anchore / anchore/syft

Some Java libraries are not being detected, or being mis-identified

Open
#3,320 1 comment 0 reactions 0 assignees View on GitHub
bug ecosystem:java
Dominant language
Go
Stars
9.6k
Forks
962
Avg merge
23h 27m
Merged PRs (30d)
48

Description

**What happened**:
When scanning Docker images coming with many Java libraries (*.jar files), I noticed that some were either missing in the resulting SBOM, or were present but with the wrong name.

**What you expected to happen**:
I would expect all Java libraries to get detected and included in the SBOM with the correct names.

**Steps to reproduce the issue**:
Create a Docker image using this Dockerfile:
```
FROM ubuntu:latest

# These will NOT be detected by Syft 1.14.0:
ADD https://repo1.maven.org/maven2/net/datafaker/datafaker/1.9.0/datafaker-1.9.0.jar /java/
ADD https://repo1.maven.org/maven2/javax/inject/javax.inject/1/javax.inject-1.jar /java/

# This one will be detected but with the WRONG NAME:
ADD https://repo1.maven.org/maven2/com/datastax/oss/java-driver-core-shaded/4.17.0/java-driver-core-shaded-4.17.0.jar /java/

# This one WILL be detected correctly by Syft 1.14.0:
ADD https://repo1.maven.org/maven2/com/google/guava/guava/33.3.1-jre/guava-33.3.1-jre.jar /java/
```

Create an image:
```
docker build -t testjava .
```

Create an SBOM and search for the presence of Java libraries:
```
syft scan testjava | grep java-archive
```

Only 2 out of the 4 libraries are detected:
```
core 4.17.0 java-archive
guava 33.3.1-jre java-archive
```

And note that the name of the `java-driver-core-shaded` library is incorrectly shown as just `core`.

**Anything else we need to know?**:
-

**Environment**:
- Output of `syft version`:
Application: syft
Version: 1.14.0
BuildDate: 2024-10-07T20:40:39Z
GitCommit: ccbee94b876240284c25c8931c6233fc71a5b7fb
GitDescription: v1.14.0
Platform: linux/amd64
GoVersion: go1.22.7
Compiler: gc

- OS (e.g: `cat /etc/os-release` or similar):
NAME="Ubuntu"
VERSION="20.04.6 LTS (Focal Fossa)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 20.04.6 LTS"
VERSION_ID="20.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=focal
UBUNTU_CODENAME=focal

Contributor guide

Open the contributing guide

Research direction

Reproduce the report with the supplied Dockerfile, docker build command, and syft scan testjava | grep java-archive command. Start by examining the java-archive detection path and compare the metadata extracted from the four JARs; done means all four appear in the SBOM with their correct library names and versions.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, go, java
Domain
cli, devtools, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.