Documentation
¶
Overview ¶
Package jar implements a scanner on Java archive (jar) files.
In addition to bog standard archives, this package attempts to handle more esoteric uses, also.
Throughout the code and comments, "jar" should be understood to mean "any kind of JVM archive." A brief primer on the different kinds:
jar: Java Archive. It's a zip with a manifest file, some compiled class files, and other assets.
fatjar/onejar: Some jars unpacked, merged, then repacked. I gather this isn't in favor in the java scene.
war: Webapp Archive. These are consumed by application servers like Tomcat, and are an all-in-one of code, dependencies, and metadata for configuring the server.
ear: Enterprise Archive. These are bundles of wars, with hook points for configuration. They're only used on JEE servers, so they're comparatively rare in the real world.
Index ¶
Constants ¶
const MinSize = 22
MinSize is the absolute minimum size for a jar.
This is the size of an empty zip. Files smaller than this cannot be jars.
Variables ¶
var ErrNotAJar = errors.New("does not seem to be a jar")
ErrNotAJar is a sentinel error that can be used with errors.Is.
Functions ¶
func ProductCPEs ¶ added in v1.6.2
ProductCPEs returns product CPEs from CycloneDX documents under META-INF/sbom/. A jar with no such document returns a nil slice.
Types ¶
type Info ¶
type Info struct {
// Name is the machine name found.
//
// Metadata that contains a "presentation" name isn't used to populate this
// field.
Name string
// Version is the version.
Version string
// Source is the archive member used to populate the information. If the
// name of the archive was used, this will be ".".
// If this jar is embedded inside another jar or series of jars,
// each jar file will be included and separated via ":".
Source string
// Kind is the producer that filled this Info.
Kind SourceKind
// CPEs are product names that provide this artifact.
//
// Currently only populated if the info source is an embedded SBoM.
CPEs []cpe.WFN
// SHA1 is populated with the SHA1 of the file if this entry was discovered
// inside another archive.
SHA1 []byte
// SHA256 is populated with the SHA256 of the file if this entry was
// discovered inside another archive.
SHA256 []byte
// Location is the component path from an embedded SBOM, when one is recorded.
Location string
}
Info reports the discovered information for a jar file.
Any given jar may actually contain multiple jars or recombined classes.
func Parse ¶
Parse returns Info structs describing all of the discovered "artifacts" in the jar.
An embedded SBoM is the preferred source of information. When one is found, it is assumed correct for the archive and bundled jars are not examined. Otherwise, POM properties are used, falling back to the jar manifest and then the archive name, and bundled jars are examined.
The provided name is expected to be the full path within the layer to the jar file being provided as "z".
type SourceKind ¶ added in v1.6.2
type SourceKind uint8
SourceKind records which producer filled an Info.
const ( SourceUnknown SourceKind = iota SourceSBOM SourceProperties SourceManifest SourceName )
Notes ¶
Bugs ¶
Older versions of the stdlib can report io.EOF when opening malformed zips.
Source Files