRh4-MeYKE(d>Zu#?nomA(+
atxRqPhi)Z<{*Q#I$+PKyQ2$jf{{IaYeTrZJ

literal 0
HcmV?d00001

diff --git a/scanners/scanner-template/src/analysis/reference-inventory.xls b/scanners/scanner-template/src/analysis/reference-inventory.xls
new file mode 100755
index 0000000000000000000000000000000000000000..2f990aa3a0ef2f42c22d3ab8ff0b2e6f698e3122
GIT binary patch
literal 24064
zcmeHP3vg7|dH(M{q!r>JA;6f2Sj0<!L_jNJ5*{nSj!i5u<45e+FtQ%INQ1nhtCfe4
z5Y}ze>DaED3I~r2X__W(n%KedqhojK20YVAoEf?8bmDPCnbhgfOf&Yxn5L5^1G)Xa
zbN1}sy?5`GsYz$r?$MmP_x$I7o&WsjKaV}yzyG_&x4-iIf**@3ZIiJ4+OCrt2i(GY
zyD2va>TR1v^Vx=XfU4<#kp=2v=*XI=+;{sMwcnSJ)Wk%7jL&aJUc*!5Uy%37A(<g^
zTW@wWm&(L%8%_;n;=kdvL+Q|KQHQf|ysdb%<P@Nda=p@Qwt6<H=W`10RrTB|v&BC4
zbIU&Vh0kpQwSey4P?y5{1NCfC&zX2y^0J~iryv_-fxHfUP}0?rqSkiF%8>NRu>6nJ
zqRHiQ*GL5V6tqI^469qlq#t?>K(n~q0v&rLgHo!fWlU5XJiK%Z>jG=%1k_s6DX+3q
zDsr}@E}%9f*9CBnh?dI^DQ~~lxzU%l&9Y>ZuiQvr?RofsKke%hk?BgVpH|y^wW23=
z2G(u~sI?^N)1qb>ENfA%wG+Mnp!5|yRr{$WF&}zu&1n^7H%Asp6ul(N+LkR_zc1dh
zyk+yg_EMoavJ^AIqO$t????^oFGp&TT3K8`TDQKOk101tRzbxUH<puI33aoqk&Plf
z?Q7yCWqR77n+rgUmi88<IqG}byL#H2BW<!;RyoL>lnP4`mGE~;n{0F78%3OS4p>2G
zGU*cADQo2;<!oFWO2U)LlK6yt4SirOgBHv1w;lmF4of{7Z;{P-ZwJg<(;V3<Porym
z$nKXr5FG|&e*lA|{298<!C)O^2T6C=H%E5K*P&@33qMV~%zjJ$9KCM!pv7xofl94r
zowi9ZhT+iy{1%5jH9enQ!e?{jVfhC7zJgG<ewvisQ7*bN9<hn16-Z)qmpWB*;?pQ`
zP`)XNN=lHZ2cF<3yu7|#sJG6D`;0sTD+abXNNB0WC9HDMroH9$M*JdqmN5sxMh)(s
z)tmRVn!>)-j5*(8%rPL;>nKr%)FP)Da|{xOXBi(3SFl<o&!G!kST1e_)OGT0gbnFw
zErb}b<NLl=9f5QSu|~nWdcgcfd0sk50VSM7s_3LsfHKmgydWPdC)F(|Fe^|i)u4u9
zfT%$|l=O}AB4+=RzJ|W2vLRN%u0;7Z=3S=$u;c1eKhDMpw+#H}rYaa7^1=6mldF>J
z;{SgcZea+QlD20p0Ll(86>1`1R`&P8zvTn}rVsqI5B#JL{5c=^vp(=I`M@9bf&1y>
z$Nxpe2b&U?eg4=7uJ!TaYkj=%ulewK-Ut4Y5Bxhm@JD>$f9V6iT7CXP@tJ4r^F(9g
znI&hINaTcqPjkSZtbelJz_FXFIPNS&Fy)8;2?Uk2e>UM=!NFhi(S9=Dz<+=xsBBw;
zy_%9c-N0SrdZvLF{apL4h1gX|?reka;xpI4i+r9@a-#-*s<Cli{XDeyDFx@gq!Rx+
zgJ0yM#}{TJjqj2>%fNpid+}OqFZR$HU&HH-9U4pUI9@@n?Nfxi_|GZfKY-T-2H(Q;
zP)UCab5tex^@fj&KNQpWPo&e@PhKwC&5~A;dx5|dX^Ve0Hb*|o0aHxdWp)3fE04yu
z$k8%5TOYy+!5j(WjdKPkTh5l;(}g9KjsVuPT2EG9dRilxp8e`iPcI3k=P8yyJ-s`a
zzBZ7ay%tPQbNS1sHwV+xPyOjR`h(~vyMygdZx5yqwm+jlFnzH7>8-)^!S=^6nSwsp
z{tKt154JznrVjZixct8(5o~`fTc@B8wtw@K^uhK=7@I<Vu>Ipx(g)jr>6G-r_Q!%g
zP=ACoVEB)pWmD1z+kg3#^uhLDF(rMl{Z~#&A8h|sQ_=_9|Arzx*ZHTU#&*Vk!tC$;
ztzEMJW3KsQH85(_{6XAb9TgA#rAwEJ^tG5%h<EJRG285fV@_BLHrLo**EwN@&Gj@V
z3_O^Q#@zZO0oD3&K4WsX=jo@P_UMyLCO!Hnm`fi8bLpdCS`_qYb=hYfYOJDt*lweb
z7k5n&m%4MlFX6i9ZJbRN#trR>6<m=o=WW8i`<}Dk-1IjV=_!lZ$YOu696ateO+jxb
zgXupy1-(1&y6uV$cfqc1{k?X@&f0;?b+u`$*MImuSjnH0$%j04wI?S${&Vg8+1*c@
zp^u(l-Q&xQ8#`|m_3^IHaHip)Kb7+OiT%zg2mN7}|0X~mg)eBIvhB&DJ<M2s;e{89
z^hPJb%=k8AS-}e9$&6(MD~u;^U$naVB3YDe^r;kEuH9H}ci94`*acg<eQqXfWF3v|
zbrJ9j*KozfHI3&UWX^$SjOTS`oNYS-ijDYeocVaDNg4#(w2t-h74i1?_Jc=KncRl)
z*e7J1lSm<1k!E`)&brp)EMo<7JMwlpC`WL{oRJ*Qq0mYT-<{M(Qt9(QdEbum-BRQ>
zg*1AEba;id1Pak^sf0vR=}YJT$s=U8M@YgeWM!Zb`fi~mHL3JF@Bhdnq{$<s(<@|6
zppedzklIxG!au+35i-Xk<OZ*hb%8?kEUnBHOQp~K?B6{?=6Zx|^a|++6r$Z*38_n^
zul)3f9wGB6q;m@IS^^=RAIQ5VyI+~S;1P12M@R+lS{5k8>0OiEKY8V4kC6EuAr-u9
zRiF^3cTINx<Aql}Laz4+so-5}1BE!fYqERt>^YB+1s)+4yz3)@LY&?;+5Pg5{>>v~
zp+`ss?@9y;aeCKe_vJTV@(5W(AseUgt~i8j{6OB-k@(_^Z)qVIqP*6@*tOUrq=I)X
z4;13`u8zdH6Hj=AG<$?p@UGTCAx`h=Nc_!PCp|)zc!X5&uC_oSPVeeSJpU)(^9YH1
zgjDdZ^?^d1-qn#9f8)GI$Wo7x3f|QjD8%Vq9f@C^`9qhG>G<Xd8?oY)xWzRkF1BlZ
zCqa?hAO33(zhxzU@E|w8r7nI>pTWW4-rXL4%S-&=EN*@)T>PBwA#(DsKIP%JqQnn=
z;pVs6#n0&pBKd(o_3&F+;s+OS^J{nUb9OpzA3ghB55H9<e&}sCzYQ*a&i)no#fgu5
z__Zp2W1|Op`%>evTzUV7<|=+;GAakKSL(x3hs%7<bx|y#xQyf?hwofI*1#dny9K_^
zQmm|0S5`V6nuV_&vBB7p%BK1UGh>+p<FO+yRp!~#WCs+;BKON6)?8!A2YeOcp4uqH
zeMU(kT`~&kl2J&Pj)x+$CSPZd$8L3LQD-+PEk@OCq(Q9vs8L*Ql~3cw7~h9+M=67K
zA(xwK1&9r4Uh;^d5m}qB0nfH_p3xe+UTy;I5l}t|GY^B`{fO23!9(PDXgaPwU=ZFs
zl&RcFbI?gQE2)(_iTkcnCq48bY%&9DUMz@j&K^khWrjw_V|&UQ629J!L6IyvB?Vu}
zK&4SMAgs+$SO~LAYO%*<Y|vd|N;PQeTv>;;I7A#AzK~6222$DhU8%#l@z{=XQK1{`
z1|{kstaU;8guV;LzPJnG52I&H56~squg60%+)csu;g&IQ>@4SKEwID5RW_#R^y-&%
zJPk0`<7okVaeY3FUW}L1N5jCoO-9gz>_aBvZpg=gyQUmB6tg4J?e-IHurc4VzdP99
zds1V$Z11pVkXwt;-+RzT>dISi!=Ni^%zdfR_!Rc7$3xR_uL7redq#3YN5*3VE?uSp
zdk^%^L7yYwgdJI7NORX}Mi6(Lr4gh{W(4Vy89}<lws+>EX#4VVdC@4e-wVA*iaRH^
z`*>)E+(7TTvwv_HF#sL3t(?$W2=BU64gFy>o*{r;>}WU++=>myfgDx9$b$+iU7SR5
z%E5GWnqDX~Kpmh&0~Sdbujl(x+0p*N>`)qdY%Qk_&%$s$uVP^q{!Kl2T{2zJh8onu
z$Cm6mYOkO%kB4T<jo8dOnZ~`l%W#7|!-s9Wu(x!wW^gqFCkn-9<3^uLhIfG$ZVZs2
zr&_NJJNfl9+yPR?N8K{K>$C9e02zAv^~%s|&XAJvF}I9P&j<)N1<2r(T!_4dZeUp1
z%&_vwRQ6!z@}YDt6~8YvJdF8nZ+YK_<|C|p65f?X0ME!}gmm_63PI&QJcsee88D<G
z8p8u888grEK#4IdB3ts23XUHE<~;~j^cORA=^(K+UkiNqv``B_E5|RN7MgHp3oHM7
zdb1g4q;w6NP(2oa_b4aNK>6S(i56kl%*9bMtffp8zl@=9D0?}b%8bW;&t<LaV6Bo}
z;;<K22w7Myi}$n==UgxF2w8PLY{-p;2`+l=VC<+%Cb;O52`;+yc<f$z+;KGX1@LRc
z-(6^CpX#GK(QBVpZ@Zzz0LJGS!g2=!&yYN%f?WxNf%t%mCL1vN$8r6ehqOvVfkE)1
zAH4W)vw)X8L4`*ipP1nB$jjNYXYrAji3wXK5^11L$|Ug9__G0*G|H1?m{+{WQ}a_C
z6c0)Pk)oRfy=_m(1j_aVXu%f~x+K!JBqk>T2R8EravJQ@6LR9j2?2s6CIG;QOCV3E
z3|IoR0PJg+sm{?rrBo1kz~Vva=V8V7*5d`22exN(L+RfB+~`xW`SO&*+<GSGC=>ZA
z?$UqNQAg6p1oIyLPFoS+Sdr^6d@%nM5<6arEql(Fg|ZYZd3s;qKZ9quvi}OFq}Qw%
zvdEj8Lh=qK4%{lZm{kmGF0!{Qd>>nbPfVMNoGf_ZgUM)TJ}H8U<%HB<oQ=;jD8=Mq
zYdgSatu8#fr1^ae0&<B>N5&V%v0sQZT$Yb3Nt6bQ?HT}^or9_VgQH^);wz(_BM%-L
z!FbF;6NH=5p^*#_Zpn^}9g6Q7z!bl8xOa4PC_R+Q+F0?%WEZRr{?Z?thm4m(npgM?
z$qAVFgrjE1zglt<u#*lL+xr+`k2zpuz%_;bcL$7A$G<z&hvu+aCDN`!^nV9=Mqxe;
zVa&`@?~QCF!a+<ff8+gs*xk1`*`wfV6nw3E{<ebTfn(AN&b_$8|1fG^i%`~F<lj-)
zzpI`rfqj4H>F*D8{4~j1(dNAs?~g3ra{0>V-b=1_yziD~3CF1`^8j)iUYHH+E7+@A
zsDaDjFN8YQGQFKNpZIqQtOib%6x9`uC-v6pZt$2UM^*1c<?bfh17Dq?jJ~(-p393d
zBDvTCWc8{ZHK?x#T^)3<l`nw?*dfGeB&`lTCx(><Q;p2mKx>v<QN1P7rD}A^LWu~v
z6hetQ=u#LZYO6~TlrY~FN>P+J<lcgWL41n5i|e&$!NmbEKyO~8${a1z!D5z#FLnby
zOClFr0mIdyi&{SvkgzglOoHrbijHE*o%na)b9}mnW4tSu+lf(y0V&7e0TD}&Evz14
zku%@~LDHZ`oo+gcs*SqTc#-A(7-e(uPc6KTX)Pthr0IZ}#J;A7H{i2Lezt^ggd8Qq
zbjiDzq1<{Z=j2%Yz<L@@se5HTu@1fFdWNssp45+to={oO@NYoR$W`k}{g_BtSx@xi
zHMeK<s`VrR6TQ8%o><{ub3JRWT2C{*GPYFK6Q?#GO3!Ur{(px7L%R4Vq(?F5JZgrT
zf`xD%$T7(n%(1?h(M4lx#YBNZR-x~S7l}*&^X|C^Fv}iraKo75Y9V}+p2#$p5C8l%
zV%f~F(Wb<Ykheeo<x9W3eX!w~KZ?oPRWJS!v$Om@vT*>GsUa5~TsZ7S=0YQf+=QG*
zRsn96V8UW(a{Ut_%7pX&)b64F?8xXyIv3yF+dq`ajf@V)Z$8|g8b)0gvV3O6p-;Vj
zj`6ITsurkPplX4t1*#UPTA*ryss*YRs9K<EfvN?n7N}a_DlHJS{|~+S#+#?sEo?ac
zB=-MpzdX(T{wv7b^YeV*R%HI~82A1BBH><S?(rW$=Kg;WnMe1Bka;d}7@5cWk0YCN
z0llAZQ1k%%el~+KW%4+s_+^Yt2b7$6iohf2?b*K6P;Rtu_>o*Lm35r_p{|;$7N}aF
zYJsW+surkPplX4t1*#UPTA*ryss*YR`2TAG?y0$h=02P^E%@C&FHZ1w1NZs-<p=J$
zxxeS$o%?uR;NotZdwu?P55N28e&1Ye<DQ@A0`rmi+b;Zl7XHQxe<zy1b;8{`?<d8P
zmm;?yFGFVi3Vg0a#+3p79ua?m55Joz_$5tUe+4+itEOvXfje*knE&q($A6IUKew~E
zDtt9*9)7FWXhJ`V$M_UEtDd;IRw0?+3uo0mkj@L{eM*mm6|jRr_!a1)eCiR5U8;TM
zM*SYezftfyH2+V9ZQlheq?JyD@c%$Y0P#<)kk2v1@$*6D^S+B3Jot#pO_0#9bkP4h
Qe|7q7`fs#<xkLVc0i|zCAOHXW

literal 0
HcmV?d00001

diff --git a/scanners/scanner-template/src/analysis/scan-control.properties b/scanners/scanner-template/src/analysis/scan-control.properties
new file mode 100755
index 0000000..6ed790f
--- /dev/null
+++ b/scanners/scanner-template/src/analysis/scan-control.properties
@@ -0,0 +1,34 @@
+# These includes/excludes apply to unpacked analysis folder of an artifact in the analysis folder and specify the
+# files included in the scanning process.
+analyze.metascan.license.includes=**/*
+analyze.metascan.license.excludes=\
+  **/.DS_Store,**/._*,\
+  **/.git/**/*,**/.git*,**/.git*,\
+  **/.svn/**/*,\
+  **/*.mp4,**/*.class,\
+  **/*.so,**/*.so.*,**/*.a,\
+  **/debug/core,**/Debug/core
+
+# Segmentation filter includes/ignores. These includes specify which scan results contribute to the derived results.
+# Licenses in filtered files are still reported as identified terms. Licenses in files that are ignored are not
+# # reported.
+analyze.scan.segmentation.ignore.includes=--none--
+analyze.scan.segmentation.filter.includes=--none--
+
+# enable scanning features
+analyze.scan.pom.enabled=true
+analyze.scan.license.enabled=true
+analyze.scan.segmentation.enabled=true
+
+# these scanning features require scancode; currently disabled
+analyze.scan.scancode.enabled=false
+analyze.scan.copyright.segmentation.enabled=true
+
+# control overwrites; false means that scans are not overwritten and reused to boost performance of the scan
+analyze.scan.license.overwrite=false
+analyze.scan.scancode.overwrite=false
+analyze.scan.segmentation.overwrite=false
+analyze.scan.copyright.segmentation.overwrite=false
+
+# forces html reports are produced when true
+analyze.metascan.report.force=false