From 084bc033f56497f6a13bdcdeeb971bc3d89de7b1 Mon Sep 17 00:00:00 2001 From: Alex Goodman Date: Thu, 13 Aug 2026 15:07:46 -0400 Subject: [PATCH] fix(java): stop at the first format that parses a native image The format loop tried ELF, Mach-O and PE against every reader and kept going after one of them parsed, so a file that parses as more than one format contributes its packages once per format. No input parses as two formats today, so this is not a behavior change in practice: `debug/pe` rejects an ELF on the optional-header magic, and both `debug/elf` and `debug/macho` reject anything without their own magic. It removes the possibility rather than a live bug. Note this does not deduplicate across readers, which is the outer loop: a universal Mach-O carrying the same native image for two architectures still yields its packages twice. Signed-off-by: Alex Goodman --- .../java/graalvm_native_image_cataloger.go | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/syft/pkg/cataloger/java/graalvm_native_image_cataloger.go b/syft/pkg/cataloger/java/graalvm_native_image_cataloger.go index 6db6059a2..1189e12f6 100644 --- a/syft/pkg/cataloger/java/graalvm_native_image_cataloger.go +++ b/syft/pkg/cataloger/java/graalvm_native_image_cataloger.go @@ -584,14 +584,17 @@ func fetchPkgs(reader unionreader.UnionReader, location file.Location) ([]pkg.Pa newPkgs, newRelationships, err := ni.fetchPkgs() if err != nil { log.Tracef("unable to extract SBOM from possible java native-image %s: %v", filename, err) - continue + } else { + // Associate extracted packages with the native image location + for i := range newPkgs { + newPkgs[i].Locations.Add(location) + } + pkgs = append(pkgs, newPkgs...) + relationships = append(relationships, newRelationships...) } - // Associate extracted packages with the native image location - for i := range newPkgs { - newPkgs[i].Locations.Add(location) - } - pkgs = append(pkgs, newPkgs...) - relationships = append(relationships, newRelationships...) + // this reader parsed as this format, so no later format applies to it; without stopping, a + // file that parses as more than one contributes its packages once per format + break } } return pkgs, relationships