fix(java): check if a version exists when determining GAV by file name for jar files

[DmitriyLewen]

Description

See #5627

Related issues

• Close identify jar files by file names only for GAV from required version #5627

Related PRs

• feat(jar): add version for SearchByArtifactID function go-dep-parser#276
• refactor: search groupID by artifactID and version trivy-java-db#23

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[knqyf263]

What if changing this method to match the version as well as the artifact ID?

[DmitriyLewen]

Do you mean just to move the following logic to trivy-java-db?

trivy/pkg/javadb/client.go

Lines 157 to 188 in 2f10ed1

	func foundGroupID(version string, indexes []types.Index) string {
	var groupID, maxGroupID string
	var count, maxCount int
	var versionFound bool
	sort.Slice(indexes, func(i, j int) bool {
	return indexes[i].GroupID < indexes[j].GroupID
	})
	for _, index := range indexes {
	if index.GroupID != groupID {
	// save a new GroupID with the max number of indexes (if this GroupID contains the required version)
	if count > maxCount && versionFound {
	maxGroupID = groupID
	maxCount = count
	}
	count = 0
	versionFound = false
	}
	// iterate over all indexes of the current GroupID
	groupID = index.GroupID
	count++
	if index.Version == version {
	versionFound = true
	}
	}
	// save latest groupID
	if count > maxCount && versionFound {
	maxGroupID = groupID
	}
	return maxGroupID
	}

Or update our sql query in trivy-java-db?

[knqyf263]

I meant SQL query. Is it possible?

[DmitriyLewen]

I need more knowledge on SQL.
I will try to do this and then write to you.

[DmitriyLewen]

I created aquasecurity/trivy-java-db#23 and updated this PR.
Take a look, when you have time, please.

[DmitriyLewen]

@knqyf263 i updated trivy-java-db version.
Take a look this PR please.