anchore / anchore/syft

Catalog java artifacts by file name without requiring content

Open
#409 0 comments 1 reaction 0 assignees View on GitHub
ecosystem:java enhancement
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
1d 5h
Merged PRs (30d)
42

Description

Today we collect initial java metadata from the file name and grab additional information to claim the existence of a package (such as a pom.properties or manifest). We should consider allowing only the presence of a jar (or similar) and the filename metadata plus the presence of one or more `*.class` files being present to be the minimum required information needed to create a package.

Contributor guide

Open the contributing guide

Research direction

No files or tests are named. Start by locating the Java artifact cataloging logic and the checks that require pom.properties or a manifest; then determine how jar filenames and *.class presence are represented. Done means a jar or similar artifact can create a package from filename metadata plus one or more *.class files without content metadata.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, java
Domain
tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.