mirror of
https://github.com/anchore/syft.git
synced 2026-10-11 21:57:22 +02:00
0bbcff1ae3
* fix: scan a Java resource adapter (.rar) given as a file source The file source picks an extractor for the scan target from its file name alone. A Java resource adapter archive (JCA) uses the .rar extension but is a zip file, so it was handed to the RAR extractor. With rardecode v2.2.0 the RAR extractor does not return on non-RAR input (an infinite loop in its signature search), so `syft scan --from file adapter.rar` never finished. The same bytes named .jar scan in under a second. When the name says RAR but the content is a zip archive, leave the file unextracted, the same way .jar, .war and .ear scan targets are handled. The java cataloger already reads .rar files (anchore/syft#4136) and now finds the resource adapter and its nested jars. Real RAR archives are still extracted. Signed-off-by: Ismael Donmez <ismael.donmez@chainguard.dev> Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * chore(deps): bump github.com/nwaples/rardecode/v2 from 2.2.0 to 2.4.1 rardecode v2.2.0 loops forever in its RAR signature search when the input does not start with a RAR signature (fixed upstream in nwaples/rardecode f501ac8, "fix infinite loop in findSig", released in v2.2.2). syft reaches that search for any file source whose name contains ".rar", so a scan of a self-extracting RAR, or of any other file with such a name, never finished. With v2.4.1 a self-extracting RAR is extracted, and a file that is not a RAR archive fails fast with "rardecode: RAR signature not found", the same way a file named .zip that is not a zip archive fails today. github.com/mholt/archives v0.1.5 (the latest release) still requires v2.2.0, so the newer version is selected here. Signed-off-by: Ismael Donmez <ismael.donmez@chainguard.dev> Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com> * fix: clarify the .rar zip log line and cover self-extracting RAR sources - the debug line no longer calls every `.rar`-named zip a resource adapter - a self-extracting RAR (stub before the signature) given as a file source is still extracted Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> --------- Signed-off-by: Ismael Donmez <ismael.donmez@chainguard.dev> Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>