@Override
    public void analyzeDependency(Dependency dependency, Engine engine) throws AnalysisException {
        for (Evidence e : dependency.getEvidence(EvidenceType.VENDOR)) {
            if ("pom".equals(e.getSource())) {
                return;
            }
        }
        try {
            final List<MavenArtifact> mas = fetchMavenArtifacts(dependency);
            final Confidence confidence = mas.size() > 1 ? Confidence.HIGH : Confidence.HIGHEST;
            for (MavenArtifact ma : mas) {
                LOGGER.debug("Central analyzer found artifact ({}) for dependency ({})", ma, dependency.getFileName());
                dependency.addAsEvidence("central", ma, confidence);

                if (ma.getPomUrl() != null) {
                    File pomFile = null;
                    try {
                        final File baseDir = getSettings().getTempDirectory();
                        pomFile = File.createTempFile("pom", ".xml", baseDir);
                        if (!pomFile.delete()) {
                            LOGGER.warn("Unable to fetch pom.xml for {} from Central; "
                                    + "this could result in undetected CPE/CVEs.", dependency.getFileName());
                            LOGGER.debug("Unable to delete temp file");
                        }
                        LOGGER.debug("Downloading {}", ma.getPomUrl());
                        final Downloader downloader = new Downloader(getSettings());
                        final int maxAttempts = this.getSettings().getInt(Settings.KEYS.ANALYZER_CENTRAL_RETRY_COUNT, 3);
                        int retryCount = 0;
                        long sleepingTimeBetweenRetriesInMillis = BASE_RETRY_WAIT;
                        boolean success = false;
                        do {
                            //CSOFF: NestedTryDepth
                            try {
                                downloader.fetchFile(new URL(ma.getPomUrl()), pomFile);
                                success = true;
                            } catch (DownloadFailedException ex) {
                                try {
                                    Thread.sleep(sleepingTimeBetweenRetriesInMillis);
                                    sleepingTimeBetweenRetriesInMillis *= 2;
                                } catch (InterruptedException ex1) {
                                    throw new UnexpectedAnalysisException(ex1);
                                }
                            }
                            //CSON: NestedTryDepth
                        } while (!success && retryCount++ < maxAttempts);
                        if (success) {
                            PomUtils.analyzePOM(dependency, pomFile);
                        } else {
                            LOGGER.warn("Unable to download pom.xml for {} from Central; "
                                    + "this could result in undetected CPE/CVEs.", dependency.getFileName());
                        }

                    } catch (AnalysisException ex) {
                        LOGGER.warn(MessageFormat.format("Unable to analyze pom.xml for {0} from Central; "
                                + "this could result in undetected CPE/CVEs.", dependency.getFileName()), ex);

                    } finally {
                        if (pomFile != null && pomFile.exists() && !FileUtils.deleteQuietly(pomFile)) {
                            LOGGER.debug("Failed to delete temporary pom file {}", pomFile.toString());
                            pomFile.deleteOnExit();
                        }
                    }
                }
            }
        } catch (IllegalArgumentException iae) {
            LOGGER.info("invalid sha1-hash on {}", dependency.getFileName());
        } catch (FileNotFoundException fnfe) {
            LOGGER.debug("Artifact not found in repository: '{}", dependency.getFileName());
        } catch (IOException ioe) {
            final String message = "Could not connect to Central search. Analysis failed.";
            LOGGER.error(message, ioe);
            throw new AnalysisException(message, ioe);
        }
    }
@ Override public void analyzeDependency ( Dependency dependency , Engine engine ) throws AnalysisException { for ( Evidence e : dependency . getEvidence ( EvidenceType . VENDOR ) ) { if ( "pom" . equals ( e . getSource ( ) ) ) { return ; } } try { final List < MavenArtifact > mas = fetchMavenArtifacts ( dependency ) ; final Confidence confidence = mas . size ( ) > 1 ? Confidence . HIGH : Confidence . HIGHEST ; for ( MavenArtifact ma : mas ) { LOGGER . debug ( "Central analyzer found artifact ({}) for dependency ({})" , ma , dependency . getFileName ( ) ) ; dependency . addAsEvidence ( "central" , ma , confidence ) ; if ( ma . getPomUrl ( ) != null ) { File pomFile = null ; try { final File baseDir = getSettings ( ) . getTempDirectory ( ) ; pomFile = File . createTempFile ( "pom" , ".xml" , baseDir ) ; if ( ! pomFile . delete ( ) ) { LOGGER . warn ( "Unable to fetch pom.xml for {} from Central; " + "this could result in undetected CPE/CVEs." , dependency . getFileName ( ) ) ; LOGGER . debug ( "Unable to delete temp file" ) ; } LOGGER . debug ( "Downloading {}" , ma . getPomUrl ( ) ) ; final Downloader downloader = new Downloader ( getSettings ( ) ) ; final int maxAttempts = this . getSettings ( ) . getInt ( Settings . KEYS . ANALYZER_CENTRAL_RETRY_COUNT , 3 ) ; int retryCount = 0 ; long sleepingTimeBetweenRetriesInMillis = BASE_RETRY_WAIT ; boolean success = false ; do { try { downloader . fetchFile ( new URL ( ma . getPomUrl ( ) ) , pomFile ) ; success = true ; } catch ( DownloadFailedException ex ) { try { Thread . sleep ( sleepingTimeBetweenRetriesInMillis ) ; sleepingTimeBetweenRetriesInMillis *= 2 ; } catch ( InterruptedException ex1 ) { throw new UnexpectedAnalysisException ( ex1 ) ; } } } while ( ! success && retryCount ++ < maxAttempts ) ; if ( success ) { PomUtils . analyzePOM ( dependency , pomFile ) ; } else { LOGGER . warn ( "Unable to download pom.xml for {} from Central; " + "this could result in undetected CPE/CVEs." , dependency . getFileName ( ) ) ; } } catch ( AnalysisException ex ) { LOGGER . warn ( MessageFormat . format ( "Unable to analyze pom.xml for {0} from Central; " + "this could result in undetected CPE/CVEs." , dependency . getFileName ( ) ) , ex ) ; } finally { if ( pomFile != null && pomFile . exists ( ) && ! FileUtils . deleteQuietly ( pomFile ) ) { LOGGER . debug ( "Failed to delete temporary pom file {}" , pomFile . toString ( ) ) ; pomFile . deleteOnExit ( ) ; } } } } } catch ( IllegalArgumentException iae ) { LOGGER . info ( "invalid sha1-hash on {}" , dependency . getFileName ( ) ) ; } catch ( FileNotFoundException fnfe ) { LOGGER . debug ( "Artifact not found in repository: '{}" , dependency . getFileName ( ) ) ; } catch ( IOException ioe ) { final String message = "Could not connect to Central search. Analysis failed." ; LOGGER . error ( message , ioe ) ; throw new AnalysisException ( message , ioe ) ; } }
Performs the analysis.

@param dependency the dependency to analyze
@param engine the engine
@throws AnalysisException when there's an exception during analysis