chore: add config option to disable latest PURL retrieval, and disable in maven sbom integration test

Signed-off-by: Ben Selwyn-Smith <benselwynsmith@googlemail.com>

Author: benmss

src/macaron/config/defaults.ini

@@ -60,6 +60,7 @@ redirect_urls =
     gitbox.apache.org
     git-wip-us.apache.org
 find_source_should_clone = False
+try_latest_purl = True
 
 [repofinder.java]
 # The list of maven-like repositories to attempt to retrieve artifact POMs from.

src/macaron/repo_finder/repo_finder.py

@@ -103,6 +103,9 @@ def find_repo(purl: PackageURL, check_latest_version: bool = True) -> tuple[str,
     logger.debug("Analyzing %s with Repo Finder: %s", purl, type(repo_finder))
     found_repo, outcome = repo_finder.find_repo(purl)
 
+    if check_latest_version and not defaults.getboolean("repofinder", "try_latest_purl"):
+        check_latest_version = False
+
     if found_repo or not check_latest_version:
         return found_repo, outcome
 

tests/integration/cases/apache_maven_sbom/test.yaml

@@ -1,4 +1,4 @@
-# Copyright (c) 2024 - 2024, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2024 - 2025, Oracle and/or its affiliates. All rights reserved.
 # Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl/.
 
 description: |
@@ -12,6 +12,7 @@ steps:
 - name: Run macaron analyze
   kind: analyze
   options:
+    ini: config.ini
     command_args:
     - -purl
     - pkg:maven/org.apache.maven/maven@4.0.0-alpha-1-SNAPSHOT?type=pom