oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-08-19 08:38:25 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(java): stop at the first format that parses a native image

Browse Source 
The format loop tried ELF, Mach-O and PE against every reader and kept going
after one of them parsed, so a file that parses as more than one format
contributes its packages once per format.

No input parses as two formats today, so this is not a behavior change in
practice: `debug/pe` rejects an ELF on the optional-header magic, and both
`debug/elf` and `debug/macho` reject anything without their own magic. It
removes the possibility rather than a live bug.

Note this does not deduplicate across readers, which is the outer loop: a
universal Mach-O carrying the same native image for two architectures still
yields its packages twice.

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
This commit is contained in:
Alex Goodman 2026-08-13 15:07:46 -04:00
parent def9bc2e16
commit 084bc033f5
No known key found for this signature in database
1 changed files with 10 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
syft/pkg/cataloger/java/graalvm_native_image_cataloger.go
View File

@ -584,14 +584,17 @@ func fetchPkgs(reader unionreader.UnionReader, location file.Location) ([]pkg.Pa
newPkgs, newRelationships, err := ni.fetchPkgs()
if err != nil {
log.Tracef("unable to extract SBOM from possible java native-image %s: %v", filename, err)
continue
} else {
// Associate extracted packages with the native image location
for i := range newPkgs {
newPkgs[i].Locations.Add(location)
}
pkgs = append(pkgs, newPkgs...)
relationships = append(relationships, newRelationships...)
}
// Associate extracted packages with the native image location
for i := range newPkgs {
newPkgs[i].Locations.Add(location)
}
pkgs = append(pkgs, newPkgs...)
relationships = append(relationships, newRelationships...)
// this reader parsed as this format, so no later format applies to it; without stopping, a
// file that parses as more than one contributes its packages once per format
break
}
}
return pkgs, relationships