Excluded coordinates should not be queried in the OSS Index ?

[dvbarnz]

Using config similar to below (obfuscated) - the excluded artefact is still included in the network request to query the index.
The excluded artefact is one of our internal dependencies. We do not wish for this information to be transmitted outside of our networks.

      <exclude>
          <groupId>uk.xxx.yyy.zzz</groupId>
          <artifactId>aaaa-bbb</artifactId>
          <version>0.0.14-SNAPSHOT</version>
      </exclude>

POST https://ossindex.sonatype.org/api/v3/component-report;
payload: {"coordinates":["pkg:maven/org.yaml/[email protected]","pkg:maven/uk.xxx.yyy.zzz/[email protected]", ... etc..]} (application/vnd.ossindex.component-report-request.v1+json); accept: application/vnd.ossindex.component-report.v1+json

[jdillon]

@dvbarnz do you have a more complete example showing this exclusion is not working? Dependency collection should respect these rules, but its hard to tell why its not for you w/o a concrete example showing it is not.

[dvbarnz]

Hi there @jdillon - this should illustrate what the issue is. Apologies if it wasn't clear to start with.
https://github.com/dvbarnz/oss-example

[jdillon]

@dvbarnz Thx, that helps.

The reasoning here is that (as the impl stands today) the excludeCoordinates configuration is processed to exclude matching (and reporting) vulnerabilities found in specific coordinates and not what is used to collect/exclude the coordinates to request information from the service.

If you had used the dependency exclusions mechanism it would have not included the coordinate in the request to the service. This is why I wanted to see an example so I could confirm how you are configuring Maven ;-)

ATM I don't see any reason why the application of excludeCoordinates couldn't (or shouldn't) be applied before making the request the the service. So we should be able to adjust this behavior as you mention above.

[dvbarnz]

Great, thanks @jdillon . Yes, I realised the original description was a bit ambiguous but for some reason I couldn't find the edit button to add a bit more context at the time. :)