Incorrect Maven packages reported when scanning build.gradle for an Android app

[pombredanne]

While scanning F-droid sources at:
https://staging.scancode.io/project/fdroid-source-99ed4069/download_input/org.fdroid.fdroid_1023051_src.tar.gz/
these are "implementation" deps from a gradle build:

dependencies {
    implementation project(":libs:download")
    implementation project(":libs:index")
    implementation project(":libs:database")
    implementation libs.androidx.appcompat
    implementation libs.androidx.preference.ktx
    implementation libs.androidx.gridlayout
    implementation libs.androidx.recyclerview
    implementation libs.androidx.vectordrawable
    implementation libs.androidx.constraintlayout
    implementation libs.androidx.lifecycle.livedata.ktx
    implementation libs.androidx.work.runtime
    implementation libs.guava // somehow needed for work-runtime to function

    implementation libs.material

    //noinspection UseTomlInstead
    implementation('com.journeyapps:zxing-android-embedded:4.3.0') { transitive = false }
    implementation libs.zxing.core
    implementation libs.guardianproject.netcipher
    implementation libs.commons.io
    implementation libs.commons.net
    implementation libs.acra.mail
    implementation libs.acra.dialog
    implementation libs.adapterdelegates4
    implementation libs.slf4j.api
    implementation libs.logback.android

    implementation libs.rxjava
    implementation libs.rxandroid

    implementation libs.glide
    implementation(libs.glide.compose)
    annotationProcessor libs.glide.compiler

    implementation libs.okhttp
    implementation libs.bcprov.jdk15to18
    fullImplementation libs.guardianproject.panic
    fullImplementation libs.bcpkix.jdk15to18
    fullImplementation libs.jmdns
    fullImplementation libs.nanohttpd

these are reported as:

 pkg:maven/
accompanist
pkg:maven/acra
pkg:maven/acra
pkg:maven/adapterdelegates4
pkg:maven/androidx
...

which is incomplete or incorrect.

[VaaishnaviS]

Sir @pombredanne,

I have been looking into this issue and trying to understand where the incorrect Maven packages are coming from. I tried to access the ScanCode staging download link but it looks like it’s internal so I couldn’t open it.
So I’m planning to reproduce the problem using the public F-Droid source (or a small Gradle project that mirrors the same dependency setup) so I can see the behavior locally.

From an initial look it seems like Gradle version catalog aliases (libs.xxx) aren’t being resolved, and project(" :... ") dependencies might be getting treated as external Maven packages.
Before going further I just wanted to check with you would it be okay if I work on a careful fix in this area, with tests, focusing on resolving version catalog aliases and ignoring local project dependencies?

Happy to adjust the approach if you’d prefer something different.
thanks :)

[Kaushik-Kumar-CEG]

@pombredanne

I've submitted a PR to fix this issue: #4704

Summary:

• Added support for parsing Gradle version catalogs (gradle/libs.versions.toml)
• Resolves libs.* references to complete Maven PURLs
• Studied existing gradle parser patterns and followed the codebase conventions
• All existing tests pass and All CI checks pass

Happy to address any feedback or make adjustments as needed