mirror of
https://github.com/anchore/syft.git
synced 2026-10-30 14:02:26 +01:00
with nested cataloging on, java leaves root-level archives to the archive task, so a root `app.jar` package only exists once that task has run. With the default `FilesOwnedByPackageSelection` the root file catalogers ran in an earlier group, never saw the package, and `app.jar` got no file metadata or digests. It did get them with the feature off. - in owned-by-package mode the groups are now packages, then the archive task, then the root file tasks. Other modes are unchanged - the file tasks merge their results into the SBOM instead of replacing the maps, since the archive task has already written nested files into them Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>