SBOM generated for JAR doesn't parsing all pom.xml
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 954
- Avg merge
- 23h 27m
- Merged PRs (30d)
- 48
Description
**What happened**:
SBOM generation is not analyzing all pom.xml files inside the jar.
**What you expected to happen**:
Syft should parse all pom.xml files inside jar and list in SBOM.
**Steps to reproduce the issue**:
**Step 1:** Download artifact from maven for input
Downloaded the launcher-common-20.3.11.jar from maven.
https://repo1.maven.org/maven2/org/graalvm/sdk/launcher-common/20.3.11/launcher-common-20.3.11.jar
**Step 2:** Generate SBOM
syft /launcher-common-maven/launcher-common-20.3.11.jar -o syft-json=syft_bom_test.json
✔ Indexed file system /launcher-common-maven
✔ Cataloged contents f6d89c85583b2334db1f57530d05fe44f33a5eb8175cccd3dcdcff9dc16efe9b
├── ✔ Packages [0 packages]
└── ✔ Executables [0 executables]
A newer version of syft is available for download: 1.4.1 (installed version is 1.1.1)
**Anything else we need to know?**:
If we extract the launcher-common-20.3.11.jar, we can find multiple pom.xml file in below path.
./META-INF/maven/jline/jline/pom.xml
./META-INF/maven/org.jline/jline-reader/pom.xml
./META-INF/maven/org.jline/jline/pom.xml
./META-INF/maven/org.jline/jline-terminal-jna/pom.xml
./META-INF/maven/org.jline/graalvm-feature/pom.xml
./META-INF/maven/org.jline/jline-style/pom.xml
./META-INF/maven/org.jline/jline-remote-ssh/pom.xml
./META-INF/maven/org.jline/jline-remote-telnet/pom.xml
./META-INF/maven/org.jline/jline-builtins/pom.xml
./META-INF/maven/org.jline/jline-terminal/pom.xml
./META-INF/maven/org.jline/jline-terminal-jansi/pom.xml
These are not listed in the SBOM.
**Environment**:
- Output of `syft version`:
Application: syft
Version: 1.1.1
BuildDate: 2024-04-04T14:52:45Z
GitCommit: 1e31356c49bf2c30fd80c833482e1fbe4133ff83
GitDescription: v1.1.1
Platform: linux/amd64
GoVersion: go1.21.8
Compiler: gc
- OS (e.g: `cat /etc/os-release` or similar):
NAME="Oracle Linux Server"
VERSION="7.9"
Contributor guide
Research direction
Start by reproducing the report with launcher-common-20.3.11.jar and the syft JSON command, then inspect how the nested META-INF/maven/*/pom.xml entries are cataloged. Compare the output with the eleven pom.xml paths listed in the issue; done means all are represented in the generated SBOM.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, java
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100