Update GitHub format package_url and correlator (#961)

The Official CPE dictionary currently contains entries for springframework with three different vendors: springsource, vmware, and pivotal_software.  This appears to be because ownership has changed over time.

Signed-off-by: Weston Steimel <weston.steimel@anchore.com>

.github/workflows/update-stereoscope-release.yml

@@ -0,0 +1,51 @@
+name: PR for latest Stereoscope release
+on:
+  schedule:
+    - cron: "0 8 * * *" # 3 AM EST
+
+  workflow_dispatch:
+
+env:
+  GO_VERSION: "1.18.x"
+  GO_STABLE_VERSION: true
+
+jobs:
+  upgrade-stereoscope:
+    runs-on: ubuntu-latest
+    if: github.repository == 'anchore/syft' # only run for main repo
+    steps:
+      - uses: actions/checkout@v3
+
+      - uses: actions/setup-go@v2
+        with:
+          go-version: ${{ env.GO_VERSION }}
+          stable: ${{ env.GO_STABLE_VERSION }}
+
+      - run: |
+          LATEST_VERSION=$(git ls-remote https://github.com/anchore/stereoscope main | head -n1 | awk '{print $1;}')
+
+          # update go.mod
+          go get github.com/anchore/stereoscope@$LATEST_VERSION
+          go mod tidy
+
+          # export the version for use with create-pull-request
+          echo "::set-output name=LATEST_VERSION::$LATEST_VERSION"
+        id: latest-version
+
+      - uses: tibdex/github-app-token@v1
+        id: generate-token
+        with:
+          app_id: ${{ secrets.TOKEN_APP_ID }}
+          private_key: ${{ secrets.TOKEN_APP_PRIVATE_KEY }}
+
+      - uses: peter-evans/create-pull-request@v4
+        with:
+          signoff: true
+          delete-branch: true
+          branch: auto/latest
+          labels: dependencies
+          commit-message: "Update Stereoscope to ${{ steps.latest-version.outputs.LATEST_VERSION }}"
+          title: "Update Stereoscope to ${{ steps.latest-version.outputs.LATEST_VERSION }}"
+          body: |
+            Update Stereoscope to ${{ steps.latest-version.outputs.LATEST_VERSION }}
+          token: ${{ steps.generate-token.outputs.token }}

README.md

@@ -156,9 +156,9 @@ syft <image> -o <format>
 Where the `formats` available are:
 - `json`: Use this to get as much information out of Syft as possible!
 - `text`: A row-oriented, human-and-machine-friendly output.
-- `cyclonedx`: A XML report conforming to the [CycloneDX 1.3 specification](https://cyclonedx.org/specification/overview/).
-- `cyclonedx-json`: A JSON report conforming to the [CycloneDX 1.3 specification](https://cyclonedx.org/specification/overview/).
-- `spdx`: A tag-value formatted report conforming to the [SPDX 2.2 specification](https://spdx.github.io/spdx-spec/).
+- `cyclonedx-xml`: A XML report conforming to the [CycloneDX 1.4 specification](https://cyclonedx.org/specification/overview/).
+- `cyclonedx-json`: A JSON report conforming to the [CycloneDX 1.4 specification](https://cyclonedx.org/specification/overview/).
+- `spdx-tag-value`: A tag-value formatted report conforming to the [SPDX 2.2 specification](https://spdx.github.io/spdx-spec/).
 - `spdx-json`: A JSON report conforming to the [SPDX 2.2 JSON Schema](https://github.com/spdx/spdx-spec/blob/v2.2/schemas/spdx-schema.json).
 - `table`: A columnar summary (default).
 

internal/formats/common/cyclonedxhelpers/external_references.go

@@ -4,12 +4,15 @@ import (
 	"fmt"
 	"strings"
 
+	syftFile "github.com/anchore/syft/syft/file"
+
 	"github.com/CycloneDX/cyclonedx-go"
 	"github.com/anchore/syft/syft/pkg"
 )
 
+//nolint:funlen, gocognit
 func encodeExternalReferences(p pkg.Package) *[]cyclonedx.ExternalReference {
-	refs := []cyclonedx.ExternalReference{}
+	var refs []cyclonedx.ExternalReference
 	if hasMetadata(p) {
 		switch metadata := p.Metadata.(type) {
 		case pkg.ApkMetadata:
@@ -46,6 +49,19 @@ func encodeExternalReferences(p pkg.Package) *[]cyclonedx.ExternalReference {
 					Type: cyclonedx.ERTypeWebsite,
 				})
 			}
+		case pkg.JavaMetadata:
+			if len(metadata.ArchiveDigests) > 0 {
+				for _, digest := range metadata.ArchiveDigests {
+					refs = append(refs, cyclonedx.ExternalReference{
+						URL:  "",
+						Type: cyclonedx.ERTypeBuildMeta,
+						Hashes: &[]cyclonedx.Hash{{
+							Algorithm: cyclonedx.HashAlgorithm(digest.Algorithm),
+							Value:     digest.Value,
+						}},
+					})
+				}
+			}
 		case pkg.PythonPackageMetadata:
 			if metadata.DirectURLOrigin != nil && metadata.DirectURLOrigin.URL != "" {
 				ref := cyclonedx.ExternalReference{
@@ -79,6 +95,20 @@ func decodeExternalReferences(c *cyclonedx.Component, metadata interface{}) {
 		meta.Homepage = refURL(c, cyclonedx.ERTypeWebsite)
 	case *pkg.GemMetadata:
 		meta.Homepage = refURL(c, cyclonedx.ERTypeWebsite)
+	case *pkg.JavaMetadata:
+		var digests []syftFile.Digest
+		if ref := findExternalRef(c, cyclonedx.ERTypeBuildMeta); ref != nil {
+			if ref.Hashes != nil {
+				for _, hash := range *ref.Hashes {
+					digests = append(digests, syftFile.Digest{
+						Algorithm: string(hash.Algorithm),
+						Value:     hash.Value,
+					})
+				}
+			}
+		}
+
+		meta.ArchiveDigests = digests
 	case *pkg.PythonPackageMetadata:
 		if meta.DirectURLOrigin == nil {
 			meta.DirectURLOrigin = &pkg.PythonDirectURLOriginInfo{}

internal/formats/common/spdxhelpers/external_refs.go

@@ -22,5 +22,6 @@ func ExternalRefs(p pkg.Package) (externalRefs []ExternalRef) {
 			ReferenceType:     PurlExternalRefType,
 		})
 	}
+
 	return externalRefs
 }

internal/formats/common/spdxhelpers/spdxid.go

@@ -0,0 +1,13 @@
+package spdxhelpers
+
+import (
+	"regexp"
+)
+
+var expr = regexp.MustCompile("[^a-zA-Z0-9.-]")
+
+// SPDX spec says SPDXID must be:
+// "SPDXRef-"[idstring] where [idstring] is a unique string containing letters, numbers, ., and/or -
+func SanitizeElementID(id string) string {
+	return expr.ReplaceAllString(id, "-")
+}

internal/formats/common/spdxhelpers/spdxid_test.go

@@ -0,0 +1,39 @@
+package spdxhelpers
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func Test_SanitizeElementID(t *testing.T) {
+	tests := []struct {
+		input    string
+		expected string
+	}{
+		{
+			input:    "letters",
+			expected: "letters",
+		},
+		{
+			input:    "ssl-client",
+			expected: "ssl-client",
+		},
+		{
+			input:    "ssl_client",
+			expected: "ssl-client",
+		},
+		{
+			input:    "go-module-sigs.k8s.io/structured-merge-diff/v3",
+			expected: "go-module-sigs.k8s.io-structured-merge-diff-v3",
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.input, func(t *testing.T) {
+			actual := SanitizeElementID(test.input)
+
+			assert.Equal(t, test.expected, actual)
+		})
+	}
+}

internal/formats/common/spdxhelpers/to_syft_model.go

@@ -309,6 +309,14 @@ func extractMetadata(p *spdx.Package2_2, info pkgInfo) (pkg.MetadataType, interf
 			Architecture:  arch,
 			Maintainer:    p.PackageOriginatorPerson,
 		}
+	case pkg.JavaPkg:
+		var digests []file.Digest
+		for algorithm, value := range p.PackageChecksums {
+			digests = append(digests, file.Digest{Algorithm: string(algorithm), Value: value.Value})
+		}
+		return pkg.JavaMetadataType, pkg.JavaMetadata{
+			ArchiveDigests: digests,
+		}
 	}
 	return pkg.UnknownMetadataType, nil
 }

internal/formats/github/encoder.go

@@ -130,7 +130,7 @@ func toGithubManifests(s *sbom.SBOM) Manifests {
 
 		name := dependencyName(p)
 		manifest.Resolved[name] = DependencyNode{
-			Purl:         p.PURL,
+			PackageURL:   p.PURL,
 			Metadata:     toDependencyMetadata(p),
 			Relationship: toDependencyRelationshipType(p),
 			Scope:        toDependencyScope(p),

internal/formats/github/encoder_test.go

@@ -104,12 +104,12 @@ func Test_toGithubModel(t *testing.T) {
 				},
 				Resolved: DependencyGraph{
 					"pkg:generic/pkg-1@1.0.1": DependencyNode{
-						Purl:         "pkg:generic/pkg-1@1.0.1",
+						PackageURL:   "pkg:generic/pkg-1@1.0.1",
 						Scope:        DependencyScopeRuntime,
 						Relationship: DependencyRelationshipDirect,
 					},
 					"pkg:generic/pkg-2@2.0.2": DependencyNode{
-						Purl:         "pkg:generic/pkg-2@2.0.2",
+						PackageURL:   "pkg:generic/pkg-2@2.0.2",
 						Scope:        DependencyScopeRuntime,
 						Relationship: DependencyRelationshipDirect,
 					},
@@ -125,7 +125,7 @@ func Test_toGithubModel(t *testing.T) {
 				},
 				Resolved: DependencyGraph{
 					"pkg:generic/pkg-3@3.0.3": DependencyNode{
-						Purl:         "pkg:generic/pkg-3@3.0.3",
+						PackageURL:   "pkg:generic/pkg-3@3.0.3",
 						Scope:        DependencyScopeRuntime,
 						Relationship: DependencyRelationshipDirect,
 					},

internal/formats/github/github_dependency_api.go

@@ -14,9 +14,9 @@ type DependencySnapshot struct {
 }
 
 type Job struct {
-	Name    string `json:"name,omitempty"` // !omitempty
-	ID      string `json:"id,omitempty"`   // !omitempty
-	HTMLURL string `json:"html_url,omitempty"`
+	Correlator string `json:"correlator,omitempty"` // !omitempty
+	ID         string `json:"id,omitempty"`         // !omitempty
+	HTMLURL    string `json:"html_url,omitempty"`
 }
 
 type DetectorMetadata struct {
@@ -62,7 +62,7 @@ const (
 )
 
 type DependencyNode struct {
-	Purl         string                 `json:"purl,omitempty"`
+	PackageURL   string                 `json:"package_url,omitempty"`
 	Metadata     Metadata               `json:"metadata,omitempty"`
 	Relationship DependencyRelationship `json:"relationship,omitempty"`
 	Scope        DependencyScope        `json:"scope,omitempty"`

internal/formats/spdx22json/model/element_id.go

@@ -1,5 +1,7 @@
 package model
 
+import "github.com/anchore/syft/internal/formats/common/spdxhelpers"
+
 // ElementID represents the identifier string portion of an SPDX element
 // identifier. DocElementID should be used for any attributes which can
 // contain identifiers defined in a different SPDX document.
@@ -7,31 +9,5 @@ package model
 type ElementID string
 
 func (e ElementID) String() string {
-	return "SPDXRef-" + string(e)
-}
-
-// DocElementID represents an SPDX element identifier that could be defined
-// in a different SPDX document, and therefore could have a "DocumentRef-"
-// portion, such as Relationship and Annotations.
-// ElementID is used for attributes in which a "DocumentRef-" portion cannot
-// appear, such as a Package or File definition (since it is necessarily
-// being defined in the present document).
-// DocumentRefID will be the empty string for elements defined in the
-// present document.
-// DocElementIDs should NOT contain the mandatory 'DocumentRef-' or
-// 'SPDXRef-' portions.
-type DocElementID struct {
-	DocumentRefID string
-	ElementRefID  ElementID
-}
-
-// RenderDocElementID takes a DocElementID and returns the string equivalent,
-// with the SPDXRef- prefix (and, if applicable, the DocumentRef- prefix)
-// reinserted.
-func (d DocElementID) String() string {
-	prefix := ""
-	if d.DocumentRefID != "" {
-		prefix = "DocumentRef-" + d.DocumentRefID + ":"
-	}
-	return prefix + d.ElementRefID.String()
+	return "SPDXRef-" + spdxhelpers.SanitizeElementID(string(e))
 }

internal/formats/spdx22json/to_format_model.go

@@ -55,14 +55,32 @@ func toPackages(catalog *pkg.Catalog, relationships []artifact.Relationship) []m
 	for _, p := range catalog.Sorted() {
 		license := spdxhelpers.License(p)
 		packageSpdxID := model.ElementID(p.ID()).String()
+		filesAnalyzed := false
 
+		// we generate digest for some Java packages
+		// see page 33 of the spdx specification for 2.2
+		// spdx.github.io/spdx-spec/package-information/#710-package-checksum-field
+		var checksums []model.Checksum
+		if p.MetadataType == pkg.JavaMetadataType {
+			javaMetadata := p.Metadata.(pkg.JavaMetadata)
+			if len(javaMetadata.ArchiveDigests) > 0 {
+				filesAnalyzed = true
+				for _, digest := range javaMetadata.ArchiveDigests {
+					checksums = append(checksums, model.Checksum{
+						Algorithm:     strings.ToUpper(digest.Algorithm),
+						ChecksumValue: digest.Value,
+					})
+				}
+			}
+		}
 		// note: the license concluded and declared should be the same since we are collecting license information
 		// from the project data itself (the installed package files).
 		packages = append(packages, model.Package{
+			Checksums:        checksums,
 			Description:      spdxhelpers.Description(p),
 			DownloadLocation: spdxhelpers.DownloadLocation(p),
 			ExternalRefs:     spdxhelpers.ExternalRefs(p),
-			FilesAnalyzed:    false,
+			FilesAnalyzed:    filesAnalyzed,
 			HasFiles:         fileIDsForPackage(packageSpdxID, relationships),
 			Homepage:         spdxhelpers.Homepage(p),
 			// The Declared License is what the authors of a project believe govern the package

internal/formats/spdx22tagvalue/encoder_test.go

@@ -6,6 +6,9 @@ import (
 	"testing"
 
 	"github.com/anchore/syft/internal/formats/common/testutils"
+	"github.com/anchore/syft/syft/pkg"
+	"github.com/anchore/syft/syft/sbom"
+	"github.com/anchore/syft/syft/source"
 )
 
 var updateSpdxTagValue = flag.Bool("update-spdx-tv", false, "update the *.golden files for spdx-tv encoders")
@@ -31,6 +34,32 @@ func TestSPDXTagValueImageEncoder(t *testing.T) {
 	)
 }
 
+func TestSPDXJSONSPDXIDs(t *testing.T) {
+	var pkgs []pkg.Package
+	for _, name := range []string{"some/slashes", "@at-sign", "under_scores"} {
+		p := pkg.Package{
+			Name: name,
+		}
+		p.SetID()
+		pkgs = append(pkgs, p)
+	}
+	testutils.AssertEncoderAgainstGoldenSnapshot(t,
+		Format(),
+		sbom.SBOM{
+			Artifacts: sbom.Artifacts{
+				PackageCatalog: pkg.NewCatalog(pkgs...),
+			},
+			Relationships: nil,
+			Source: source.Metadata{
+				Scheme: source.DirectoryScheme,
+			},
+			Descriptor: sbom.Descriptor{},
+		},
+		true,
+		spdxTagValueRedactor,
+	)
+}
+
 func spdxTagValueRedactor(s []byte) []byte {
 	// each SBOM reports the time it was generated, which is not useful during snapshot testing
 	s = regexp.MustCompile(`Created: .*`).ReplaceAll(s, []byte("redacted"))

internal/formats/spdx22tagvalue/test-fixtures/snapshot/TestSPDXJSONSPDXIDs.golden

@@ -0,0 +1,40 @@
+SPDXVersion: SPDX-2.2
+DataLicense: CC0-1.0
+SPDXID: SPDXRef-DOCUMENT
+DocumentName: .
+DocumentNamespace: https://anchore.com/syft/dir/e69056a9-935e-4f00-b85f-9467f5d99a92
+LicenseListVersion: 3.16
+Creator: Organization: Anchore, Inc
+Creator: Tool: syft-[not provided]
+Created: 2022-04-13T16:38:03Z
+
+##### Package: @at-sign
+
+PackageName: @at-sign
+SPDXID: SPDXRef-Package---at-sign-739e4f0d93fb8298
+PackageDownloadLocation: NOASSERTION
+FilesAnalyzed: false
+PackageLicenseConcluded: NONE
+PackageLicenseDeclared: NONE
+PackageCopyrightText: NOASSERTION
+
+##### Package: some/slashes
+
+PackageName: some/slashes
+SPDXID: SPDXRef-Package--some-slashes-26db06648b24bff9
+PackageDownloadLocation: NOASSERTION
+FilesAnalyzed: false
+PackageLicenseConcluded: NONE
+PackageLicenseDeclared: NONE
+PackageCopyrightText: NOASSERTION
+
+##### Package: under_scores
+
+PackageName: under_scores
+SPDXID: SPDXRef-Package--under-scores-250cbfefcdea318b
+PackageDownloadLocation: NOASSERTION
+FilesAnalyzed: false
+PackageLicenseConcluded: NONE
+PackageLicenseDeclared: NONE
+PackageCopyrightText: NOASSERTION
+

internal/formats/spdx22tagvalue/to_format_model.go

@@ -96,13 +96,31 @@ func toFormatPackages(catalog *pkg.Catalog) map[spdx.ElementID]*spdx.Package2_2
 
 	for _, p := range catalog.Sorted() {
 		// name should be guaranteed to be unique, but semantically useful and stable
-		id := fmt.Sprintf("Package-%+v-%s-%s", p.Type, p.Name, p.ID())
+		id := spdxhelpers.SanitizeElementID(fmt.Sprintf("Package-%+v-%s-%s", p.Type, p.Name, p.ID()))
 
 		// If the Concluded License is not the same as the Declared License, a written explanation should be provided
 		// in the Comments on License field (section 3.16). With respect to NOASSERTION, a written explanation in
 		// the Comments on License field (section 3.16) is preferred.
 		license := spdxhelpers.License(p)
 
+		filesAnalyzed := false
+		checksums := make(map[spdx.ChecksumAlgorithm]spdx.Checksum)
+
+		// If the pkg type is Java we have attempted to generated a digest
+		// FilesAnalyzed should be true in this case
+		if p.MetadataType == pkg.JavaMetadataType {
+			javaMetadata := p.Metadata.(pkg.JavaMetadata)
+			if len(javaMetadata.ArchiveDigests) > 0 {
+				filesAnalyzed = true
+				for _, digest := range javaMetadata.ArchiveDigests {
+					checksums[spdx.ChecksumAlgorithm(digest.Algorithm)] = spdx.Checksum{
+						Algorithm: spdx.ChecksumAlgorithm(digest.Algorithm),
+						Value:     digest.Value,
+					}
+				}
+			}
+		}
+
 		results[spdx.ElementID(id)] = &spdx.Package2_2{
 
 			// NOT PART OF SPEC
@@ -159,7 +177,7 @@ func toFormatPackages(catalog *pkg.Catalog) map[spdx.ElementID]*spdx.Package2_2
 
 			// Intent: A package can refer to a project, product, artifact, distribution or a component that is
 			// external to the SPDX document.
-			FilesAnalyzed: false,
+			FilesAnalyzed: filesAnalyzed,
 			// NOT PART OF SPEC: did FilesAnalyzed tag appear?
 			IsFilesAnalyzedTagPresent: true,
 
@@ -180,6 +198,7 @@ func toFormatPackages(catalog *pkg.Catalog) map[spdx.ElementID]*spdx.Package2_2
 			// to determine if any file in the original package has been changed. If the SPDX file is to be included
 			// in a package, this value should not be calculated. The SHA-1 algorithm will be used to provide the
 			// checksum by default.
+			PackageChecksums: checksums,
 
 			// note: based on the purpose above no discovered checksums should be provided, but instead, only
 			// tool-derived checksums.

syft/file/digest_cataloger.go

@@ -77,30 +77,39 @@ func (i *DigestsCataloger) catalogLocation(resolver source.FileResolver, locatio
 	}
 	defer internal.CloseAndLogError(contentReader, location.VirtualPath)
 
+	digests, err := DigestsFromFile(contentReader, i.hashes)
+	if err != nil {
+		return nil, internal.ErrPath{Context: "digests-cataloger", Path: location.RealPath, Err: err}
+	}
+
+	return digests, nil
+}
+
+func DigestsFromFile(closer io.ReadCloser, hashes []crypto.Hash) ([]Digest, error) {
 	// create a set of hasher objects tied together with a single writer to feed content into
-	hashers := make([]hash.Hash, len(i.hashes))
-	writers := make([]io.Writer, len(i.hashes))
-	for idx, hashObj := range i.hashes {
+	hashers := make([]hash.Hash, len(hashes))
+	writers := make([]io.Writer, len(hashes))
+	for idx, hashObj := range hashes {
 		hashers[idx] = hashObj.New()
 		writers[idx] = hashers[idx]
 	}
 
-	size, err := io.Copy(io.MultiWriter(writers...), contentReader)
+	size, err := io.Copy(io.MultiWriter(writers...), closer)
 	if err != nil {
-		return nil, internal.ErrPath{Context: "digests-cataloger", Path: location.RealPath, Err: err}
+		return nil, err
 	}
 
 	if size == 0 {
 		return make([]Digest, 0), nil
 	}
 
-	result := make([]Digest, len(i.hashes))
+	result := make([]Digest, len(hashes))
 	// only capture digests when there is content. It is important to do this based on SIZE and not
 	// FILE TYPE. The reasoning is that it is possible for a tar to be crafted with a header-only
 	// file type but a body is still allowed.
 	for idx, hasher := range hashers {
 		result[idx] = Digest{
-			Algorithm: DigestAlgorithmName(i.hashes[idx]),
+			Algorithm: DigestAlgorithmName(hashes[idx]),
 			Value:     fmt.Sprintf("%+x", hasher.Sum(nil)),
 		}
 	}

syft/pkg/cataloger/common/cpe/candidate_by_package_type.go

@@ -19,12 +19,12 @@ var defaultCandidateAdditions = buildCandidateLookup(
 		{
 			pkg.JavaPkg,
 			candidateKey{PkgName: "springframework"},
-			candidateAddition{AdditionalProducts: []string{"spring_framework", "springsource_spring_framework"}},
+			candidateAddition{AdditionalProducts: []string{"spring_framework", "springsource_spring_framework"}, AdditionalVendors: []string{"pivotal_software", "springsource", "vmware"}},
 		},
 		{
 			pkg.JavaPkg,
 			candidateKey{PkgName: "spring-core"},
-			candidateAddition{AdditionalProducts: []string{"spring_framework", "springsource_spring_framework"}},
+			candidateAddition{AdditionalProducts: []string{"spring_framework", "springsource_spring_framework"}, AdditionalVendors: []string{"pivotal_software", "springsource", "vmware"}},
 		},
 		{
 			// example image: docker.io/nuxeo:latest

syft/pkg/cataloger/java/archive_parser.go

@@ -1,14 +1,17 @@
 package java
 
 import (
+	"crypto"
 	"fmt"
 	"io"
+	"os"
 	"path"
 	"strings"
 
 	"github.com/anchore/syft/internal/file"
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/artifact"
+	syftFile "github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/pkg"
 	"github.com/anchore/syft/syft/pkg/cataloger/common"
 )
@@ -34,6 +37,11 @@ var archiveFormatGlobs = []string{
 	// project that we can build in CI feel free to include it
 }
 
+// javaArchiveHashes are all the current hash algorithms used to calculate archive digests
+var javaArchiveHashes = []crypto.Hash{
+	crypto.SHA1,
+}
+
 type archiveParser struct {
 	fileManifest file.ZipFileManifest
 	virtualPath  string
@@ -101,6 +109,7 @@ func (j *archiveParser) parse() ([]*pkg.Package, []artifact.Relationship, error)
 	}
 
 	// find aux packages from pom.properties/pom.xml and potentially modify the existing parentPkg
+	// NOTE: we cannot generate sha1 digests from packages discovered via pom.properties/pom.xml
 	auxPkgs, err := j.discoverPkgsFromAllMavenFiles(parentPkg)
 	if err != nil {
 		return nil, nil, err
@@ -135,6 +144,7 @@ func (j *archiveParser) parse() ([]*pkg.Package, []artifact.Relationship, error)
 // discoverMainPackage parses the root Java manifest used as the parent package to all discovered nested packages.
 func (j *archiveParser) discoverMainPackage() (*pkg.Package, error) {
 	// search and parse java manifest files
+	// TODO: do we want to prefer or check for pom files over manifest here?
 	manifestMatches := j.fileManifest.GlobMatch(manifestGlob)
 	if len(manifestMatches) > 1 {
 		return nil, fmt.Errorf("found multiple manifests in the jar: %+v", manifestMatches)
@@ -157,6 +167,18 @@ func (j *archiveParser) discoverMainPackage() (*pkg.Package, error) {
 		return nil, nil
 	}
 
+	archiveCloser, err := os.Open(j.archivePath)
+	if err != nil {
+		return nil, fmt.Errorf("unable to open archive path (%s): %w", j.archivePath, err)
+	}
+	defer archiveCloser.Close()
+
+	// grab and assign digest for the entire archive
+	digests, err := syftFile.DigestsFromFile(archiveCloser, javaArchiveHashes)
+	if err != nil {
+		log.Warnf("failed to create digest for file=%q: %+v", j.archivePath, err)
+	}
+
 	return &pkg.Package{
 		Name:         selectName(manifest, j.fileInfo),
 		Version:      selectVersion(manifest, j.fileInfo),
@@ -164,8 +186,9 @@ func (j *archiveParser) discoverMainPackage() (*pkg.Package, error) {
 		Type:         j.fileInfo.pkgType(),
 		MetadataType: pkg.JavaMetadataType,
 		Metadata: pkg.JavaMetadata{
-			VirtualPath: j.virtualPath,
-			Manifest:    manifest,
+			VirtualPath:    j.virtualPath,
+			Manifest:       manifest,
+			ArchiveDigests: digests,
 		},
 	}, nil
 }
@@ -181,12 +204,14 @@ func (j *archiveParser) discoverPkgsFromAllMavenFiles(parentPkg *pkg.Package) ([
 
 	var pkgs []*pkg.Package
 
-	properties, err := pomPropertiesByParentPath(j.archivePath, j.fileManifest.GlobMatch(pomPropertiesGlob), j.virtualPath)
+	// pom.properties
+	properties, err := pomPropertiesByParentPath(j.archivePath, j.virtualPath, j.fileManifest.GlobMatch(pomPropertiesGlob))
 	if err != nil {
 		return nil, err
 	}
 
-	projects, err := pomProjectByParentPath(j.archivePath, j.fileManifest.GlobMatch(pomXMLGlob), j.virtualPath)
+	// pom.xml
+	projects, err := pomProjectByParentPath(j.archivePath, j.virtualPath, j.fileManifest.GlobMatch(pomXMLGlob))
 	if err != nil {
 		return nil, err
 	}
@@ -273,7 +298,7 @@ func discoverPkgsFromOpener(virtualPath, pathWithinArchive string, archiveOpener
 	return nestedPkgs, nestedRelationships, nil
 }
 
-func pomPropertiesByParentPath(archivePath string, extractPaths []string, virtualPath string) (map[string]pkg.PomProperties, error) {
+func pomPropertiesByParentPath(archivePath, virtualPath string, extractPaths []string) (map[string]pkg.PomProperties, error) {
 	contentsOfMavenPropertiesFiles, err := file.ContentsFromZip(archivePath, extractPaths...)
 	if err != nil {
 		return nil, fmt.Errorf("unable to extract maven files: %w", err)
@@ -298,10 +323,11 @@ func pomPropertiesByParentPath(archivePath string, extractPaths []string, virtua
 
 		propertiesByParentPath[path.Dir(filePath)] = *pomProperties
 	}
+
 	return propertiesByParentPath, nil
 }
 
-func pomProjectByParentPath(archivePath string, extractPaths []string, virtualPath string) (map[string]pkg.PomProject, error) {
+func pomProjectByParentPath(archivePath, virtualPath string, extractPaths []string) (map[string]pkg.PomProject, error) {
 	contentsOfMavenProjectFiles, err := file.ContentsFromZip(archivePath, extractPaths...)
 	if err != nil {
 		return nil, fmt.Errorf("unable to extract maven files: %w", err)

syft/pkg/cataloger/java/archive_parser_test.go

@@ -283,6 +283,11 @@ func TestParseJar(t *testing.T) {
 				metadata := a.Metadata.(pkg.JavaMetadata)
 				metadata.Parent = nil
 
+				// redact Digest which is computed differently between CI and local
+				if len(metadata.ArchiveDigests) > 0 {
+					metadata.ArchiveDigests = nil
+				}
+
 				// ignore select fields (only works for the main section)
 				for _, field := range test.ignoreExtras {
 					if metadata.Manifest != nil && metadata.Manifest.Main != nil {
@@ -567,7 +572,6 @@ func TestParseNestedJar(t *testing.T) {
 						}
 					}
 				}
-
 			}
 		})
 	}

syft/pkg/java_metadata.go

@@ -3,6 +3,7 @@ package pkg
 import (
 	"strings"
 
+	"github.com/anchore/syft/syft/file"
 	"github.com/anchore/syft/syft/linux"
 
 	"github.com/anchore/syft/internal"
@@ -20,12 +21,13 @@ var jenkinsPluginPomPropertiesGroupIDs = []string{
 
 // JavaMetadata encapsulates all Java ecosystem metadata for a package as well as an (optional) parent relationship.
 type JavaMetadata struct {
-	VirtualPath   string         `json:"virtualPath" cyclonedx:"virtualPath"` // we need to include the virtual path in cyclonedx documents to prevent deduplication of jars within jars
-	Manifest      *JavaManifest  `mapstructure:"Manifest" json:"manifest,omitempty"`
-	PomProperties *PomProperties `mapstructure:"PomProperties" json:"pomProperties,omitempty" cyclonedx:"-"`
-	PomProject    *PomProject    `mapstructure:"PomProject" json:"pomProject,omitempty"`
-	PURL          string         `hash:"ignore" json:"-"` // pURLs and CPEs are ignored for package IDs
-	Parent        *Package       `hash:"ignore" json:"-"` // note: the parent cannot be included in the minimal definition of uniqueness since this field is not reproducible in an encode-decode cycle (is lossy).
+	VirtualPath    string         `json:"virtualPath" cyclonedx:"virtualPath"` // we need to include the virtual path in cyclonedx documents to prevent deduplication of jars within jars
+	Manifest       *JavaManifest  `mapstructure:"Manifest" json:"manifest,omitempty"`
+	PomProperties  *PomProperties `mapstructure:"PomProperties" json:"pomProperties,omitempty" cyclonedx:"-"`
+	PomProject     *PomProject    `mapstructure:"PomProject" json:"pomProject,omitempty"`
+	ArchiveDigests []file.Digest  `hash:"ignore" json:"digest,omitempty"`
+	PURL           string         `hash:"ignore" json:"-"` // pURLs and CPEs are ignored for package IDs
+	Parent         *Package       `hash:"ignore" json:"-"` // note: the parent cannot be included in the minimal definition of uniqueness since this field is not reproducible in an encode-decode cycle (is lossy).
 }
 
 // PomProperties represents the fields of interest extracted from a Java archive's pom.properties file.