fix(binary): omit download location for sha-1 misses

[bjk7119]

Summary by CodeRabbit

• Bug Fixes
  • When a JAR’s coordinates come from local metadata and are not confirmed by Maven Central, a SHA-1 miss now adds an explanatory comment and omits the Download Location.
  • Timed-out lookups do not suppress Download Locations or produce warnings. Other lookup failures retain their warning behavior and do not trigger suppression.
• Documentation
  • Clarified how timeouts, other lookup failures, and normal SHA-1 misses are reported.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: fosslight/fosslight_binary_scanner/.coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: c03479eb-554c-46ce-8d2e-a21dc6d04671

📥 Commits

Reviewing files that changed from the base of the PR and between 9d3beae and d12bc75.

📒 Files selected for processing (1)

• src/fosslight_binary/_jar_analysis.py

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

When Maven Central reports a SHA-1 miss for locally trusted coordinates, JAR analysis omits the Download Location and sets the OSS comment to SHA-1 not in Maven Central. Failed and timed-out lookups do not trigger this behavior.

Changes

JAR SHA-1 Miss Handling

Layer / File(s)	Summary
Handle Central SHA-1 misses src/fosslight_binary/_jar_analysis.py	The lookup documentation distinguishes timeouts from other failures. For a Central SHA-1 miss on coordinates trusted only from local metadata, JAR analysis omits the Download Location and sets the OSS comment to SHA-1 not in Maven Central. Failed and timed-out lookups continue through URL lookup.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: 🔵 Low · up to d12bc

Reports for locally sourced coordinates missing from Central lose their provenance, which can make those entries harder to assess. The impact is limited to those rows, so the PR is otherwise mergeable with this report clarity issue tracked.

Architecture Summary

Architecture risk: 🔵 Low · up to d12bc

The change affects 1 system.

Changed systems: src

Architecture concerns
No architecture-level concerns identified.

Review details

Systems and components

• observed — src (service) was modified; 1 changed file maps to changed impact.

Before / after behavior

• observed — Modified behavior in src/fosslight_binary/_jar_analysis.py: Adds the _SHA1_MISS_COMMENT text used to explain an empty Download Location after an unconfirmed SHA-1 miss.
• observed — Modified behavior in src/fosslight_binary/_jar_analysis.py: Updates _search_central_by_sha1 documentation to distinguish normal misses from failed lookups and timeouts, including their warning behavior; no executable logic changes in this block.
• observed — Modified behavior in src/fosslight_binary/_jar_analysis.py: When Central returns a miss and coordinates are trusted but unconfirmed, the JAR download URL is now left empty instead of being probed. Confirmed coordinates and trusted coordinates from failed or timed-out lookups continue through URL lookup.
• observed — Modified behavior in src/fosslight_binary/_jar_analysis.py: For the unconfirmed-coordinate miss case, sets the OSS comment to SHA-1 not in Maven Central, replacing the prior source comment for that entry.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 3 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: omitting the download location when a SHA-1 lookup misses Maven Central.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}