From d4d60082bbd1e083dd44379941b0d011ceaf1630 Mon Sep 17 00:00:00 2001
From: Youssef Bel Mekki <38552193+ybelMekk@users.noreply.github.com>
Date: Wed, 16 Nov 2022 13:46:18 +0100
Subject: [PATCH] add ability to pass command line options for maven cli (#90)

* add ability to pass command line options for maven cli

* update readme

* rename param and function

* fix flag for salsa tool

* add maven_opts to action.yaml

* make readme better for maven opts

* update mvn command

* fix(doc) Update documentation and renamed actions

* fix(action) add default
---
 .../workflows/keyless-salsa-integration.yaml  |   2 +-
 .github/workflows/main.yml                    |   2 +-
 .../service-account-salsa-integration.yml     |   2 +-
 README.md                                     |  33 +++++++++++++---
 action.yml                                    |  12 +++++-
 entrypoint.sh                                 |   1 +
 pkg/build/jvm/gradle_test.go                  |   2 +-
 pkg/build/jvm/mvn.go                          |  36 ++++++++++++++----
 pkg/build/jvm/mvn_test.go                     |  17 ++++++++-
 .../.gradle/7.5.1/checksums/checksums.lock    | Bin 17 -> 0 bytes
 .../.gradle/7.5.1/checksums/md5-checksums.bin | Bin 23147 -> 0 bytes
 .../7.5.1/checksums/sha1-checksums.bin        | Bin 41717 -> 0 bytes
 .../7.5.1/checksums/sha256-checksums.bin      | Bin 27737 -> 0 bytes
 pkg/build/test/buildtool_test_util.go         |   2 +-
 pkg/commands/scan.go                          |   8 ++--
 15 files changed, 92 insertions(+), 25 deletions(-)
 delete mode 100644 pkg/build/jvm/testdata/jvm/gradle/.gradle/7.5.1/checksums/checksums.lock
 delete mode 100644 pkg/build/jvm/testdata/jvm/gradle/.gradle/7.5.1/checksums/md5-checksums.bin
 delete mode 100644 pkg/build/jvm/testdata/jvm/gradle/.gradle/7.5.1/checksums/sha1-checksums.bin
 delete mode 100644 pkg/build/jvm/testdata/jvm/gradle/.gradle/7.5.1/checksums/sha256-checksums.bin

diff --git a/.github/workflows/keyless-salsa-integration.yaml b/.github/workflows/keyless-salsa-integration.yaml
index 89fe1b4..ea5ee74 100644
--- a/.github/workflows/keyless-salsa-integration.yaml
+++ b/.github/workflows/keyless-salsa-integration.yaml
@@ -35,7 +35,7 @@ jobs:
           context: integration-test
           push: true
           tags: ${{ env.IMAGE }}
-      - name: Generate provenance, upload and sign image
+      - name: Generate provenance, sign and upload image
         uses: ./
         with:
           identity_token: ${{ steps.google.outputs.id_token }}
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 0b9519f..ad233be 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -10,7 +10,7 @@ on:
       - 'Makefile'
 
 env:
-  VERSION: v0.4
+  VERSION: v0.5
   IMAGE_NAME: ghcr.io/${{ github.repository }}
   COSIGN_VERSION: v1.13.1
   SYFT_VERSION: v0.44.1
diff --git a/.github/workflows/service-account-salsa-integration.yml b/.github/workflows/service-account-salsa-integration.yml
index ceec11b..fa750b9 100644
--- a/.github/workflows/service-account-salsa-integration.yml
+++ b/.github/workflows/service-account-salsa-integration.yml
@@ -34,7 +34,7 @@ jobs:
           push: true
           tags: ${{ env.IMAGE }}
       # Added to a workflow
-      - name: Generate provenance, upload and sign image
+      - name: Generate provenance, sign and upload image
         id: salsa
         # nais/salsa@v...
         uses: ./
diff --git a/README.md b/README.md
index 8721bc9..24d7cd0 100644
--- a/README.md
+++ b/README.md
@@ -189,7 +189,7 @@ jobs:
           credentials_json: ${{ secrets.GCP_CREDENTIALS }}
 
       - name: Provenance, upload and sign attestation
-        uses: nais/salsa@v0.3
+        uses: nais/salsa@v0.x
         with:
           key: ${{ env.KEY }}
           docker_pwd: ${{ secrets.GITHUB_TOKEN }}
@@ -260,8 +260,8 @@ jobs:
           id_token_audience: sigstore
           id_token_include_email: true
 
-      - name: Generate provenance, upload and sign image
-        uses: nais/salsa@v0.3
+      - name: Generate provenance, sign and upload image
+        uses: nais/salsa@v0.x
         with:
           identity_token: ${{ steps.google.outputs.id_token }}
           docker_pwd: ${{ secrets.GITHUB_TOKEN }}
@@ -306,8 +306,8 @@ store the cosign signatures and attestations, see more specification in
 the [cosign docs](https://github.com/sigstore/cosign#specifying-registry)
 
 ```yaml
-- name: Generate provenance, upload and sign image
-  uses: nais/salsa@v0.3
+- name: Generate provenance, sign and upload image
+  uses: nais/salsa@v0.x
   with:
     key: ${{ secrets.SALSA_KMS_KEY }}
     docker_pwd: ${{ secrets.GITHUB_TOKEN }}
@@ -331,13 +331,33 @@ build tool can authenticate with a `PAT`. Use the `with.github_token` field to a
 
 `with.token_key_pattern` can be used to specify a key pattern, other than default `GITHUB_TOKEN`.
 
+#### Maven Options
+
+`with.mvn_opts` - (optional) additional maven options in a comma-delimited string.
+
+Useful when your project depends on a custom maven settings file or use dependencies from a private repository.
+
+Actor need to set `with.github_token` with access to the private repository.
+
+```yaml
+ - name: Generate provenance, sign and upload image
+   uses: nais/salsa@v0.x
+   with:
+     mvn_opts: "-s ./.mvn/settings.xml, -Dmaven.repo.local=/path/to/local/repo"
+     github_token: ${{ secrets.PAT }}
+```
+
 #### GitHub context
 
-The GitHub context contains information about the workflow run and the event that triggered the run. By default, this
+`with.github_context` - (required) default to `true` to include the github context in the provenance.
+
+The github context contains information about the workflow run and the event that triggered the run. By default, this
 action uses the [GitHub context](https://docs.github.com/en/actions/learn-github-actions/contexts#github-context).
 
 #### Runner Context
 
+`with.runner_context` - (required) default to `true` to include the runner context in the provenance.
+
 The runner context contains information about the runner that is executing the current job. By default, this action uses
 the [Runner context](https://docs.github.com/en/actions/learn-github-actions/contexts#runner-context).
 
@@ -356,6 +376,7 @@ The Following inputs can be used as `step.with` keys
 | `github_token`      | String | ""                    | Token to authenticate and read private packages, the token must have read:packages scope                                                                  | False    |
 | `token_key_pattern` | String | ""                    | If a token is provided but the the key pattern is different from the default key pattern "GITHUB_TOKEN"                                                   | False    |
 | `build_started_on`  | String | ""                    | Specify a workflow build start time. Default is set to github_context `event.head_commit` or `event.workflow_run.head_commit` depending on workflow usage | False    |
+| `mvn_opts`          | String | ""                    | A comma-delimited string with additional maven cli options for the dependence build                                                                       | False    |
 | `repo_dir`          | String | $GITHUB_WORKSPACE     | **Internal value (do not set):** Root of directory to look for build files                                                                                | False    |
 | `github_context`    | String | ${{ toJSON(github) }} | **Internal value (do not set):** the [github context](#github-context) object in json                                                                     | False    |
 | `runner_context`    | String | ${{ toJSON(runner) }} | **Internal value (do not set):** the [runner context](#runner-context) object in json                                                                     | False    |
diff --git a/action.yml b/action.yml
index 4ed9de1..3e89818 100644
--- a/action.yml
+++ b/action.yml
@@ -68,9 +68,15 @@ inputs:
     required: false
     default: ""
 
+  mvn_opts:
+    description: |-
+      A comma-delimited string with additional maven options.
+    required: false
+    default: ""
+
   github_token:
     description: |-
-      Token to authenticate private packages repository.
+      PAT with at least packages:read scope to install packages associated with other private repositories (which GITHUB_TOKEN can't access).
     required: false
     default: ""
 
@@ -97,7 +103,7 @@ inputs:
 
 runs:
   using: 'docker'
-  image: 'docker://ghcr.io/nais/salsa:v0.4'
+  image: 'docker://ghcr.io/nais/salsa:v0.5'
   args:
     - ${{ inputs.repo_dir }}
     - ${{ inputs.repo_name }}
@@ -108,6 +114,8 @@ runs:
     - ${{ inputs.repo_sub_dir }}
     - ${{ inputs.key }}
     - ${{ inputs.identity_token }}
+    - ${{ inputs.mvn_opts }}
+    - ${{ inputs.github_token }}
     - ${{ inputs.docker_user }}
     - ${{ inputs.github_token }}
     - ${{ inputs.token_key_pattern }}
diff --git a/entrypoint.sh b/entrypoint.sh
index ff2c6c2..ca63729 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -86,6 +86,7 @@ scan() {
     --env-context "$ENVS" \
     --subDir "$INPUT_REPO_SUB_DIR" \
     --with-deps="$INPUT_DEPENDENCIES" \
+    --mvn-opts "$INPUT_MVN_OPTS" \
     --build-started-on "$INPUT_BUILD_STARTED_ON" \
     --remote-run
 }
diff --git a/pkg/build/jvm/gradle_test.go b/pkg/build/jvm/gradle_test.go
index 808f65e..88dcc8b 100644
--- a/pkg/build/jvm/gradle_test.go
+++ b/pkg/build/jvm/gradle_test.go
@@ -76,7 +76,7 @@ func TestBuildGradle(t *testing.T) {
 		},
 		{
 			Name:         "cant find supported build type",
-			BuildType:    BuildMaven(),
+			BuildType:    BuildMaven(""),
 			WorkDir:      "testdata/jvm/gradle-kts",
 			Error:        true,
 			ErrorMessage: "no supported build files found: testdata/jvm/gradle-kts",
diff --git a/pkg/build/jvm/mvn.go b/pkg/build/jvm/mvn.go
index 15496fc..2537860 100644
--- a/pkg/build/jvm/mvn.go
+++ b/pkg/build/jvm/mvn.go
@@ -17,12 +17,16 @@ const mavenBuildFileName = "pom.xml"
 
 type Maven struct {
 	BuildFilePatterns []string
+	CmdOptions        string
 }
 
-func BuildMaven() build.Tool {
-	return &Maven{
+func BuildMaven(cmdOpts string) build.Tool {
+	m := &Maven{
 		BuildFilePatterns: []string{mavenBuildFileName},
+		CmdOptions:        cmdOpts,
 	}
+
+	return m
 }
 
 func (m Maven) BuildFiles() []string {
@@ -33,11 +37,8 @@ func (m Maven) ResolveDeps(workDir string) (*build.ArtifactDependencies, error)
 	cmd := utils.NewCmd(
 		"mvn",
 		"dependency:copy-dependencies",
-		[]string{
-			"-DincludeScope=runtime",
-			"-Dmdep.useRepositoryLayout=true",
-		},
-		nil,
+		defaultMavenOpts(),
+		m.parsedCmdOpts(),
 		workDir,
 	)
 
@@ -55,9 +56,30 @@ func (m Maven) ResolveDeps(workDir string) (*build.ArtifactDependencies, error)
 	args = append(args, cmd.Name)
 	args = append(args, cmd.SubCmd)
 	args = append(args, cmd.Flags...)
+	args = append(args, cmd.Args...)
 	return build.ArtifactDependency(deps, cmd.Name, strings.Join(args, " ")), nil
 }
 
+func defaultMavenOpts() []string {
+	return []string{
+		"-DincludeScope=runtime",
+		"-Dmdep.useRepositoryLayout=true",
+	}
+}
+
+func (m Maven) parsedCmdOpts() []string {
+	if m.CmdOptions == "" {
+		return nil
+	}
+
+	parsed := strings.Split(m.CmdOptions, ",")
+	for i, s := range parsed {
+		parsed[i] = strings.TrimSpace(s)
+	}
+
+	return parsed
+}
+
 func MavenCompileAndRuntimeTimeDeps(rootPath string) (map[string]build.Dependency, error) {
 	files, err := findJarFiles(rootPath)
 	if err != nil {
diff --git a/pkg/build/jvm/mvn_test.go b/pkg/build/jvm/mvn_test.go
index 7ea41e5..a0b3259 100644
--- a/pkg/build/jvm/mvn_test.go
+++ b/pkg/build/jvm/mvn_test.go
@@ -30,7 +30,7 @@ func TestBuildMaven(t *testing.T) {
 	tests := []test.IntegrationTest{
 		{
 			Name:      "find build file and parse output",
-			BuildType: BuildMaven(),
+			BuildType: BuildMaven(""),
 			WorkDir:   "testdata/jvm/maven",
 			BuildPath: "/usr/local/bin/mvn",
 			Cmd:       "mvn dependency:copy-dependencies -DincludeScope=runtime -Dmdep.useRepositoryLayout=true",
@@ -43,11 +43,24 @@ func TestBuildMaven(t *testing.T) {
 		},
 		{
 			Name:         "cant find build file",
-			BuildType:    BuildMaven(),
+			BuildType:    BuildMaven(""),
 			WorkDir:      "testdata/whatever",
 			Error:        true,
 			ErrorMessage: "could not find match, reading dir open testdata/whatever: no such file or directory",
 		},
+		{
+			Name:      "Add additional command line arguments as a part of the mvn command",
+			BuildType: BuildMaven("-q, -am, -X,-B, -D yolo=molo"),
+			Cmd:       "mvn dependency:copy-dependencies -DincludeScope=runtime -Dmdep.useRepositoryLayout=true -q -am -X -B -D yolo=molo",
+			WorkDir:   "testdata/jvm/maven",
+			BuildPath: "/usr/local/bin/mvn",
+			Want: test.Want{
+				Key:     "com.google.code.gson:gson",
+				Version: "2.8.6",
+				Algo:    "sha256",
+				Digest:  "c8fb4839054d280b3033f800d1f5a97de2f028eb8ba2eb458ad287e536f3f25f",
+			},
+		},
 	}
 
 	test.Run(t, tests)
diff --git a/pkg/build/jvm/testdata/jvm/gradle/.gradle/7.5.1/checksums/checksums.lock b/pkg/build/jvm/testdata/jvm/gradle/.gradle/7.5.1/checksums/checksums.lock
deleted file mode 100644
index 402456c43dc9e0c898621c60cf27bb6a955659e6..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 17
VcmZP$m}jz>Z|Z~p3}C<<3;;631fc)`

diff --git a/pkg/build/jvm/testdata/jvm/gradle/.gradle/7.5.1/checksums/md5-checksums.bin b/pkg/build/jvm/testdata/jvm/gradle/.gradle/7.5.1/checksums/md5-checksums.bin
deleted file mode 100644
index 38d8befdcc845777f473c8dadbe34baae307d3ef..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 23147
zcmeI3i9c1_0>=+I=MXY9AdMoTaEZF+A(>~#tjndF$W2M~h*FYUnp7flSCJ?x3K_~&
zN*$pAS1KuzTN(&?YoE22`*~-3|G;~DeLn4czSj4wwSH%<wRfM^UPq%zicX?J`=`wP
z=SS)%Dgi11Dgi11Dgi11Dgi11Dgi11Dgi11Dgi11Dgi11Dgi11Dgi11Dgi2i|CIz-
zU?4N$U?f-a5<iH9(P*kd;0Lcgg=3pvY~9HNe{Ge3|Nr2?#qT`o83jZgP^?y9eo*FN
z#EY!s+K`)TV;-NW>1CBImk7CA8|H^H$A<+Jwlg7j*o^t%xIH#o%Qm3TajL=mSh9M~
zzS7<<Sl=QU^Telp)~0P0?-6gp{N(C{&YBMO5%l?MFh5<p|77dO>>S9=axg!mR8#$X
z!2N@e+l5YXUF$n4Z})3LZX1Dl=ATZ%PXcc(hupGmiWit(>$hcr9Esv~4)cP7%}>7H
zzB&rIlNaV!l9wzvptW&7<hJHhymZz!mYV!=$Q>}AEV5g1+Q9E*7Ub5;@Gq{3%QVey
z$Q(yJZi<_BACJ{LcOUVan3uGxoiZ%Sd;_`r&zRp>7`4am^Fs7}S<Jxvrl)_+OF^j&
zSl{j$=H&{n`=mo-mO<`18}o{zE<gDc_b!Fp(HHZo&HP`wE`(P>?re|wo%V54tKK8w
zkXvlRy#C!H>n(gEMv%KRF>koYj=7jCmJ7MfLd+YJb3RHJDi=X+o`LzjR>jVWoZK6b
zyM|%TPR+56D_t!Mxzkb1Tf=_YpAaf-3Ayui%-g~`#zHF3IYMs#c#8j(aAo}&$2!Eb
zFmEs15T2*5bOv%O56qt*IhVA}nZFlu)*$8`u`{pcdj)kv?$U#KS2HVXASwpUPZuf7
zUkJU8G$@rFMD=%1aYeyaeMOHl$Q^&ey#H}qt*ej!&yc$bV?MOd$U?F39K<viOUyrg
zHjX`>k;K^@Xf(%Dn143%ysz(Dpacb$9Ofh6yH35SEl-2oUJ&!|PgxIn(nZj`wM@i(
zOxom8$%X9MsJ<@d6H?3teqHmlAh#`;;sNYlXJ<1F$SqYcr}+yHI?*T4zTxlya~|o?
zh3_{Oq1<ftVm?E<M4EX*Zvp%qJ2A|Kn33HcD|$O2cg@3GGCQvRWb=>$<ZjzAmy%A?
zt;jdK4Y|`W<_o>I?2>)gT8}>881uyv&u4u~X#5xC_FFMuDl9b5pgA=ja_2tGWn>~*
zc@0gEAh(#nTz;2Y$0`Ha0aSk<=E_#dBekn#Af`E-#awmYuj5t=cIm@kxSC+Drc|T#
zvDwNLavNLBwMI{GYMlEVts@H!%(WwLx0e?`)`j)W3^CV<3U4ve@kIT!s={3N&V!am
zcHReIecNu#^)#ZQ3--99`EPdtbA5}F{29u}(SGQ18FQ1~>ea!r-=yK^ShFxU-F5wI
z%AFpx|FB#zH=B3)_O;2&FJXNrCCu%lcf73e-gW|g&H(225;-$l#@RlQ+w@Lxy*(`_
zo)xnpchkq*Av4=x$q%i^kXwGk+)?HAneBH{V<2}N#oYDsl`{$5iEfbFN=)&WD-`-7
zW!6K^D#zSCU-Dzls+Lg59q5>Q(?dR(_^JL0x!IE`?l^04y=fq-@7RF358bdk)sM#?
z)epgZQ+0Zemfse%;92pQ`>QYi`{J67Xk1nwF%M+WR?c*&K<zp&#(b-DV)ex0I<#Mz
z3rz7dN!1?e$AVzH=0TY6^t}|cXzWG=;%v;rEBk`2^t99<ckRGDLUpZ8Ptz?k$Sr*^
z-+k}!YHc$wv_IQi#T@@lqw(K`4t1pxpc0@Gpc0@Gpc0@Gpc0@Gpc0@Gpc0@Gpc0@G
zpc0@Gpc0@Gpc0@Gpc0@Gpc0@Gpc0@Gpc0@Gpc0@Gpc0@Gpc0@Gpc0@G`2S2m9SnN~
z_(L4#UMgB{omQMSXV+w%j!e1Z&mpU5G@gA;k6s19Y<P(izRLe;Z2ainGM=zZTxQ?V
zAKhPjK~2JVjn0trCX$WDZAYYK7G7lf#iwb1OE3E!8gD+qHq6J!2D@q31^>dDl%S-M
zTFJ%U+o16do%<EqOEx;xIv+c!wpG%#UPNXLv#&v;zZ|w95=}Pdd`Sp4RJo@#+T3<L
zUcv{Be6ScAJlSMJFU><Pb58Ls0ezu$(Wh>MQ;fvOKWu;ooj4`Rl~r?g=~H``>p27O
zctn4lq`ig4Koc|=YstpdV3|z4<eP<OcU9}AjIQ~Bj0|MVCmZYE2<>~C>S^(*eW}3u
z9iLHFA99fqNj9GFMD>d{XJ+uYrbfuOkAr@5#(_@h@)M_8xyB)OB7I_S5c93Gp1X2D
z`ldsuSLmFvurb+?X9(^HlC=2xb7yNvbN~MHs10<|o8e40ioYfHXNh?j_UD%S^7Ao9
zpfQNv5s|Yc8`}NP1~&-~Mw@SZFT~E;BMXi9#B>FP?gcJf<9Ox%BdL1ud)88S>p@m-
z+9G6p<p?x&6S8rSbwX*=+6N8pC2D>xm*&le#=s9~FeJ#vtJcQJclq76>Ce+Q4{2-w
zXS9iQ2ew0l?>O0L{-Jw$(>uoRN^%0*b9$P=scX*nAq))xFfQ(Kum=;A-W%S!^+7_1
zZgM3X%p<~h{{$L}#COj%ay`St-#&Rq47<Ilo0E5<i7;Z^r0lLjL;NY(h+KJ8HT;%j
zwAbE}&Vus?|3Gb=goYS##+j>)zlM&~ins{nt*VRDEYL}kL<X3VL=hlP6>}M3ic6zj
zwl%h98R$Jw&W%K?_CpItpfQcehInSky}hd=I@sRnA*FLz^019zbP}6MoKWU!;|70-
zmf2>(s)|Q1560TGz2F#Z23T1{;Rm0<ZOpjHH|Y9qOG<;5RFjrL1~`RHq&xDEBhZ+{
zsdBD14)NYxu92KPrdyWnQ{7nY4vn#)|8BgN`;ub+WbNZ{N!l89t1nfsS3JaLgThao
zjOS`&d$82|#8S1hVTxe}Z?-M_4H`3ca|9Z5E7=IVBByY7*|6^yNzat#!Evx!iE&J-
zA;Xt!9Ep`(!0RM&sPa`U|FRTAP?Ipe@<2lj%o^@q@v3+3?hE^SL7e7&hjzQ+zhSR<
z(TiweMP$RPJ%FhlXlx@mfBingE{z=6#yD}`07Z-sT)0L)utl_ML)Oc;DmwnFI|CFx
zL1UB{F(_iZ;KF6>9v)6>Gcj&EAm;liU&jROAz&PAS~5qVi3yU8*wBht9{<JZH{-uf
zUV48R?hI^(4l>q}ji#ePTZ~%|H~4kyyM5M{=Z9_Z|AY+U-3hK<l^s|lIpHCc8+!be
z%jMEjU?mah4()@6z%=)d%=fI)XD?_UUY`q7GK<>$7c@T2fW}-GavL#<Bc)y!Pq#0v
zYt-zDb|JEgxqfvI`UV-`F2~)gz1`0u%kA$5IXyS`A5g4XiN+BK+n{@p4cd9f`9Yq!
zTCW~RJS>&i;E4>hGte!`#?jDvN3E8CC8qD<Uzzxrh7i4SlZxLD+n9NeY;0ZqoMsun
zeAduW)rLz4gNfNr7~aqjtt1=qPk&z)$giZK=3-}|IKu*DM11G`HP8_Fg>0zue)>AR
zv0s7FuWei&{pSLrjq6uq&^YF*kd4#I*XE1cN73y)YHh+hg^B$N7<)g$Hu%9_&z<h=
zlNRoO7}+E~o|`Xu_vAI=eh$XrI|~|8d1Rw$uBeC+U-GW56#;!buZL`)aWn-Q^0j0`
zglT=hF6lzoNG#vLjmcGh(1>@0hQKs?V&#yorP%DC9&ytHdUyNWh&v9EF4{%;-;mpg
zYusqzrOQ`qB%Z+x8}LjA21r)`tq%s6HQXalw9(eMIeBDQVVQh-MxAyPGSFR(Zbmj#
z%9M*E;wKIs(n*Of>UTd24Nh-BWxi>$D)N==jypU5U0p*)LGfv$o2ZRVpgLhhf(zFg
z?8{8r>~yiKP~kV1Q=dELiXh`ON1!o?=S40<X@1qm)Rc=GOAY0=s*eUKAmcVPm>_L#
z<2Uo$)~!4Wl@$u&{`x-(!7~CUE3g)cG84=iZln8EX^~o$s(Ig{<gN!Xm%-X2jG6N|
z0*wx4KerL%?*CN($f|Jj)X?X5wKdz2p$iQL@g^46IL`ladExiN_f|ZLlRIs9fe9*b
z+V}<y{xY&regAle>GIP;vWq5`?A`dK9vXtnp&_J2Hmq2!d4H(~D9QQM#YNw#iGYR>
z+S^U1S+#zm%CVNNaSlF<=bAVzIt89!h+YXg!8YWGCo`^b6yIj4B=_%{bLn7ZP?yJU
z@UAdt93{|jnr7ABZ+V?Dq7`hh)^(ps-iDdrIfP?`LqlkqCxDVabYf22OW$H*rdC9M
zA<%%vf!;x443T>!f35Gy^6c>jhr|zSbp_&xH3-Hb^cJ=uHqA_&cWLK=f63DQc~z8x
zvU`?-*-h*v@x+rDDD-JoEmOHB(X*^E^be)rmZ;3I^RNwJFo%i45C<2otZH0-vbMV*
z;F8gCj@F|^ybn$EO4yYn(D<gg<5a~|JzwM0=)a$JX02U!7||=jAo>pq-5XrE+Gstv
zJi(wo-(7=kA<whEY9SoQ;R2#Qjiy07XK@)j&g4t>`@MLb-{E`Lr#=Sk%*4nKO>zX<
ztTD2&F6XoInB}n*Yf_UvBfUn!tl;!23mSaj*_6ADOy9XHB_><FtxTgbdTKhsbSDfE
zw2O*PvuY<V4gI=v;)~82$FoB!ioU1~5iskC!gv8LT;otF%QH~CW$GYXp#Mu+z+Ge1
z2KvseE6B#geTzenlRomyJ9e!1zNb5yiK6HmoNY9XvEDn&U{yyzo%CV>w?*4Gz&1qH
zK}}Hj*MSRHujVucifigQE@4fUl#B+Aham&)?ILMp<Az)m{{U~?j`(=xZWn`kHZs8K
zCCYRoU#5RxtHX@RkWJZ%mSYzR=ON=yXjs{Szqxufv{TMUL09+T_B&^KMl~YA3?#k}
zQS>G|lUR#fMv-DlzFUZdV=p`UwNcalTx5XtPLx^1a~7B3<$tqh>`|cRH>Za|LhQ3r
z(2zzeiXlceHlLb((zs4L&*t7;N!?1~y+oo{(x?qOn3>#duoF@X69#n>AIy&s-YcBE
z8yVk0O;Gsa!G)_=YN6Y=t#)%xWcKwGj2R@wLSsQTN1!pblMTVj`t}{6A;BMJ^;W$R
zo3tg2wx}X&Xwauw=d*%^MFJ}_&z{`vQr9&6hI1cmi_ug?ZLB1>(bdLki~Oyu%UpPW
V%&75O@b7ZaMvSH*YGVsw{2MurIvfB1

diff --git a/pkg/build/jvm/testdata/jvm/gradle/.gradle/7.5.1/checksums/sha1-checksums.bin b/pkg/build/jvm/testdata/jvm/gradle/.gradle/7.5.1/checksums/sha1-checksums.bin
deleted file mode 100644
index 8471840138a0a90e0d219d0fc59236987f6aa2c4..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 41717
zcmeIbc{o+y`~QE;5lNG&G>T@?9FhhKDPt0m3L!$7=VWRyR;EZvlvGHjBAN$ONGcUl
zD2=a_%6F}^)?TmA@7VkGE7#|b@AbW`>w2H_x}M#SeXo7*wbyjk?Y*4Ek{H^H3+vx9
z^56d)_^*Ko3`Afc0s|2kh`>Mu1|l#Jfq@7NL|`BS0}&XAz(52BA}|nvfd~vlU?2hm
z5g3TTKm`6@iGU%v5g~Ll64SZie~7xVSPH@{7S~z-=zprGUpkqA{@L#%_4|SU*&f>$
zj=Q;#9@9hV0aG_g8O}cFjCA|2M4x^3WcBRS8%Xzcqx3+&pJG#1FQ0*QGZUguRh+}$
zrC5jbt+$BYymj@~3ql1*w`-&HAhoz>pLRD*LAt35(cd}@yCpPo9@70|D1DFfb^)O#
zAswWL=o9_k;P(~0`dUbLd`szj7vAt5tZ#81=^IB9J?jUTQc5<66)d_Alpdn+Q{&T1
zpYcd{<|DdQ*uofl{%=T+av{3E{E&$c5?Yb2zmU>HCscX8I2N@S>8nZo!}y)1&lq_O
zUq5aMWgjLjD&|^yaVxS92_yP6A(0N1GZskSR!{WQd1l&avN1@Hen<3l>v1w46a|o;
z5=ZnVVb+Ct34Tbo2qO9~=jt72I}DJXO5zZa`t!4(yfePedOym3pVYFd{U7huBYU0C
zM6X)D+hpRF1xQaQru6-TlS+&H_TqMOYz5Jq7V*q1Zo7)?t#c?nGF~Y?sG#*3(qm^6
zz4C?jl%-Q{BVAjB(xVica%Ot#Tt~X?CQ6SUVP_XMRxuIjp@)fnRmo_nBM*{UQ36D7
zjN@q%D>{b$AtHj(V{%1r%(JT+jdZJQqCala(WouyMEYS_N{^kh|7m%nQa92KNIQ%*
zTy{l<d!r!Ix0+G*ahfJI_e6)wBYkrUr5~!?6Z`06S~}8K=~DXPL2K%*TsFxf-MW?N
zJCriIrOs+1-Km`DE^aT5E*JfZbo()seq>sC*^cdZLy>;OmguV4Z!(oln~?6(LG-ke
zU*Fcb8YA6mDbcU|3?Jz+|2fj*2UB{yMWJo?zJxZUyN;*ygmsJ3bSic5b+ngJdg7z1
zqlX$3MUZ{S6-qy99wXp(U1U1a{pBb<#ZTkmS%qo3NMB9Ky{S4D)83q(9E^0+OzIy}
zPZ&7W+m%j6x<@jlACu0tys6*pk91q|z8q6NIb;0BSNMImBkeY=r)JlYpnM}_A2F7?
z&ha(ckLK${Y(ctyI;Ef3kjZzn_RUJ9@0>yD=?+UjJgQlS`{4tAMDOg;-n=b(DzaZo
z{GQyV|5VT{>lM=Xk?WjH|2m{NdphpNj;^Dwlj&#Q+f*}J71@W7=bqgVci`THU*<?p
zBK^tP>zkf8CMMzcePaN1ot(pmYi9{}S0VdNyD0q}>zr_iis?F}n>G<W=CXWgP95%N
zc2*I+V8~8GMY$+sA5X@S^GX%L!Ygd>^V;4(*<Uzy$LR3J>vxd7FKKVN+4=fwcUmq&
zx^V_&pSSMmYL_hiT}XE)<62(I(a;I8d=*I7Jx<x@-@Tl8tMQc^(${^Z^a9f@^$Vw~
zh9f<>mC`Sb@%7*GWeo0by`w0-aHCE6tHF{f$li!Nm%>XrWtClWTaoV7MeLh=W0ZzE
zM<U&m#Ixj}@odWrt$19BC;d!GVy1w{%gKt!-enbaosy&VMpH{_@VL2!jPE72^J5F7
zy33LMo+*_5m1J$6qQDh++_du|dODv)+9p>eWbYSD>1DmAzDca{@<zJxPD(H5a=9FP
zMnE0uae_o&oA>bRr1dy%`{F76YQTw<{F4z8$bR)LO0THu`JMjxToKZJQixvnQ$xG;
zfIHG-4pMrhwfc#R1<%uweyEV>-y4p|ms{ZY#F2Pj^Gsc-@MTXNviEpM*<bU^5>d1?
zLo#c#645V+{A?~8`xE`cQ8KPwKa^{-YT6#$|F79Z+20)ZVTS0_RY!4s#EBlC{!#ku
zOg!I+wI=%a4&nF_!vc`K{S`{T<&$B}C0tgGbT{(e-L3XbSx{q&$Cn*sUU7f4`O-u)
zyJlp+_B?f+`}=pxo7_pp^Db@DZtwq`tnl@?GVcGaNdH{5N@&{^3u)Z{go{zvsoF5_
zi|*Q(7wGy1xkTUbSSp-<tqRg3XAwPM%Zb~uLxYf>K-yuoaniT|H!XXlJB_96tDUwb
ze32MZi}dYWlwLFVe#e#MGigY-Y9_jL%ELY8yttif9V2=yYxSUH>zT;@Xb91h(se@$
z=1fAm*+im$sHun_osatsZ&^xz;JeabX#Gi3WWOVw(jTp;pKg^p2ERux`9#0fqp-VS
ztOc?UA^k?Jy|jwYN!?pW4|bsJYuy@qTrMBiN4hZ|(Vy=>xAKVoHKeZ}PU&@`HWvb)
z?7`zyL^;vVn!9HzO*?|@bxA*2_w0>+dbT{CR|JYs_K&mm&wE^A%|Z71JVd`%U%vI&
z{2NGjzeec|P2(CQhV$V5KU#~@pExg*P*-il^9qykl-_t?Mbyz3LayjKiDW+Wbk~o&
zVqK#6x$GnT|1)=qeV6B7--PU4E2!%{ciI27Z1-y1KGVoJ_1x9_=S^e%&B$Kw9<g`5
zTJMv0niuJ-Bq_a#Z|J-g()oCvxzmd1DYF)Mow4M@_Q90?f{QQh`03R+o|~2sT}J)c
z?;jiSd@T4l(Wef6v}CF&?yusP5`EF4rqZFizM$)yKP390tewW?p&>}Oyg})&qH}Le
zmt2YCuzxYpI}5C(#!BiT`$RcPZ~nFX%*6{ac1Yh7N9ipJw|I64)?Y;Wc2dt4n<Kxp
zC%h3ux)m8`TmE_3df;y68>Fvoqps8HytHoViql<4Hx;1t*MmmeF08A@^JlLhqA%~5
zmSk!@7TKE^6W#C2uhq>7_mS>Ck?8lnwl&XPa0cl*rIg-gby{o8(#sY|x7VliH+#y*
zdMMqzfONyLL@#)jH_mxMCeqWcQ2N_3I|VFbuLmN17wMPUPy3GAE_L4t=}r-peaA@&
zp6mPqcwM&XG|?}<iF$B`h35%}O^N<+^a<w+8hCuM{6*>SR43mk+?bB%tJ}%@{%&uh
zQ`Ol5+^<G%CHB{N;@1}F;eO0HgXoXScV*Re?L+lUologqHg+qEj?Ks8po1mRyT%=z
zyZalyj^1HP|1d{&MMwHAJRjQ`PxLZJ|5dzqaQk-~N%R{3)DJc9Un0LQr2qM-czbHZ
zOMN+{M>SFQpX7N3d(U)_LAq}?(SvVXoVwz~LZlxc{p6=>Zin9aPsjbgwg<8QvMe|%
z<uEt0PayB(mpbvDhrudak?x~J*?*m;&n@~^ej3t)8;Cx$_mM)OB7Tonk#Xm1va)Hk
z?Y!a0J}Q&4|7Kxx+F-O9?ynAhC;D^l6cd4~GRWSD^jF=pOx<Txx8imfm_yljTdWy8
ztYOJ0WbdUz^t_=X4A%d)!FnOle>{tOU0Ixr^dq&D{^PM>71vSGV@QuC&*ewk)inny
zSP4jvdr8^%h#$x~eEzK^(hpV;U3x|J#f&t3zsApq?w!7){N!ldevYINJvl>rx@LI;
zx=vac(L1HGFRYZ%Kzhm@O8+Swr}GbAz7Nu!3@QEB_L^2BBh9%;*Cp-t*Wr21*}~Eb
zkiO4~*!PG&+32K#*AZHCDgC#HhFov>0c&I*nMmoqV!d~&&Mmx&^q|j_&a&w7+}q=d
z*Ad2~|76*SyffhYh2LvWGB0IycfauYx(Bc063P6NOIldt;H6Sebo~RQ{c|04@07bn
zJ$FYkFXB3HCEDb^z7yFW+)veqdt2x9WDU~^NVg#EfjcKx(evE-0Hp6|B=&hBTE#o+
zLXp0iv<L3qr-kZ#0eJqYP1+k@>7dsxBCqgzZ3F2~_)UK6NGv~w*GGrCsOt;N`Dv3K
zse$$QW}-g~oE4dCl7{>S)Kj`(aF$kct{wK9%0=lyUP0gH-;G>`>{E{uJyOT|;`=kX
zNDsY7^wjOT(F()y`{jO+(g!D<oxQ+NW+}1{bEI@(xr^7vm47Km`VOLts6CnekGU*<
zURrjPy~s`D_alRgaR26~OZ4ik6H^LW)X;UdlXf`dwdJXKTk^b+?tO!@7hSFPdH-iy
zJZ=V%>x()>RtYO`nId}!a$lkzn<L83nB*gU6L}v+{cWE6U)X*Z=|=J7`tc4$<#O+E
zf9|}K=pS>n-hIA^`zuEcN*}sIP@y{EF5VwF=0)^VHYp!UTPxA^lXHmPFl_PTI}RI>
z?r%o)-xjmE2PqFidYV3^i%kn%bHTv`&#xS&5&dFv<?{t**~or<2c-{NlXh2cxdE=v
znma_-EeM?8`w?G1;v3QZYV-a%aN|9?&fYenM+eJ0J{yMLuY=<$eYowao*^pLxWC;)
zu0MR|!F_zUcvaDLl1TqBVsXT)Yf-~4A$>oI=ZJ3yyqh0rWg&gfChGbl<Mswvd+m)!
zx)JGrMxC#iv^XZT4Cz~ADEm=0$FDrjT#MU@GwDCY&+4|R>fMM&_MYUqOH97uJiN^J
z2-0^qQP+`_PF5*7t$7vcW(SFGFIsG09fa3q`lKI_bpN(FJY=o{vNumA_74rZu5KLb
zhxCo_C|ydX^P8VRiYC%+N{L?b)lqT$BfJmhM4pROWm=G%+RU}cK9Mr-m1><Yz4ITf
zlStn%i~0v?T_u5>C+}AyJ!~PRk5<1nq-dkOHqy5pBf3MFt;*Q;*GOM?h0@2Yu{n3K
zx)iscWD%kpj^8lOLi#DP*Rv$Lg}uk5w~wwP{qQfM=U?D{)TnU`=^G1(e%WE)ldwc_
zr2CToZOpr$s(EiEpCR3zjB7G7uTKp!d8mf;z*g!yG7ANwV{3T>k*=9dbXB(#MZf)T
zA>Cv@(U(r^@VV=V>yu<h^j*#AQA3a6_TX1c^spB!o*Zr*w*#w)e%f8dR>~Ilp9Z8K
zkm(vKoNO11=g;1zl>J!kM43ItJMsL-Pm<EdhpIIkHlBw2`7OlngbCh;nK$m>{e&13
z%6`H-_jvQQEAhU8VL7GC^2#JlYEei+_Z$0==zDfF+C}b@K>7jFKgedsDJwaI;rWd7
zVq#wwA@uUJ5uU#}9H#WipN+L<Xx~4Ju47BycR43zt^?KkaDNy;-gh|<#l{(GlRA*S
zg*bH``7MiwT(0KA<7Ui6N}nntlAPtq>x=B8R49GMhVmu}w-pvh-$Le@GZNfJ>=P|$
zK{^>uduMW;Z&4Bt!Rty#AL=?Ywd1=h=iuR;<$0RYXC<B+Q_<OU8C_>rBGF%XY#BP9
z?>y3V)=|2`cw?Q6_o{YC4}VMaCk<=#_Joc_x>*mU&z@0Yq`vvy2&8+=Ci=s`_<h;x
zc%HU}v<F4u@^*pzggwaKa|vayG+MV#VcyM|NY|<-`s8GdDHV08NZ&x}uT*Fh&}i9=
z$FKd*h<&-pO4YgZ@i?OINa=ITt><2M>cH!){TW2J78|Z0Jqh>ch7m*$N_9%wxtI(2
zO(6B3tI=ch@`+V1()Wr|_H&Iy95v#<>m%Kq#9^+vW`Rt7QX$gyrcw6uRxjx7bnZkl
zE46{r7YKgdxnQCWelEfDDSe@4m-XOJNg)UblBV=U;~nKbrQ5$m`kE<3U)B_m-_eZU
z7tN(a*NeRwSvW)z*{>z_U-bQu_05q_u;1ta%6{<<A!9QOH9TI}lIt(_zFJp&;h_q;
zj;0%BuWVesd+@p<JRjK4M|5BJ2kOcj@%!#g`cLJvs=Hd0ALISlExMGwN}8i?mTx%j
zuly;wS9PwhU$*~-R^-=!w13qTd@TnZxl53~*_HxS8?ugxE!0&<`d%+eU$Xk*X`Y!;
zxE)%W61~-Yyj$J9G-Pl1jp$w0db6$<C?GvNm(rK|CDnN}j2epct#U*!*pr<6IBFQu
zw~>BhS!$xjf$pRDd3lLb_RDT=s8k$TycgN8i6i>G(sAjR*PlT8-W8O-TyUJ^jOe!?
zk#15!^rVy^SFcZad|bbZ(pL<gd~w;MdE1b^r7Y349$6;eQXY)-wIn_(!;2dEWZe9b
z?qN;YYq&HzL}`AuMY;{?H#EBCA0DrrHy`QA9+bW2sGO^Ly*aOtZt6mG$>KBCXP4Gs
z`(>2AYKvJJ*Y%eINIy#2xt4WS?6QdScwV<jkh0f$5|{PazH$Pxw<g!o9<q7;{*&>=
zNDm63?6nnjE3`ixosRUdbfRyS@*n3^h{t#TTSUJ&UD_nl5ceAqhLo-|c7vPKB+J+6
zItirR>R5YtcZ*Qtohuoab<V{Gd=_{dhwP8FQP<HO^5SIYk(KzpF!@gDdZ}q@<9;uC
zi0osNDP4bt&#^l1y||wY<01O2mLtv;NrA}Tr<UkW(<34l&2UG$MHi(TjW%*<&#SdU
zx($hs@r;Bmx8yXqkshu=*&Dat8yVR%b_vo0j#2vhOuK9QE0Sj+-A#+==f)Lpn5u%?
z?XmMjZ}5B^RoaI8!;~qMZc=~T;`!9GH_&x-$aCKyxlCZsh$K9ZN{pfGH=LIEm_Fmd
zE@W>=o{MQoz!>FQy*O@e?<jlomnZJW^NQnn{_adl-}Hs=j`LTSM06c<Yf87^b9ujF
zivq6ys$!z+4;g!1!w&oPv88lNzNJk`Texh{bu^nPeX~hUk&>%o0n+VAf4jM6|4(Uc
zZAGN(a#8kHvZ}mQHWrOYk0ax_m8^U7s<|3?oV6Aq_HXZ3?$|B$1ljK;ao(am(jt0P
zL^sld$a}i=&=YZMr#d_?gf&vv*_yavT>O$_I1avpiT*UB(O9$Q2f9umd9Sxk$f)J%
zYFv)=9i$yv&yg)Ul`{s%XV+HhI@Tw&YL9;_lS1~6r2n+>QVA|9t*}749jU*~#gsw%
z-x~1#m5U#Bo$cDjmrkhL;`QLVFiN-MXH6H<E5XleR}H1x3vI5LIn1{KUEk~)(N`I3
zZ*oa+M0!vu(Mv<?LZ8b|M0(&dN_TLv5;?W)MLp6($vEy1xZbF?gljF*x7ktlI~HjR
zXr9x<^UU3(-`mmTV((#k1h2C;Y7zTp7oE|WK3LZw@1vtpOxdro*P77vSIbfMj{8!b
zN>*v$@iDr9=tmBhnJPs(Ap1i>l)lrp!|BP$o12jyN#e8fd*og77Lln)KT6`@T*%kf
zaZ2YL($|fluH#%*r=9y^u?y0ZNI&4*o;NLJ(LHCR2b1>fGC|3&cSpc`q_5AXuH&LP
z;oH9HBP)^aO8UKBtEYr6Pnr1@>&BG*uFF$h&o7deN4m{tO5bgD#zCg%k{8ks=@7lD
z-bzkop%Bs!-=K82wJO_d$A08PdZ;DQ)5}Ve4V<4M-9U`e-TlSKggE!?N4gt{vxj?V
z^SRFF_`Y_lQ1+g=r&>MLpWu2PB=z?a+x$7t;juBg&JiWb-b-P@nwNJ<HIW`e+NZbP
zx$E8~Bk}s>a1>?lT`<k_U337hPs%2uKWdeH^{j0Hy3RU%qSw`SZ&UNf{l5+ASAC|;
z8fp<D6N~IE3MqRZ*OJk?!>k`5J=}-rRhieS_?A)a(2UZ3)dMzXeB5~#*}Iz%-9WxM
za;vsF(sv6Gy~1XW-D*Bdq#q;wq2J~kW``!#{zSSp>1X_I@IB7n@M{{<H;{Jg_c<!a
z^o4yE(k)4RC_gNgJobSs20jNOFc5)(2n<AEAOZss_`fp(N}yUZ!2e|7|3+*GOWfqp
zc=N$q<274&FREG!pSuNCja-5Gxx4VHgZmgTRQw|<=uUO>c3=$(9pw}yS^sDYzr&Nw
zRlmybNK0r|c!HTD^tGD@Q!(J1!xsYue6`?xF>V@aVfy!CG5&V`i5HcVe>TsX(@^8|
z3;A+Ci+ru>>FbMu0=`~<Vy0rIr>d`xeV+Ndc7#jJJiC|j?x~r`mj_;{3J3J{#XtdH
zZ$ptUI_jl+aEOh@%fg8l_LrvXiKOafX@k`jjG^aHM2Y(K^~FE|U+u-rRF5-v{kr|j
zu9>K2E_pe5-I;Kw3G=ZpyraaG*4GyU1$@1`fPB$WE9Qy_9XxD3)1ua~Rq$#{>n{s4
z{JgyIE)`#3Utb;v?vDw3GyBTV`}ZzSZ&rHF8h$AX)zE7Y^2HD5>KrX<;VI|NcTt|a
z-IA?#vp=hj8FzI(Sg~>Ws(+}(J8t}N1^s6fh`g6D_C-T|4lPo9FLE-)Y@V8A@u~-j
zf{P-$a1ANSyRWYn;pZ>vxtBM|98$@;wrJEOsrD7YfO0De62Pr@>Zw1bU=4?(8q!f}
zvkEG+a&BI_o~?S_*Rv(J^xJ*#X22HZC5os)CVhRaO}-T*WIrqEVO&|x$GC1D!M4p7
zm>P*Fk!5|U!unUPma<1az6mmmxU5i=Ug&gN5#Cn_U)vW%3Bt7xN8~L(@XVYvK1Qi%
zrtOmOhjqtnCm(nE|N7!L>Ps>Bg7+oO?CbXaPlDV>_IwJ;d0Ky-w<pwiyTp0y3-&Ug
z$m)U*jvD5DSnq##Nc`k;gKcBJh#uLQGt~>+4?Bj3*$|7*tS=Q>Gu5-bJ+t_ROUWih
z+aXOlOTL4hP8f~1u&sk4wi0}B_+p^oeU(9mo+_Pe?JDqFN>P9Ax3a<=k0yyr27=ub
z*rJAXB1&lm_~!7%KtW%4Pl1klZQM~j&D3f|`_)fM{`PlfgiR__!O_4gSbp)ozIt;l
zzOR!}7~Lu4mw%ze?U%vK2SYH0*U7x#-R7*}nQ#B}6ub}lvQ_!|@shoJonB^MTZ*a2
z=)MFe^`#i@3-nQ){~(I)zE)n!2)-yJXDw*DSIlzpdSl;1kH9a(T!AK%YjY7b4Ep4V
zArqCK>%EnkVtC51hIluDu5HYZ{I)}Bxw*XHt%)|};}#UQ-O%7i(eRE(zSw8=Icj*>
zb&7DN<;IFT>n(2tFKq7mw&gi^^I_}tS%)dO)5Sq;J8$wxWuaGi`BdK%MJl#jvHQwF
zpUbA;+X%`aIq<<j%^9i@nG(KEW?$v)w^~{^8b>LGY`_%WwGpuFOO1+5ITx93ty%c8
z!s3qL<kK=ydnf<@Q`5CeO7tqi>atUYdwI*QsE$|VkHge@SU*rh*b{KnFzx7p8qu3l
zT2jY5NBM0sZZpzov&NJKWLPW#NASTx-RBM#am{m|X!_ytr2Cy7vF@V#PGV{s8)6B-
zUjaBMiHV^fJ;Y@-hq$yAY;-V`+&{rP0a3o-xxpevGkzIN?wZJDkiRsYi%a(5Tk(K}
z*;7FqhmrTiW2G4Avp9XZ$ypZ0OAm4M8Gksd^z^5LR^mCJCu39icPTO6z7%&==%$zD
zi+9D0@PD%C!m70*S~g&mV^g4wz#_&CJ~-~n=F_FcOImJ7be5l68#+H}aP0S<3{2tC
zK@9rjpi&%ug>NjHSlVu*@Oed@cI9HVKzj~qd0*=70Zlgv?kUS>9}pULt$B|1lfdad
zn3@i(K@qD49~{2I7HJ&u4E9dG6&%1<u3tHS=~8F#RN42H&xTlnH1iFKsbY#15>4af
zUAXc@RJqPe-^#+HgCFeQK^X~KF^8`TLs^3=gN!Mja_eWfemIkwJj{6?^5xIPhFJV?
zLe4=w`*Exw@QB5dbrAter;q9El~}FHhbg=t$7kA?3RIcCf2`@ca?@+duMUhz3pI9^
zEdmsr+qfcMd|H1@ffg08ikZ@Q@hnE(?5>@Xg!u3h-|%<aT&HY-H8hb7+k+^f+kJg8
zQNULRGbQa-<njGNLDQp`<{8BzM*GbR?||J|wl6q40cFr@@WBy7CJOj^$A)OBH=~BQ
z|H}F{Xz%!^qgFLMoAI-|`VID_k0?Q!{*Z|RzCJKh2@`)_T72`}T3P;6udi!f*{yP|
z<U8=?mfn5zCa&QU@Xc{w3>17`ADOBBG55Ya*6|(FHm}LTW5x9*0fl4W9cIVS0#QTZ
z2^J1tOce0-nVIS+&(k@zcAna+cj}wHrbIj6ydggc`113-doBu5f}8sKVxZuCePgE5
z%9=C}jhH*l_rO|JIjx%Kt(8-8J3I(_Q&{9G!3W2EF;V%sfd|<TEtOgLOufc6{kwy`
zq@iqx-}UMX+~MeXrGU{7mXWi-2Zt{P3fxy99?k#vsMdRx4;JsOPg>?U>i2^|`tob`
z9t86Y_>`@{d<qsxusY?eArqCK8wA@QD72Kif4J4;P9E;EbCF_qmRY^*Z1#t~vYsS>
zmIVtx?1MR?(aJypU%%K8EtQ>gY5XPL59Zaw?}s&a>L}K5m3jbQ-inXpBN4@?+1D2X
z1tPx(?>W#>7boYQJ$bTTmQ_``ac4lSUQEs4q42%{g~w%Hnivjl%N!h=AS|2P?D74*
z)zbIZqsOUZ3XdtgG;6(t>bRb!6CXn_L`Q~%4_V*VoH-Np&}?59aWsni-dBW}?Ma1<
z(D74N{nmEnRW6Tcv--`B#*@2?5hVcL0nW%XQ1HH>4^Zf+RrQ-6Ux{q)@G*?(FkGF{
z8kn8~+61g&@Mc5_<$-UGr(F2fAb6!&?bnLR_OpWxtF~}GxD3X8_DHlAQG9S_^k)?C
zwO5dtx}>32+-76jcwy7|Cc%?M$G=}&>x6yzBZ|MZuP+7)`oeDt9reTH@u@v4MQv28
zCy#jAv;Ag=2QOIZ!uQK`KJqmPjJTZl#Y6#L<;+yDLwUf-3ms#)WAr;eU7579sv>+j
ziu~T|h!U3T>#P3vMzxG(YZOWYnwn&|`6Vum_zY($zUnWRi6crDu5vgc&p^Rw)H73t
z70(_Vsa~YuGVjUOQ#TYWGB@00k16@NA)bg5Uewpu)$T&=)aFa8Cmj+wab*7X<6=@5
z!Ayu<L$DtJiw4a|#6W=>hWPz86?CUY7_aE*d`+ILa7y(w&+*}hJ}5p_+hY4sEP4Wp
ze8?;0%YdezXP|&DA^a}WQFC9M5)dETxyJ8W_%JP<*S}anC3xi<dIb66?*iW(&ugLR
z$;eSfpKjU}BpC?=PTh89t^W;F!?1;j5~JyD(%all6ec;Jv|BbZ>4%=twpa4c1uzBI
zuAuPI%x%7CwOI(>SJ!V(PmI#lxm&Sk`M6P-dWI<eVc?sih97q*nak8EO7r+$=U=HY
zblCGeG0@i8Jpf$QfWkg;{bv+-%HfBYsg{tQ;K?U!7AMD6dT+~+8D4%tH2~Exf||iv
z0Gh+svz_<fobPfp__4#{bAWD!=7)Le;OTOC={r(q1%~weF$HQE(Ti$GM;*UoH*Max
z2l6?=yeeL^7b@G2I#Gvx!J2_G_dWRFs38LdeC^9-L;s7EtLK4Jr%ot_t*qkKyLSIV
zmT(83E{frPJ>-iQ%yl?x7%;0vxOmEprGqOM|5Lr&bgQJ=ik*Ohy$##}1Z61ANW?&a
z`#JzdS|;kB?L}A5pP!N(wLM?sUD0yx_QI#LQ4J4NBZ~h8_~wY=Ciz%}xsOjh5;?>p
zl$H>c=D4*d6;TJ_r~ryi3Hacke)y;e-1Rr`oiXx?=E8@Qy{){rfHxlY^9K9b5No*l
zpHum{k&(=l(y%K|NB_|t*}^BD)1JoNn;Z56yu)yWjl!*W5a{<gYxr^S>9q4FF7Ns^
z`Nq24M#dw*npA-G7MuEne2FIarS?9FKiqcG_=MinwGrvXx7*j7ZxTaPG}s-1g)WAT
z4p*bz`*)l>TK(w(Pgu;&y>iOzHBo+U44ye?uLUSa3<J*cr&x!5>RvkRWnNE5$EV5R
zUeA%Q*g&=`mVkR-s@=nG?zQH37O@fXty&)Ky6W+d!MqUOSKK&64FOM`)0fdcY4=kv
zJ$2{ijumo!6=f0k&h;vw{F86y!!Z&Rvkl;bqlOF=@O21}M08YSP^Hs?Lsf64jr$N>
zFPGR|`$kU^`0~lyu8v~Jf3vf%F9r(wf-_eTcslC!JH_!C5=93DUD6y6X7B~wopS@U
zI~a{arfiC(1;;Ut`|{kH=AIyT-CJHt_ifwWuqyLu^FaU3<vZz{%yvX&)%-C9eOWV8
zLoCN{4Qn0#Fd=NWv2sw(O?NFVFov*e2v#1T2!w&Q!db%;i7Q2O--ykA{`!9L>QyHV
zx#hO9*D1i46Psd<ZtF|6bo)3BdhJ^?efhbo?{Ax=E|8T@!M?zr3Ml-)Tl!M#9{FC$
z&e)$hZH0vF1AC|E${UrvFm;$sv7{dLrOYafbrQWge&%)B4b480mHASw6wY7+9d2)j
zZ$67P^9<|>I3mwPf%`haO!02j<X$e7=EVJvs<ido?v6$-N$|$AV~E}_u9~X8zM@h@
zeoM~Edtue~<o5Hn?&5^W&R|`_Zij_zU##W+e@wxr4Bi-6mivPbj{AC_S0}RTZF`c~
zI1#<WYxLw|&g+7CE_}Z(ya3jqtgr_ke?~!H57`hcC8u1zH@V5T_)NfVwV6}CNRJMx
zZ$kIA8qIt8^3(hJVxXX}S8QLj)RFcry^^IP_!`HKJ+F84&EsNmx#KAEhbN;NO2cuC
z<Gv<0rd+m3|K;oFF88X@)%`$W$v(Ib0DK*WD_$_QDTF>bDAD4wl~;$~x3hM98CbOK
zT6f`huc4SyMwBXS#T?Wx#YYcCq`dFls?=S*QpNjl*Ush-m|DW7Sbl+hDV_!6byWg+
z>le0+Y24?ctQ0k8-giKOoxnOYkK&c8{9_8<7g&{oLQ4$}o-cK_BY5w`>~a2;(swfI
zf;ED04dJK&-pbiD^TW5?65rw~`3zd(wH61oEjckv@YPpLnX@U@Y`BKth{m&p1qqMp
z!^*bZ-LU!bv$nLcV^q5_<-(@8w*J$Xit=|^?9**9dHmC1uVg|DefPy*x&tW_iQDto
z6i=4lpHm<jZp@Uuez%=(@~4@;`HPy0tMZ?}UN9H*N$j=(=TD$4fxA8&_tkJSVrN$E
z@F@~s6i?e4H*G4NH3g5bhtt>)*LXONaZq{V_3SrIagNLG8XdYrZ)HXD>g!X0FEA3R
zf%z{igJ2K$XB2$OpzXs#N6EI&j1X1|4{;e@y3+aKZ@wKF2Su<iF#5rw^8$Qu_+p@-
zuTzkrrz{rQ+>83WjYnXiZ)!;wZ`H)IK(HcY$1s--aanx?-yFW)7<$PYJ^G=u>O*=?
z;>Ih%se-q`8i?KI;X4e<4LBnG83k*2kqyyOPs*KIOmvzhw{Gg${AF~hL$SGq3_BWj
z4e;rL!p_s-@WntuUj@vRznFSnMfC?akp~Hv(*^l&S3P^A0i$6eam$QNO-+O|2o7JP
z14miht-hJCEv4?B_Y<d_=FqFHIEJOjS9fz?YP|i-5$Bvf&(TQs7Yxbyt!8k~2=p>=
zpG~ohO%1vX`$Z04W2(k92c}+$JO23Gp174aBhCzqzQvBlcD0vmiZx8IFXd_6JVf5K
z!TFxc+tETbmWHnqCBPa8wq9*nHYLt~tuMvk3&s%diqQFDxGzY7nu0=mUrdn))KxY`
z8+nHNg1+vuDcbvLd>ypK=ML|^%vmk!i|)8e%^I=V7DNN~*g0&9`wQ$pI3mwL0bfVB
znW=rtt{jZNwDiHE>?an>6_c|Qt;&OeFW92c^WqUp>g$V%0=|UVzGx}2F6)nx{BwTA
zNoUJnQ@v&Uqqy}F^yP4S8|tye2aW0Li-`ihrm}s}QgKuBlc#^kJSunfc|&T@R5wFe
zQ9QyPf%{P4Pvo-yDlA6~(;YlYE}szlVX?lYv-j$Amp1iM-~;wHN6`B<cvK=_IjDP8
zpBJh%e0sinaivV^hQY0|V!JB<<&$Tpt-|)jN}JM`GB-86>QLf8e`>T)mqmx0*3K0s
zR5XOx6ptwE3I5C%tRbG6|BWv|*)aR^S!FokTzJB^L0VtL+lIXRZvKrQtdHS}exE<0
zqG-lS1`5{Do|!6obV#B$btA8D-GpnA<05}gXb+x<BkzHz5zr?`G``(wtr>dBY`2cA
z?CT7%&VqSg;V+Kt=LP2Vu*lK$Hbp$^BuXOA%&+hI=Eiasj6c(G1g=v+Z?n`2Q4@5)
zH-|3<3f>oZV_>19sxx|L%Cfpv`Bsl#-6Hhx<^oU4E$kS6s6$VgmF@^o4qpru^cBW-
zMN27(PFVhyhfDIbg2K-w@7~?C9^L?Y87`koqsrphl=vXEzP=bJ=nJi3X{kZ>lX>`t
zb@2Ie-?~!O)bOh3(gZFP!zEy44+^(6TsL#v*S#~TRngOpqfT|D@~hq$ar^M<UNG{&
z7G+(_rug44>`O8Df;CKKQ?$OeI}AP$zP$3lxE;&P<PybQf@bMTqZ%$7&!%{rM)mc@
zKtW%}nJI?*f)tvw(cahei1eu7ufd*Ef)*InzEI`aWjs3r)DTkD=)MF@`quFA{gQk4
zo^eM`$lALyJyX9o^!%cmkTQ|D`-Dx6N*VX(6!7((naV8~+pxg>Q{Km9!G!C}gslw{
zMuYh-dnD3kQ#_V1DjZMw<$b62Ft?D|zF97x2WM5C<u_|F!uQq7rUa(E?n^QF0?~-)
zVfNMY_Vc2PMMHx|U2o|+;&@27S5gG@x$s?HhT0)lF3swOfdak~OxeC@DPcwN`>pvB
zo7}Z)u9!MF8VM?BfH^39UP&HoDq;rg?>V9o`bl7k+PHg{W-C^`Rl8q!QmDwF9Z}~}
zAjSRT(u=+n!=5?t^<TT+zj+cRhEJ4#(-OGnpRF5JpFaO_P5}4<@7F>&e*%Rc?D28d
zkbwfeUY}<}v=nm<DT;1aU*FK8sW!JU^PuthS*p>aJ%g&Vexn*L9*unQZR%S?1`5^?
z&&=s4rkz_r-9WzRc5WXYUM|}@N$tvuBSy+&hko5TY3B;qqF@Y9Ac`0E!5mMSfr2$e
z?=p*y>R&(4u-gNCwJk?AT<+huhRnX&Rv?OQB)XKd<n_nfp?bC>q7$B3RhfIQT?OW#
zFd8v%WM#3$xjVrpM>H5HSVP#OF;Jr~Cq<V}jeVcSdZ0Y5=v|IV&N?uLKwr^2*wjoj
z3-Hb1OIR#~)qGqzTqNOX^pNDvL9@jrWf2v*kxlW4X8th+YiP?%G1L%J|53yKolRw?
z+Agqb$f7&Z+P@PE%v2lPZ3KnxoCEXujkdRlqC54`zmpiuRNDvSi|+hJ|JHiU)SE$U
zU$iSk=6Tc`&<BG;JCEw$ii4SY1KK_)wCj}qjYQ1UTlRdOe*EfRz5_GWj#h{)es6Gh
z96dn)PCGMG?SAYSvgpo8Gn{4tJ-~mROJSzk(HxsacLt_^=TexdcCdPbh3+&<|8@`h
zxBJcPtNk9kg0%Y^%)Z+1vnkr0_WsQ(nW^??Y+tnV-u~@=GgIxK*uH4@%%k2*Ek3@_
zV}dJRll3*3U7cNFx%0rN2ijrBBsRt3cLv`aZ%XIgN~spUg)GhD1lyi})@q5ZG}c7a
zJJd%hI>KF54vHZ+5ab~ABg+p^{m9n?R6jEB0M(BiIzatbHXK976QDXYP~_<{o*1%P
zAO)WjD0EpZ3>j*WVy_**yDSAzj_1XY4F@UkTL&z3*>DWmI*<Z0bT%apJ~@0bWIO??
zQwdRY8BYv3S&-U^D7yTw{^i0j<j_H1^~e`pHeCNQgZh{A$dGFWYWNQIHnh2B4D&-k
zy$8R>z(O}aWXPd|)LcZ-<<K!?WkSjvQFK|E3>k%x+Jh*%j6#Mv0HjXg8vgkl08$SS
zMK_u=WPbpvD+p14k^KRvPiUutHv5Aiy9!XB(VB=Q0Cpic-!F#DAVB>C_S;~g%M4=3
zt^ySG|Jg&AUB!^&1E}wCj}rQVza((<01P=<fa>XDLo7O93|UBk`Wb^Lx-2Ay>?%O@
zDq>$&eQU^&g#=Dxvf{BXaGrznz8JE`0L5jAD7vgMhMX)wapV17x|}SATr)uN_#j_&
zxn>M`Qh?%D#`gvH12~=+L%trQz;AA_(B<nfWLE)d&}>A}WmhreE<wr;QGb!U1S$NB
zDqZdpL(T}K%8@U+OcREcFQnieB`9<&Uxw8vpagN>OSc+jS}*?|bEg^kqFXOBP|z2C
z%5)S%4g#dCk*~kVL4edDT*G4U&C#M5vI!uCejELpYywDqLcabYn*dNkqY(8MD=A2U
zy**gy)<g`a?jhxlD7sVk{X6^3kQd;q-o5uJ^7R+l1h9tRm??&{`hXe?f6)hp?yNpT
zUI3&F5Ji_wz;IR{Q2%x6p5Y`sq;4T!e{m8XQg0ANcM_iIO#AQA_uzaN6uL9*3>5Gs
zBFaoL?3qJqJ)-FL%$d%#{~rAkzsr0UfaZ8B87Sxr&YwV`qnOTqgJ|HkL3j3>fr7q{
zAzyS9!`W{@i6$V5?!-95*>6Z)M-=}H@XZkohO^(0!foR(&VIY++gpD|zUY2IVEEku
z_!^4a1|7w4_8U@oCG{6)zafQZm49*e8&ddpbGjHZoc)H>2^5XLIQtDL@ar@ze{uF3
zQt<Z%Q0UHnGyIYTDCx(DqWk@e;nyWdVPAB=E;0P#1F0X#7u_#D4Er{K8jXG_rroz;
z`g=sRfl8Ig7u{bm>ffFN69s&s-<N53D*Ct9W1@gB9C^AGqTW{dc+ajKG7s{fHAGg}
zPR(e`-2!&8f@*!w>!4`x4FlgCJpdyWsD#%kbX5QLH~P0n)W02={_UmoZy%t4J4^lB
zfnkavXd7S9Q>NQzW4f<@DZ2d)rl$-j+|SePVlh3h|KW>f$BZe4|ASi4xAihT<$o!<
z9W$oL|4Y&Bef4kGv449+Ouj%3yU|mo+u>yL1*q?cqT7$^-#!}?RU0^mANivDOHfRE
zm4F(AD7wGf!?f!ND0prI6uQ4h)W20W69s&&Lcad@*5(X<jU)*8GQz&Jz&A&a-M<w*
z69s&2L%!(t0T{CH!MOZiE8qUDvirAQW~w2$FL!ib{4{HGrWyju15tGQ08BOfm->sp
z4*+BMA1iu>zbXLRMlh-&-9AA7az^@>LDRpC42BxQ`@(A?x~!J|oe5;f@d3XE{#UjR
z!+pUT9%o0MHq(S5hLFNDSh_5v{^jd2L<9OlD-LeD6Os%$K9EXh-xqC;Pyezc7;?@2
z^+lU&#_+uUrD(IO7-|S9{L2Vk9tT6@A(hFF25qKf|FWwXDCjE}wJ5rrtp4SVGUQf3
zUuW39XmcwVG8Z6q5w#7ve24z!-ZEq%!M76mqRl5_@C9oK`*%?2@_ZR$2&qCgM4Nld
zP(w(SuqoOa_V0Xe|1vTde8C!`y=B_7#0<V5Rl&Y5+UyU8lhu$aV^g#zs~IwbAa#jN
z(Pjqq?<_F`1$}*G`=UL8oKSE7D)WVgvYFYMGO1_M{L&qIW6%l7MXqd$_U|k)P{7wb
u1!l@D<Kv8PTO6!Dn}>%jH6EcH({(=&`?5q7pFQ~InCUT4(AU!cN&O$tOFr@d

diff --git a/pkg/build/jvm/testdata/jvm/gradle/.gradle/7.5.1/checksums/sha256-checksums.bin b/pkg/build/jvm/testdata/jvm/gradle/.gradle/7.5.1/checksums/sha256-checksums.bin
deleted file mode 100644
index 64943bd07e9b0e535854ac3b786c29afc8ca9bd6..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 27737
zcmeI4_dk|j{P=HsWR{sEGubO6MM7j{@0q=_8c4E=h$z`BGlf)EiG;UQ$V`z{B0H(<
z`d-(4uFL1~z3={j&*SsB&kxtz<Js}_dcDrM&N+7-Z#4{tjo~lSF#pq-|L04>SA+@>
zDnO_Jp#p>o5Gp{Z0HFee3J@wlr~sh?gbENUK&Swr0)z?>DnO_Jp#p>o5GwG0r2-~U
zBGe!mHW6a@3;K%~j06qz#f`9vP4{u13q;_LbqdgbKM0qsDDIZbdj+^n3CbhBIBPjS
zrmh9tJrd>D?r#uD=a$1xsOc`CJX&H)<Hy8hZou7DP#(kc?$Y?(Bt^hAcRbgHscGkq
zmDvMs`w;DaJx|s~C!hZ|;GXn5yvX&y{_j#0fZM;=;oJV*XDjB60e7uNd0gJs3YDNg
z(%;}Z%5Ox6>G?dfMdC5Li1NgA>7vNmuOq<Yb_wOTKTPXt3_PC)T$>f;$ujYuUJgsI
z0dB;+!%b9Q>?gLSLOcy9Pic)x?qAL?LOd2IPZNIGbk?II25^1l9ezx=Mf_WoEa0c*
zcDPdcx6-3lV~8KcfAb2BeFr@o1OV3>K>r}GT%&6Cv<Wm1;O4rD@<Pi}vYdf$CjoaH
zM0s)1FS`125oCOAcu`(n?moED{A3;UH{nP5!^k`a)w#W@fLq=~d1d;6eb<gSM*)7i
zeuvl6`I$%^Oak1P6XlQZy){j>ZhH&(87h=l-*x3w@E!04+{PK@HSeYFs65J>0^IX9
z%Ii2o!<>F{BJ)RcXC6Mac6<4G7ke(~Z`g<SuNR!0<~Se03%KbclsB~J8+}eaeGG6%
zBb2{zr~EZi68Hjev&|iztwZuGLR}YdyY(GjL}s6FcTO5``^zYAdB3Hh^EDw5aIKyA
z+h+FbdXcW30Nm36?cbhWw9HW<_6YD(aXWl{jwYRHcR1j#0VsddFZAho(Y-pr%?_iy
zqdPQLzQ+og&u6qz-nAtl@vGqIFVNrOHOk+GI~Bf3W{3pbIv3^LzAhO*+2{rUx06PB
zPgc?C=vo;*<mW!!;oo~&()U##0o<b#<-MUNjTr`utpInGM0x*3yQui{9NK`JzeM@K
z#o^6>#sVY2jlb;h(fG=fX-5A6Ze)h?_rkB1hlRXe18%ivhgaAJmP!k!0j~2E<wFSt
zseY!EUja9nL-}xmdQ#3f^*O-pYEeGYWpZ~eGy-{lEl5y4PV+6~crD)o=x@1ehYRiM
zR~E8*2Ds5M%0JK7y6)v-Hw4_81Lc!$Y1=wH-xv`-f%2*P<o*$!NaTHSQ$YDQ$$8c<
zM+Lut{#GARKHE3YYVP2s0Jw`M$`_ObUOlxgq6OUUJj%cKgyntjS)2ge*%9SGeyUzg
z%1y=YE*OmQU6ikMTU6}jP1FGWZI@C0^MrMWvSYb0;3lOgU#ntZGB*F?2Dp>e4&NBL
zGu2w34Y&ar$~Qikyd%n?zYDnb2+B7()Vpg+^7jC4cpBx~9z9=8O*Ib#uKNJx7&qDl
zW3p{z{WqlD;cIK-mw!dAg8t6jC@11L&pGe>2pL~Jag>vA)NoMTQrZXlpAJGf^`*#F
zxsF6+J#=J5IqkKG-mUD-_n^NA1<L8uy`Q~2xNrk-r!kbX<wv(AcP$A5?y`h(c8=_0
z&mU+u18#l=<$GK6BQG8o(+Awv8|9q#UO{{_{cV7s-rnI0TS`?k?8ts+uZVIk)*-qd
z@$JE&zk$XM*U8);W#)&Bqst+bbJNnW9Pi4yj>K~e<vctgCZ(_5b_1@%h4O<zQp2Lh
z`Q`w(h(@_+#zm$Z^tF?KTbZC-jOfv%G;1^|;0~{LxK8?7s|*jo7=yPcm+Xs3zfpby
znTM7=D3=m`d1Sdu2jRNzC_l2E;@ZwUgsiJt^e9(6OKoOje;lc^!_^%g()_;uaUZfT
zoZ1=3qoIMlCyrX9`8uHekF|96cI(?;1A*$dpj_#2=#}y?OJtqV4@bGOR?Pzvu_R>Q
zH1$EbYF?&B!dedUKAw4pa`oQ{8FzDb$pF9S&c3hyr%xfIr{)LX&eLfBlN<fkTW9I(
z0e4VExh8vknQMhg55kF1ZopbZ-MiJ}0Jxst4p$26z4h@i(%+>V<%W6r#}E8D(g*tM
z9^Bz${G-I>uE_jx%0{`7_+*-YOI8HvZ)~^2(^X>ElRIt$?*1Rj%^y~##gE;#K;rqe
z!z&NeTM8X31l%KThkrgKI32=+oO4V?QEvHwZMjIa_dMutn1pich(W45uHMLc>&1$4
zn_Ff4yewak^~&QE%I%HlxY{&45sy(i${om5#<HA<kp7xG@t+Z|{JHW)ksJJ6$2(|$
z*Fx=qg4L$IfS-xq;Y~RcN1VJ005@GhxhFYBgxc^qlCOy?%Dp4ZO$VM6A?tuuD$0FK
zZ#Qjo{fC?zPwm9-la|_KC7tLE{HHq6{(kF;9k!FSLV()}qujsgz0Q+y#Q?x<W>6lW
z$+LPxgt--P=OUC}a4hrQzgc$)a4iFr2Zph7M*DBZ1MbAW!yBi4b(D@s0dAp=@?dYy
zqDX@>cEGJ|P<}~5UT@-UgC^kGnJ5pb6%Jmw6^{5Vby0r#%?%kvO&e{{U+)RZ(f?vF
zw36V@2v0%<2o)eyfKUNK1qc-&RDe(cLInsFAXI=*0YU``6(CfAPys>(2o)eyfKUNK
z1qc-&RDe(cLInsFAXI=*0YU``6(CfAPys>({&!YD8VU=(2nt_xkvx#zaYTv7IC6z`
zD<-HxUz<FWl&qcUQt4z&m!)I4cN26|hA8rF_u@T}3wa3iU#0)wz(}>cy4RRr*Mdau
z!_$7%^|7XC!PhT8NSm5;aCXErJq3n^$G||8k8jB9?Y_zt)vZ|NZp9LHSoBI}e?+sA
zEQ!G*<xNqBLBm(TFp1o{BZhB<;lvQh(7Uy?XOym5a--X9<Y3r=O7Rr?e7~7>bxXR%
z=WKbv@WlhfKn&j_#W5^r){kV7x?X-zKF3E%B$jo7ID!4COkXrvSd{p$!Rkd|m_=^R
z(O<zgD8GE$)u=8llf~_Tc^)veXKd4lS(^Eij<%lU_xopmHUY!jTMz@eJicMOrzOE4
z-sT6HX!YH5CV?LrtaZ3Q#FklK*a#3D+0Ru442!nFKnCBM!^xsh{pHsR*$eAQnH|@e
zVgj#+SFo=AW%jUKpFTr=_t?yC#DLr{q=fI$;TWQCK4ztvTfFr?qdlwCqWS)lzAp99
zA6JF9viWmdZmQ2ASs*v*$>AGoIEL(u^o)D7GhAwYESs}`k5+1}Sua<b+FdctR@+{<
zY6$&`3Ou9ckh_?)@LgFPL*|7~EvogKJXK6?B+G)+$$|@}))+sUkG}+*PitCvc_LXL
zx0b2+@C{NJ&c|ws(%HRSRzZIc^^{NZ^gN@a;np4v&!zY8vDXEL1?2uK|7m=~q5S!}
z)?vz&P+=L}wIqY_`KY4`bL=*U&5xh@&K7R)0T`x!K;H?qQ=8BOCktuy!+~nbH+qx3
zOIf8m+pf)~1=H1j{jT^@OiT5ES?PYH4u7x$3^^;lLB6I|-7)1*7Jb_;tMe!0EKP>Y
z6GY|S+UBR_ho(kE??DXyz(AUWZ?NQ=8fd%wt?8tjXj<mt-e1q}Z+CREMNgO+e@j<q
zk~0H_dH98f8kr6Bz{z4hdjB+oPu_U&!pMW6N|zwgd2*B0`;-e&ak@cim-5wtVX+r0
zz)+mPH*lX*v2+TM>Z2bbZP>Tv8>`e2HM?qX#lj)x1D_s)0(93Bo)7bWz(57xQN)Qs
zPWGg{#XP%!|DA8i$<*J3Zn~-MAz|eCbGR$yZ>U5GbSocgNCpN*__imGA@Sgh4Apg#
z-st6L4(&B|L_IwdL%}}Jo3vL($<&C{1Q5d@FbKh`9gblvPHf_Jo*?U^r0n&9eN2h<
zx*g}4S6f=r>;qcGC?1Fc!*3!ahJU=>9%k#~;(=rNKN|{E?466%1S&XOMtN@ho=EvT
zk;HHG0*T=_Fi1m{#f_nwE5`M;u!lciy2+K6yW6uD8`hW1G<g0bcBy(CGD$Xu3=tOW
z`cHsiH#A3a4T_7Ijjk=(>ZyiDFy!~X7+d_|z4Si(wm@^;N7q<>7e#CgJ;cbbkug5P
zH#GAc3H-FadRAvqkDc1rdNKJ+iN1hk=Wf}!gU2m)=|C$iJQnLdAO=Qae8YnI7xJ-{
z0<xb!+__(UBC5K6raFBo4C6cGQj#;{^%PlQw%}DBYK)}N17|F9H1xwC96c8+&mPWS
zG#Tzit#cr=<dE$X@7u$_gDPy6Ko*#EtN_Ef3*T^qW34L6JE&G9pIc9Jm8iS+mhXuF
zk%8h*I(58q0_o820YF*wP)Z^O_+B?o43Qp;L3#0fNhec#9mGiLH1nd{X{svU@UFjm
zz<1@ydFUoAQAG8VFl0WEL-PaI&~gORzTah1<ZX)kL*~91fo0V@Nr!4x-fdcZU1#eo
z+W;|;A4OtN!#5OMa}Lq=kAGW2x?~s@*kzPz(NpPr|AXk5XMS(adj=OI3uwKB8<`dK
zz{#SeD}Qc&!6w7P_A671z4W0)onJ=3#U|VSrvDiHwJ`)$5L*Z2%_7srH`tZk<9o(v
zwWuB~A$@uK@z(6gXX1nB`X%&+SLllizMH^?0jKZCI!XNo->@u5cWJC)pL)>8DMRz2
zCfUP2)=agH2W9r?Ww>ZobY);;=>9<heJ9kIp*0IPi+5r)i62(Y)a|tR6N;$<5{+CG
z2ZlU?J~kMwA1=H+orPra5-Y$^+2I@Z2n57xpALER&i>Lh55~=_>`K4sJuFT#MtAu;
zuQysPAXy-Fpj5^;*nQ(5Hc7q7=in{(h@7%EIjv}gLWwi;fc%F5k4P>7N)Q7TGMeNf
z_y$R8kNl5hGA+V4PcCnzb<z#Z*mQ2?D+y|RT`H}hAp&*ip`ry@kimDJaYpld2B)x5
z)77KaLVbr4f=t6HrJr21S05Po>KmH->vAHrx?x9i3K&RB@eRjMS*Zrw_bS|^A8RtM
z%g$2JijWCDs71luJfmMI!F>&>Lk%!6i{l$+>`!zB{&|}>Bs}9}cu1rD(((MH>g}WN
z{R?GosgSf{PlE$aOLu^Q${XLn9+Ta${Mh)h{a)KC^*W~D)RSs4JgIIvL9u^q90%i}
z{SrH)pxF&KhDPXtQwO&GN5cZl$Mj4nvL;qNAN?WgtUI%mZhY^?^VYxeb*`C+0Y1Ax
zjS{X0j$!k-fL$8DCb#&Sn5>vZfG~ITybo;{o8Z-#dduq(5y6lFT4^2WumTMGKPsuB
zH#2Q#c&t~XVmFhs+lFAe+;BwS+07;TH@w#I%KcFE@K{i@00SAE4NeU9hIh37+x0Bm
zCF8^#bHa1mx^??{mBDAvp3WBM<d{*r0RvSEFp$^d8;r~KV@jq5dP`+BL&{lS@Yq*f
z@4rs*XJ6U`nU6_Ga2{fC1qRZ8ob4xLX_-#28XR@^X;dKHCVyP{y+YYol6+q1oL|@3
z6>hM1_fR7zb8`6iS#YvwzdAx3PT^&)8sYtg^~>ANmJe668<&hK_HA@>WZAEuMPfkL
zhbnx-ntN=OS7}ODOxE758-+h?>&iSyblcPV&E-zWVpuw${Q;g2OK|>BI|!}3xG`+1
zer0Nqh^}S&9O&)&(23QZu`iS4(BkZ><x`bSvXg=!hFt<!0fy!XzTuFLMWRs50)wE}
zT{*VouYS!b-E(>mN1k;jNJQSsyr~BawC2D-`j3<OHiwPQT?3Az&$E&qo?nvPEm*a_
z$v||guiaULO>LxY1{kOVkr)o*$Ix}c-ztyegKX!0m&>WTzoTCG++?1PyyYlGJ#=NG
zf=dR8fgTvhcjFs~_Vp&z=Z=PZl2{B>Fci4zHT@MaVrWtkIk5C?_E;V~7SNt`9X>Ze
zjqD%qW{TyU@WNl&H1>v3j@7&;b(s+wBkt{S*W_$2uqf8Gq=Fb2kQny-<22YpOZ{`J
zuZF2O;revJUX9to{0CZj&3kT^$kcn9X;pqh4DcrtsL^Lb51bjb+q8>?<@eGf3vE_0
zmn(D|w!16IzTKn~yf1cNapmE;I$)rIOmJiT$E?n0OLXuek25i+DR_s8J7#kwWzXxd
zTH~s6ORH7AxCg(G7z%+w2mWmuoEW;*&j0u<DLkKBofj_8wL<0nO`IzC=YePYS%qkK
z|9Nr?7<L&013!GG!!hikQ}eDmPHW0r=rwfe#I!`uN59r=k&-}#7&px?d__t~7RV_`
z;~%Tskl)0Yk!JaLS5p;NF>w->;jC<K@nj!jZ!J2HJ+dV$z(5P<4>dA-=z$Z1)l1XG
zfbFBAWwEyZX%2+fNJ}5qX#Ugq@tw2A-(^G3e8d2MT80{FEcC!JBo;7|N*gsr4=evz
z(Iid@FwdWi;j@Xkq|nUavZ^%d3=GuBeqsEN{Q|RZ)as~bDTD6`>p!_-?zUQUam|VO
z{hcXBj0Yd^orYEvcuvOs#fE^P+r*E7^Jd6mw8r?^fdBGpIL4m~RowZd?C*CwxI#d}
zy-<wA62w5C0SpXI_y)f~%?sJRVsck9&!6LMeU|Mxv_ED}klvlblWuX)i>DeG7?9tZ
zrh`v~ICZdma;p31tLKypbjv?K%6mOZrWV)rVdmDK@UEY4sypfnvba$WVmQ2rZ&<E$
z)U8iuJs^Kl;y}G<zjeObskN>{@A=Crmrb)7hoSEv3d?S<hSvqC*+5z0#=xHJJNh>E
zTGOBHO9NsxlbL1wT*A$J&cuy>{;i<g@J$q{1M*(zKF2pW_mzLK&rUqymQlnbYqg!;
z#IWpbt*l`E!RzwJ++!v1Ith(MiWM9I2BQtnO`JMdg<YvIS}19(aNOr>qc-_utgxx)
zfZY&f>0Eh>nk(%jVu0!aw|&#l1IKWQxuYsZfb(;SFX^(Ps21k6C`bL{@}Q-sHO*hW
zEQ6;YLnz<se&}-s-0t^44;({wOL$}5c5{B0N#c*(%@;quhfb{LZD=|FDK&6Omu$U{
z!~m^TaNFAtJ#Y+VpYPJPe;(MDxn=vNN$FI~<EAwOXPV@?uAiBA8yK0OHJa#hmB$I_
zECV;SFzA6}7^*V9UUgA+Ah%1cj{L%Ma&V^Sn@9BT>7rvJ8zPGD=s*T&G#`&c-w8E!
zFX(||knK<MGE7%pvekEIn=3fPdu2?nHPLlxFuq*9F~>VV4P=pu>{%TD_*)daplXdZ
znz_P=_p5Abk7d*+sD59aJEzH@=6Yk$TCn^gVt~)GP`mPvJxlL(UNd(v?RaNxH)oOD
zdXDfN-bVNH*BYZpO<09K#Wny#3fOsxdfq`AoGd7A6-;+m@4o7mG1k*c891d-%jfs<
z61i0Uz0={xqv)YI2+ycgTWkmz$zXhg%Dn$Oe(pdiKJ$GS?w8D5*3w@|DfV{a$Nbf}
z_~cH(1;_x8#T~4Hyd8c=abn1;8QiU+J2k;AckrcppIynUrO9crW6KE**Amyq64~>R
z7y_^cBIkds)t&n|RP<ToemT#Zw4Hd;`ryN{J0>o9Q*Xk3RxEAS`VA1nQLKSf=>~ob
zBFW<^!%0o*BHVUmiatj?b7BuB)t`NscKoS;v(UM%$B01$7@mH{H{@-4i!{$Io-vo#
zWhOE@_UD0^io9i$OMLU2=E)IDxe#DTfqymzL;eSP({SsMz*#mpAo3<SLa+Rt{hHd=
zQ)<;`O6?QPBGer!wts?H5d*YlLyh7(yiVX$a(9vclzkNM%=8{dOt^EsIOBcM_xr`h
zyGnS-<2P>KkU+A4KP5uj#oktYgR;eZ5sREo=jlEZ7XBCdYlV-JRx$cFLnf~|*%$AQ
z{SFzR(bQ_g8px`P@C{Cx4XLABHD#*1WEJ1O$@|zIouIJim|p0ctFf$SoTTEB7~s7M
zYRbvb11F0o{&{l!ywpWk8vl;2(7)fUoJAvAXG7i9O_TKW+=?>%nHP%TcsN#op@i27
z9K!{V-n>9%f#?*G*g>7e4*C4JT>t#;tBa~}fqP~IyI&y&c3{vQ$2SZ!5m{VV?_V)X
zKiuP(({5H3$<y3d#dO+0Nk4Y*cWx+>1+)W0jfndnr@?2d?`KoH?7fU8INXe%*@;Xq
zS@VsIQE#yI2<+;$!ay?#%EI#_oIliL<)8;n7I*y?bpmvIhay9@SsJr{y6oMk6;dgG
zC^;83HncAL23lFLb(p{kFuSSn4UQWs3|#6Mx(zDF+842IyFN>)B$EvdI!2gSmMV?f
zo`MYU+pUi^kW2pKM9St*Vw@}NO8=_D@5T8Lm-x}XYd_g@m6xZ^YxC#mJNqF9<oxgo
zo|`yX#OK;37!&8&)isl96nVN|Zh99mYi(krl`~c7c#G2gHDZ9)D!8qEfgU&p%%L1L
zid)w`_LF_I*Xuhw<+#$qag59-Aeo!TuI=!%G{o=(D<E=Q#y7NYYATTF3ht7C{)a$4
zze+EE{w_Edmp`W-+Z+8=cIAg1Y_MQ^Ba1bV+`ocvkmXy`(AoRb`}}%bQ|jO~Evcj7
zPr_mgWv>@cv=KEOgie3(XzC!Jv+@t&8_d&mdm`3oBOZ_#NJnhn$>>uKqL?_^r~N~^
zLUc7_)eU5kMvRSt_$T~+;M9T0kgxF3C-12tGO2+6q00*IW)DnB$g||OS~m53%Ce9L
zS-b}GfrK#&-@v9gZ_$~1gz3&DcDftUS<CF&J<H^kB{dUo>w;+ccpYJb_Zt^#Yz!py
zwfKgIn;};V+An?jox40-r#r#r`04iU+qbowZVWzP8>N&b0$HR&qY5?3MtJwb$zt0K
z^GQ7IV&ufq&z{qtDYe%9#QZHrE(V<Xr01_8+RKF0;Rx11ZS;@7(JDV@-K-jBj_H|u
zVRd;fPf_l*`PHfC(|Zn=C|~xbXM#^+(5z1L!Wu}D{xO<H|1mpK3U8haG1JxYpEo3*
z<Vx`l`#?Ktah$dNCvh;cMx|ZC8ZZZ`@U!54DDj%dwZVa>X}qeJrlZDbuiWgqX`3-!
ztKUG>los@z@Vlu3RTOSKy3hls4ljA9p9d&uQP%qVo=h~R$?c6@h`(BRQsWB$f0wmC
z=R;>WY!=tC0!)z)zG3j7Z^F{Z_P5Nvr_Zs>{x*#6;eEI0dA2XK-O#ITrCJj)*kBF2
zSTgYqf2m0y)sT<6w1mj#l00!fm9kf(PC#?~Z{xzXfXVGP9mEiXHIOic;TyV&BfXC(
zB-WN${N8&<Chx_*cm=731NLDBcV&6z&qqV2Ke!IcqgVs6s}#N=xR_sX^jJxacd9Cl
zH;1xZxVjaYlw|#jl+cJodczRp9F^7$3=|gl2KSyDzBJoED4xu`@UbzU9;MV2&5;>w
z&MSY*Sw|_l4xPN<7*x5j2GTJWe8Zd3?+1J@QfM>Y6`nk?mQnNW_Ga^%rmyI2zfuP#
zrU7%r0J0!@@{fH}D`#~fER*ZG`>hwz{iKv3e4)XqE}yOHR4-O147{F$4e*=<`vv);
z0)7nNsZ_i4DgBiBA`;5Z+WrmT&1Ef05?v9$aP72Mh-Ndg`=^s&vmkLOz&9vT`sNfq
z`{I(Fap>td#XXZ<3@;7581DTZo>|wb<81YYVu1cei{k^<fFWnZH<%@w@Ez2`R1n9O
zbsQ8__WbXb<!voeuYLb@dnHW1A1Fl(^T0p`t(&;Bde!m=Yv+fN9EwNd<7|{#QdB}z
zdlhyC{JHNO+Nx*$9op@%F>C+>DLlJz-iv@NLl^&g>GJ`PZ#q7_Cvmnirm`h3<%;S1
z_FOHA-G%TccX*8gr$JUqPJF{0Wwq}lWxtav*)(->3RAzrtT3ax9gE=u5{c34#zRjb
z12i9W_^~mtlK+Qq@VY&`mq9>z0>jBX&uSk{(Gnc+zO;(s414M9mx!@>XcV!d`4?-T
zI5dTCFsME%bp6}YU{P_c(mN#2-=1qcXZ>*Z2}zq6UgC@Zdm&JVePBLd$o=sRg0v%4
z$&;ou8K)M*Ush_2G}rxLb+FLTcOkaY(3V@;1~E*#V`CtphsFlCl9YZunf1Iw*Ag(g
zk%xE%UK@Qq9@cePmpL}l#7>OT2wo@Qn*)cj1`N3=zF|L?*@0Yt`Ic?g!*`!bXPBCr
zP<+ZiwI;{$D?8~oQN?{Y2Jbf>C$I*wGHBhzjUn)Thu`5fU3c-7^WyJ%HaHrojt`Fc
zI*Xm&UolS;_^=)}Sg>^rVGS&~2k;FhW}gq=yDy&VGVsYh+co*7P>fXbU`ki%5~o+=
zF2&G?kl}J2OH(@5z)E=>-|$$(uEyJ8`l%tmWVg0>l9hq^H|o49x@kd?xJ`=6A!r`J
zF}w!rq);ZbZsKNPM7CNuI$iuWC_jro_RZ~4jjB5_#ba$lL=DmY<~haCP6N+}X?ShI
zU|5Oa_XB5EOI<8u5Sj=sXDG64d}a5`-7B6UHBrGyrYdDxKl<tk=&i;Y&SDK>Hum_2
zl+L6%wJj>TnNF*gY&T*H%AA9d3t|`@uk)sj16ffQfnk9HYmoARPeV8{xV$`|xmGyy
z?pC?;BcV2CUlGO%ePyGzT(jQ-yW=J<z;hDHA}a`Mh!Z`AZzwFF@^r9pzNOyCs9;|l
zBk$O%e8lLMkNiu|8`c)LtFnQiG8Z-wZ`6(B8?H{-``ZsURDZK$kBQnvo6*{s#6B`Z
z%~5u5_M+)Y6-&qvIS~2?-Y=m>_Ky>(YVoO!fJ>W)H?)3EjY@z19&5wSpnE=I_V{q8
zuwxK)2i6cFD*+7u`ga@$9>%}7>8%W3@%_CZ!#Z$ZkaKWc%3ASodr$a*;(KGz&xT@%
zkW~Q&GH7&hE6HT~L6jt?fHvxCrBou9Vg2{ekl}CjT+x)}QuoYsRJtI;74hC6_^pPT
zvKI8f84IC>&bFFN>4sk&yjETJ5<-64GoGyX?EE_{Dg3PS(q{+6z=aiH%&_m~{{#IQ
Be<%O|

diff --git a/pkg/build/test/buildtool_test_util.go b/pkg/build/test/buildtool_test_util.go
index 6fa7e27..e341afa 100644
--- a/pkg/build/test/buildtool_test_util.go
+++ b/pkg/build/test/buildtool_test_util.go
@@ -48,7 +48,7 @@ func (in IntegrationTest) integrationTest(t *testing.T) {
 		} else {
 			assert.NoError(t, err)
 			assert.NotNil(t, deps)
-			assert.Equal(t, in.Cmd, deps.Cmd.CmdFlags)
+			assert.Equal(t, in.Cmd, deps.CmdFlags())
 			assert.NotEmpty(t, deps)
 			assert.Equal(t, expected[in.Want.Key], deps.RuntimeDeps[in.Want.Key])
 		}
diff --git a/pkg/commands/scan.go b/pkg/commands/scan.go
index be6b57b..975c295 100644
--- a/pkg/commands/scan.go
+++ b/pkg/commands/scan.go
@@ -21,6 +21,7 @@ import (
 var (
 	buildContext  string
 	runnerContext string
+	mvnOpts       string
 	envContext    string
 	Config        *ProvenanceConfig
 )
@@ -50,7 +51,7 @@ var scanCmd = &cobra.Command{
 
 		deps := &build.ArtifactDependencies{}
 		if Config.WithDependencies {
-			generatedDeps, err := InitBuildTools().DetectDeps(workDir)
+			generatedDeps, err := InitBuildTools(mvnOpts).DetectDeps(workDir)
 			if err != nil {
 				return fmt.Errorf("detecting dependecies: %v", err)
 			}
@@ -98,11 +99,11 @@ func GenerateProvenance(scanCfg *config.ScanConfiguration) error {
 	return nil
 }
 
-func InitBuildTools() build.Tools {
+func InitBuildTools(mavenOpts string) build.Tools {
 	return build.Tools{
 		Tools: []build.Tool{
 			jvm.BuildGradle(),
-			jvm.BuildMaven(),
+			jvm.BuildMaven(mavenOpts),
 			golang.BuildGo(),
 			nodejs.BuildNpm(),
 			nodejs.BuildYarn(),
@@ -118,5 +119,6 @@ func init() {
 	scanCmd.Flags().StringVar(&runnerContext, "runner-context", "", "context of runner")
 	scanCmd.Flags().StringVar(&envContext, "env-context", "", "environmental variables of current context")
 	scanCmd.Flags().BoolVar(&Config.WithDependencies, "with-deps", true, "specify if the cli should generate dependencies for a provenance")
+	scanCmd.Flags().StringVar(&mvnOpts, "mvn-opts", "", "pass additional Comma-delimited list of options to the maven build tool")
 	scanCmd.Flags().StringVar(&Config.BuildStartedOn, "build-started-on", "", "set start time for the build")
 }