oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-11-01 23:16:30 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix:handle compound aliases like ``.tgz`` when cataloging archives (#4421)

Browse Source 
---------
Signed-off-by: Yuntao Hu <victorhu493@gmail.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
This commit is contained in:
VictorHuu
2025-12-02 16:55:32 -05:00
committed by GitHub
co-authored by Christopher Phillips
parent d37ed567a8
commit afe28a2fc0
9 changed files with 138 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
syft/format/github/internal/model/model.go
+2 -3
View File
@@ -6,9 +6,8 @@ import (
"strings"
"time"
"github.com/mholt/archives"
"github.com/anchore/packageurl-go"
"github.com/anchore/syft/internal/file"
"github.com/anchore/syft/internal/log"
"github.com/anchore/syft/syft/pkg"
"github.com/anchore/syft/syft/sbom"
@@ -155,7 +154,7 @@ func trimRelative(s string) string {
// isArchive returns true if the path appears to be an archive
func isArchive(path string) bool {
format, _, err := archives.Identify(context.Background(), path, nil)
format, _, err := file.IdentifyArchive(context.Background(), path, nil)
return err == nil && format != nil
}
syft/pkg/cataloger/java/tar_wrapped_archive_parser_test.go
+7
View File
@@ -32,6 +32,13 @@ func Test_parseTarWrappedJavaArchive(t *testing.T) {
"joda-time",
},
},
{
fixture: "test-fixtures/java-builds/packages/example-java-app-maven-0.1.0.tgz",
expected: []string{
"example-java-app-maven",
"joda-time",
},
},
}
for _, test := range tests {
t.Run(path.Base(test.fixture), func(t *testing.T) {
syft/pkg/cataloger/java/test-fixtures/java-builds/Makefile
+4 -1
View File
@@ -16,7 +16,7 @@ fingerprint: $(FINGERPRINT_FILE)
jars: $(PKGSDIR)/example-java-app-maven-0.1.0.jar $(PKGSDIR)/example-java-app-gradle-0.1.0.jar $(PKGSDIR)/example-jenkins-plugin.hpi $(PKGSDIR)/spring-boot-0.0.1-SNAPSHOT.jar
archives: $(PKGSDIR)/example-java-app-maven-0.1.0.zip $(PKGSDIR)/example-java-app-maven-0.1.0.tar $(PKGSDIR)/example-java-app-maven-0.1.0.tar.gz
archives: $(PKGSDIR)/example-java-app-maven-0.1.0.zip $(PKGSDIR)/example-java-app-maven-0.1.0.tar $(PKGSDIR)/example-java-app-maven-0.1.0.tar.gz $(PKGSDIR)/example-java-app-maven-0.1.0.tgz
native-image: $(PKGSDIR)/example-java-app $(PKGSDIR)/gcc-amd64-darwin-exec-debug
@@ -31,6 +31,9 @@ $(PKGSDIR)/example-java-app-maven-0.1.0.tar: $(PKGSDIR)/example-java-app-maven-0
$(PKGSDIR)/example-java-app-maven-0.1.0.tar.gz: $(PKGSDIR)/example-java-app-maven-0.1.0.jar
tar -czvf $(PKGSDIR)/example-java-app-maven-0.1.0.tar.gz $(PKGSDIR)/example-java-app-maven-0.1.0.jar
$(PKGSDIR)/example-java-app-maven-0.1.0.tgz: $(PKGSDIR)/example-java-app-maven-0.1.0.tar.gz
tar -czf $(PKGSDIR)/example-java-app-maven-0.1.0.tgz $(PKGSDIR)/example-java-app-maven-0.1.0.jar
# Nested jar...
$(PKGSDIR)/spring-boot-0.0.1-SNAPSHOT.jar:
syft/source/filesource/file_source.go
+1 -4
View File
@@ -207,10 +207,7 @@ func fileAnalysisPath(path string, skipExtractArchive bool) (string, func() erro
return analysisPath, cleanupFn, nil
}
// if the given file is an archive (as indicated by the file extension and not MIME type) then unarchive it and
// use the contents as the source. Note: this does NOT recursively unarchive contents, only the given path is
// unarchived.
envelopedUnarchiver, _, err := archives.Identify(context.Background(), path, nil)
envelopedUnarchiver, _, err := intFile.IdentifyArchive(context.Background(), path, nil)
if unarchiver, ok := envelopedUnarchiver.(archives.Extractor); err == nil && ok {
analysisPath, cleanupFn, err = unarchiveToTmp(path, unarchiver)
if err != nil {