[n1ckl0sk0rtge]

The shaded plugin previously discarded licence/notice files and let shared paths overwrite one another. Its CryptoGoSensor and MethodMatcher implementations also contained substantial matches to Sonar's SSAL-covered sensor and older LGPL-covered matcher code. This change preserves analyzer redistribution materials and replaces both implementations while keeping detection behavior.

MethodMatcher now evaluates owner/name alternatives and argument signatures directly, without the upstream-style predicate and wildcard helpers or SetUtils. It preserves wildcard validation, ordered arguments and arity, unrestricted arguments, constructor subset matching, detached-call matching and the values exposed to rule serialization. CryptoGoSensor now uses a package-analysis session with source/result records and separate parsing, syntax-error reporting and check execution. It preserves Go MAIN-file selection, package batching, module resolution, blank-file exclusion, cancellation, fail-fast handling, visitor timings and error isolation. Converter cleanup also runs if setup or progress cleanup fails. The sensor calls the bundled analyzer's APIs; it does not copy the analyzer's orchestration implementation.

Twenty-one new behavior tests passed against the original code before replacement and against the replacements. Two further tests cover public sensor file selection/cleanup and cancellation between packages. A comparison excluding comments/imports finds no remaining matching sequences of 48 or more tokens against SlangSensor, GoSensor or MethodMatchersBuilder; the previously identified long matching sections are gone. This comparison documents the implementation change rather than establishing a legal threshold for copying.

The release JAR includes each resolved Java/Python/Go analyzer module's legal files in separate artifact/version directories, the Java SSAL text, our Apache licence and versioned notices. It embeds matching Maven source JARs, including Java/Python frontends, and the complete Go release source ZIP with the native bridge, shaded modules, generated-source inputs and build scripts. Missing source downloads fail the build. Shade still minimizes classes and retains package names; the notice describes those transformations.

For sonar-go 1.32.0.5128, public commit a7de104 records GitOrigin-RevId: f05477beb84a17dfed5c3ffbe57038b1fa260702, matching the released plugin JAR's Implementation-Build. All 58 published Java source files match the snapshot. That commit also exists in the contributor fork. The build pins the official release source; update both source revision properties alongside the Go version. CI verifies legal files, source archives, Go source/build provenance and the final shaded artifact.

Validation on JDK 21, targeting Java 17:

• mvn -B clean package — 505 tests passed, 12 skipped, no failures.
• mvn -B spotless:check checkstyle:check — passed.
• python3 sonar-cryptography-plugin/src/test/python/verify_analyzer_packaging.py sonar-cryptography-plugin/target/sonar-cryptography-plugin-2.0.0-SNAPSHOT.jar — passed.
• The archive verifier rejects missing Go source archives and wrong source revisions.

The PR remains a draft. The bundled analyzers retain their own licences and SSAL's permitted-purpose restrictions still need review. Java/Python source classifiers include the resolved implementation modules, but have not undergone the same repository-source completeness audit as Go. The Go archive maps to the released plugin build; it does not establish a byte-identical rebuild of native executables whose embedded metadata records a separate revision and vcs.modified=true. Replacing these implementations does not change historical releases or certify the licensing of the entire project.