topic Re: Identify open source jars in Talend project in Talend Studio

Identify open source jars in Talend project

thomas_ciampagl — Mon, 23 Sep 2019 19:27:53 GMT

Hi All. For my project, I have to supply my company's security team with a list of all open source jars that will be used directly or indirectly anywhere in my project. In other words, I need a dependency tree.

In Talend, I can find the list of installed modules, but I see nothing in that view that indicates whether I have a job that actually uses the module and I see some that I am definitely not using on the installed list.

I attempted to just find one of the pom files and get a maven dependency tree from the command line (i.e. maven dependency:tree) but that failed, I assume because my generic maven on that machine is not configured to access Talend repos or something...

Anyone know how I can find this dependency (which must include all jobs/joblets/etc.).

If the answer is that I need to use Maven from the command line, then please let me know the settings I need for maven.

Thanks.

Re: Identify open source jars in Talend project

Anonymous — Mon, 30 Sep 2019 09:14:07 GMT

Hello,

Is it enough for you to set customization of assembly and maven pom.xml in Talend Studio configuration?

https://help.talend.com/reader/QrWkwPvKmKybs~JNLeBt3Q/3baqcOWkcGX8AZZdEeP5tA

Best regards

Sabrina

Re: Identify open source jars in Talend project

Anonymous — Mon, 30 Sep 2019 12:44:47 GMT

This can be done in this way:

Create a job (wich will not actually be used in production) and add all your jobs in it. It does not matter if you do not set any context variables or any configuration.

Now right click on this job and choose Build job.

In the folder (under workspace) .Java/lib/ you will find all jars used in your jobs.

Re: Identify open source jars in Talend project

thomas_ciampagl — Thu, 03 Oct 2019 15:48:21 GMT

Thank you, but I am not seeing how that link applies to my question. I need to give our security team a list off ALL open source used in the project. So, what jar files are used but the jobs/components and all of the sub-dependencies of those jars. The other alternative, since I'm using the licensed version, is if Talend's license already guarantees the security of all of the jars it pulls in automatically. Is there something like that?

Re: Identify open source jars in Talend project

thomas_ciampagl — Thu, 03 Oct 2019 15:51:52 GMT

Thank you. I actually dd see this, but this is really only step 1. This will show me that my jobs, for example, use a combined 20 jar files. But I still need to find all of the jar files that those 20 include (could end up being 100 or more potentially). The maven argument "dependency:tree" can supply this information and since Talend uses Maven, I assumed there should be some straightforward way to run this command on my jobs, but I can't find it...

Re: Identify open source jars in Talend project

thomas_ciampagl — Thu, 03 Oct 2019 16:30:31 GMT

Actually, I finally figured out what I was trying to do originally which was get the maven dependency tree. From the command line I was originally just locating the POM.xml and running "mvn dependency:tree". I didn't realize that this was using Maven's default settings file and I needed to use Talends settings file. So, once I did "mvn -s <path to talend settings.xml> dependency:tree", I got the results.

However, the results tree actually doesn't go into much more detail than the list created by answer below, so O accepted that as a viable solution.

Thanks for the help.