refactor(maven): Migrate from DiskLruCache to Kottage

The DiskLruCache has not seen any updates in at least 9 years, and has
several shortcoming that ORT's `DiskCache` class wrapped away. Reduce
the amount of custom code by migrating to a modern multi-platform
solution called Kottage [2] that uses coroutines and does not have these
known limitations. Its SQLite backend allows to inspect the cache easily
with tools like DB4S [3].

[1]: https://github.com/JakeWharton/DiskLruCache
[2]: https://github.com/irgaly/kottage
[3]: https://sqlitebrowser.org/

Signed-off-by: Sebastian Schuberth <sebastian@doubleopen.org>

Author: sschuberth

gradle/libs.versions.toml

@@ -21,7 +21,6 @@ clikt = "5.0.3"
 commonsCompress = "1.28.0"
 cyclonedx = "11.0.1"
 diffUtils = "4.16"
-diskLruCache = "2.0.2"
 exposed = "0.61.0"
 flexmark = "0.64.8"
 freemarker = "2.3.34"
@@ -43,6 +42,7 @@ kotlinPoet = "2.2.0"
 kotlinxCoroutines = "1.10.2"
 kotlinxHtml = "0.12.0"
 kotlinxSerialization = "1.9.0"
+kottage = "1.9.0"
 ks3 = "1.0.0"
 tomlkt = "0.5.0"
 log4jApi = "2.25.2"
@@ -101,7 +101,6 @@ cyclonedx = { module = "org.cyclonedx:cyclonedx-core-java", version.ref = "cyclo
 detekt-api = { module = "io.gitlab.arturbosch.detekt:detekt-api", version.ref = "detektPlugin" }
 detekt-test = { module = "io.gitlab.arturbosch.detekt:detekt-test", version.ref = "detektPlugin" }
 diffUtils = { module = "io.github.java-diff-utils:java-diff-utils", version.ref = "diffUtils" }
-diskLruCache = { module = "com.jakewharton:disklrucache", version.ref = "diskLruCache" }
 exposed-core = { module = "org.jetbrains.exposed:exposed-core", version.ref = "exposed" }
 exposed-dao = { module = "org.jetbrains.exposed:exposed-dao", version.ref = "exposed" }
 exposed-javaTime = { module = "org.jetbrains.exposed:exposed-java-time", version.ref = "exposed" }
@@ -143,6 +142,7 @@ kotlinx-serialization-json = { module = "org.jetbrains.kotlinx:kotlinx-serializa
 kotlinx-serialization-toml = { module = "net.peanuuutz.tomlkt:tomlkt", version.ref = "tomlkt" }
 kotlinx-serialization-xml = { module = "io.github.pdvrieze.xmlutil:serialization", version.ref = "xmlutil" }
 kotlinx-serialization-yaml = { module = "com.charleskorn.kaml:kaml", version.ref = "kaml" }
+kottage = { module = "io.github.irgaly.kottage:kottage", version.ref = "kottage" }
 ks3-jdk = { module = "io.ks3:ks3-jdk", version.ref = "ks3" }
 ks3-standard = { module = "io.ks3:ks3-standard", version.ref = "ks3" }
 ksp = { module = "com.google.devtools.ksp:symbol-processing-api", version.ref = "ksp"}

plugins/package-managers/maven/build.gradle.kts

@@ -39,6 +39,7 @@ dependencies {
     implementation(libs.maven.embedder)
     implementation(libs.kotlinx.serialization.core)
     implementation(libs.kotlinx.serialization.json)
+    implementation(libs.kottage)
 
     ksp(projects.analyzer)
 

plugins/package-managers/maven/src/main/kotlin/utils/MavenSupport.kt

@@ -19,12 +19,21 @@
 
 package org.ossreviewtoolkit.plugins.packagemanagers.maven.utils
 
+import io.github.irgaly.kottage.Kottage
+import io.github.irgaly.kottage.KottageEnvironment
+import io.github.irgaly.kottage.getOrNull
+import io.github.irgaly.kottage.platform.KottageContext
+import io.github.irgaly.kottage.put
+import io.github.irgaly.kottage.strategy.KottageLruStrategy
+
 import java.io.Closeable
 import java.io.File
 import java.net.URI
 
 import kotlin.time.Duration.Companion.hours
 
+import kotlinx.coroutines.MainScope
+
 import org.apache.logging.log4j.kotlin.logger
 import org.apache.maven.artifact.repository.LegacyLocalRepositoryManager
 import org.apache.maven.bridge.MavenRepositorySystem
@@ -79,16 +88,15 @@ import org.ossreviewtoolkit.model.PackageProvider
 import org.ossreviewtoolkit.model.RemoteArtifact
 import org.ossreviewtoolkit.model.fromYaml
 import org.ossreviewtoolkit.model.toYaml
-import org.ossreviewtoolkit.utils.common.DiskCache
 import org.ossreviewtoolkit.utils.common.collectMessages
 import org.ossreviewtoolkit.utils.common.div
-import org.ossreviewtoolkit.utils.common.gibibytes
 import org.ossreviewtoolkit.utils.common.searchUpwardFor
 import org.ossreviewtoolkit.utils.ort.OrtAuthenticator
 import org.ossreviewtoolkit.utils.ort.OrtProxySelector
 import org.ossreviewtoolkit.utils.ort.downloadText
 import org.ossreviewtoolkit.utils.ort.okHttpClient
 import org.ossreviewtoolkit.utils.ort.ortDataDirectory
+import org.ossreviewtoolkit.utils.ort.runBlocking
 import org.ossreviewtoolkit.utils.ort.showStackTrace
 
 /**
@@ -101,12 +109,18 @@ class MavenSupport(private val workspaceReader: WorkspaceReader) : Closeable {
     private val container = createContainer()
     private val repositorySystemSession = createRepositorySystemSession(workspaceReader)
 
-    private val remoteArtifactCache = DiskCache(
-        directory = ortDataDirectory / "cache" / "analyzer" / workspaceReader.repository.contentType,
-        maxCacheSizeInBytes = 1.gibibytes,
-        maxCacheEntryAgeInSeconds = 6.hours.inWholeSeconds
+    val kottage = Kottage(
+        name = "maven-support-store",
+        directoryPath = (ortDataDirectory / "cache" / "analyzer" / workspaceReader.repository.contentType).absolutePath,
+        environment = KottageEnvironment(KottageContext()),
+        scope = MainScope()
     )
 
+    val remoteArtifactCache = kottage.cache("remote-artifact-cache") {
+        strategy = KottageLruStrategy(maxEntryCount = 5000)
+        defaultExpireTime = 6.hours
+    }
+
     // The MavenSettingsBuilder class is deprecated, but internally it uses its successor SettingsBuilder. Calling
     // MavenSettingsBuilder requires less code than calling SettingsBuilder, so use it until it is removed.
     @Suppress("DEPRECATION")
@@ -294,7 +308,8 @@ class MavenSupport(private val workspaceReader: WorkspaceReader) : Closeable {
 
         val cacheKey = "$artifact@$allRepositories"
 
-        remoteArtifactCache.read(cacheKey)?.let {
+        // TODO: Straight use `RemoteArtifact` instead of `String` here once the model classes use KxS.
+        runBlocking { remoteArtifactCache.getOrNull<String>(cacheKey) }?.let {
             logger.debug { "Reading remote artifact for '$artifact' from disk cache." }
             return it.fromYaml()
         }
@@ -413,7 +428,7 @@ class MavenSupport(private val workspaceReader: WorkspaceReader) : Closeable {
 
                 return RemoteArtifact(info.downloadUrl, hash).also { remoteArtifact ->
                     logger.debug { "Writing remote artifact for '$artifact' to disk cache." }
-                    remoteArtifactCache.write(cacheKey, remoteArtifact.toYaml())
+                    runBlocking { remoteArtifactCache.put(cacheKey, remoteArtifact.toYaml()) }
                 }
             } else {
                 logger.debug { artifactDownload.exception.collectMessages() }
@@ -430,7 +445,7 @@ class MavenSupport(private val workspaceReader: WorkspaceReader) : Closeable {
             if (downloadUrls.any { url -> PACKAGING_TYPES.any { url.endsWith(".$it") } }) {
                 logger.debug { "Writing empty remote artifact for '$artifact' to disk cache." }
 
-                remoteArtifactCache.write(cacheKey, remoteArtifact.toYaml())
+                runBlocking { remoteArtifactCache.put(cacheKey, remoteArtifact.toYaml()) }
             } else {
                 logger.warn { "Could not find artifact $artifact in any of $downloadUrls." }
             }
@@ -596,7 +611,7 @@ class MavenSupport(private val workspaceReader: WorkspaceReader) : Closeable {
     }
 
     override fun close() {
-        remoteArtifactCache.close()
+        runBlocking { kottage.close() }
     }
 }
 

utils/common/build.gradle.kts

@@ -26,7 +26,6 @@ dependencies {
     api(libs.commonsCompress)
     api(libs.semver4j)
 
-    implementation(libs.diskLruCache)
     implementation(libs.log4j.api)
     implementation(libs.springCore)