Add README

experimental/javareach/README.md

@@ -0,0 +1,19 @@
+# Java reachability (WIP)
+
+This is an experimental tool to statically enumerate the reachable classes in a
+Java program.
+
+The intention is to see if this can be used to exclude transitive dependencies
+from vulnerability scanning completely, if they can be proven to be
+unreachable.
+
+## Usage
+
+```
+go run ./cmd/reachable -classpath=<classpath> path/to/root/class
+```
+
+Note that `<classpath>` currently only supports a single directory path
+containing .class files, with a directory structure that mirrors the package
+hierarchy. This is unlike classpaths supported by Java runtimes (which supports
+specifying multiple directories and .jar files)

experimental/javareach/cmd/reachable/main.go

@@ -134,6 +134,7 @@ func enumerateReachability(cf *javareach.ClassFile, classPath string, seen map[s
 			slog.Debug("found", "dependency", class)
 			depcf, err := findClass(classPath, class)
 			if err != nil {
+				// Dependencies can be optional, so this is not a fatal error.
 				slog.Error("failed to find class", "class", class, "from", thisClass, "cp idx", i, "error", err)
 				continue
 			}