mirror of
https://github.com/anchore/syft.git
synced 2026-10-31 14:36:33 +01:00
`discoverArchives` collects MIME hits first, and those are bare real paths. When the glob pass then found the same file through a symlink, it was dropped as a duplicate along with its access path. Java decides whether to describe an archive by its name, so a content-addressed jar (`store/3f9a1c`, linked from `lib/json-simple-1.1.1.jar`) was extracted but produced no package. This is the pnpm / nix / bazel layout. When deduping, the candidate now takes the first location that carries an access path. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>