anchore / anchore/syft

SBOM generated for JAR doesn't parsing all pom.xml

Open
#2,873 5 comments 1 reaction 0 assignees View on GitHub
bug ecosystem:java needs-investigation
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
23h 27m
Merged PRs (30d)
48

Description

**What happened**:

SBOM generation is not analyzing all pom.xml files inside the jar.

**What you expected to happen**:

Syft should parse all pom.xml files inside jar and list in SBOM.

**Steps to reproduce the issue**:

**Step 1:** Download artifact from maven for input
Downloaded the launcher-common-20.3.11.jar from maven.
https://repo1.maven.org/maven2/org/graalvm/sdk/launcher-common/20.3.11/launcher-common-20.3.11.jar

**Step 2:** Generate SBOM
syft /launcher-common-maven/launcher-common-20.3.11.jar -o syft-json=syft_bom_test.json
✔ Indexed file system /launcher-common-maven
✔ Cataloged contents f6d89c85583b2334db1f57530d05fe44f33a5eb8175cccd3dcdcff9dc16efe9b
├── ✔ Packages [0 packages]
└── ✔ Executables [0 executables]
A newer version of syft is available for download: 1.4.1 (installed version is 1.1.1)

**Anything else we need to know?**:
If we extract the launcher-common-20.3.11.jar, we can find multiple pom.xml file in below path.
./META-INF/maven/jline/jline/pom.xml
./META-INF/maven/org.jline/jline-reader/pom.xml
./META-INF/maven/org.jline/jline/pom.xml
./META-INF/maven/org.jline/jline-terminal-jna/pom.xml
./META-INF/maven/org.jline/graalvm-feature/pom.xml
./META-INF/maven/org.jline/jline-style/pom.xml
./META-INF/maven/org.jline/jline-remote-ssh/pom.xml
./META-INF/maven/org.jline/jline-remote-telnet/pom.xml
./META-INF/maven/org.jline/jline-builtins/pom.xml
./META-INF/maven/org.jline/jline-terminal/pom.xml
./META-INF/maven/org.jline/jline-terminal-jansi/pom.xml

These are not listed in the SBOM.

**Environment**:
- Output of `syft version`:
Application: syft
Version: 1.1.1
BuildDate: 2024-04-04T14:52:45Z
GitCommit: 1e31356c49bf2c30fd80c833482e1fbe4133ff83
GitDescription: v1.1.1
Platform: linux/amd64
GoVersion: go1.21.8
Compiler: gc

- OS (e.g: `cat /etc/os-release` or similar):
NAME="Oracle Linux Server"
VERSION="7.9"

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the report with launcher-common-20.3.11.jar and the syft JSON command, then inspect how the nested META-INF/maven/*/pom.xml entries are cataloged. Compare the output with the eleven pom.xml paths listed in the issue; done means all are represented in the generated SBOM.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, java
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.