What happened : Up to version 0.103.1</stron

Properties metadata.manifest.main are no more available in json output about syft HOT 2 CLOSED

francescomedina commented on September 26, 2024

Properties metadata.manifest.main are no more available in json output

from syft.

Comments (2)

wagoodman commented on September 26, 2024

Assuming you're referring to the java manifest metadata type, which was:

syft/syft/pkg/java.go

Lines 68 to 71 in fef0e54

 type JavaManifest struct { 

 Main map[string]string `json:"main,omitempty"` 

 NamedSections map[string]map[string]string `json:"namedSections,omitempty"` 

 }

And is now:

syft/syft/pkg/java.go

Lines 71 to 74 in f4e1896

 type JavaManifest struct { 

 Main KeyValues `json:"main,omitempty"` 

 Sections []KeyValues `json:"sections,omitempty"` 

 }

This was a change made in #2553 (which is the closest culprit for what you're describing).

That being said, I'm not seeing the behavior you're referring to:

$ syft cloudbees/cloudbees-core-mm:latest -o json > /tmp/core-mm.json
$ cat /tmp/core-mm.json | jq '.artifacts[] | select(.metadata.manifest.main != null)'

{
  "id": "f5da67d7d1f4d742",
  "name": "aws-java-sdk-codeguruprofiler",
  "version": "1.11.995",
  "type": "java-archive",
  "foundBy": "java-archive-cataloger",
  "locations": [
    {
      "path": "/usr/share/jenkins/jenkins.war",
      "layerID": "sha256:545b89fe82a087acefa3ce12783e1da0a1268224364c7310341e408d73985846",
      "accessPath": "/usr/share/jenkins/jenkins.war:WEB-INF/plugins/aws-java-sdk.hpi:WEB-INF/lib/aws-java-sdk-codeguruprofiler-1.11.995.jar",
      "annotations": {
        "evidence": "primary"
      }
    }
  ],
  "licenses": [],
  "language": "java",
  "cpes": [... snip...],
  "purl": "pkg:maven/com.amazonaws/[email protected]",
  "metadataType": "java-archive",
  "metadata": {
    "virtualPath": "/usr/share/jenkins/jenkins.war:WEB-INF/plugins/aws-java-sdk.hpi:WEB-INF/lib/aws-java-sdk-codeguruprofiler-1.11.995.jar",
    "manifest": {
      "main": [
        {
          "key": "Manifest-Version",
          "value": "1.0"
        },
        {
          "key": "Archiver-Version",
          "value": "Plexus Archiver"
        },
        {
          "key": "Built-By",
          "value": "root"
        },
        {
          "key": "Created-By",
          "value": "Apache Maven 3.5.4"
        },
        {
          "key": "Build-Jdk",
          "value": "1.8.0_171"
        }
      ]
    },
    "pomProperties": {
      "path": "META-INF/maven/com.amazonaws/aws-java-sdk-codeguruprofiler/pom.properties",
      "name": "",
      "groupId": "com.amazonaws",
      "artifactId": "aws-java-sdk-codeguruprofiler",
      "version": "1.11.995"
    },
    "digest": [
      {
        "algorithm": "sha1",
        "value": "d16a17cdb41c76ef41b6172d903db751cccda395"
      }
    ]
  }
}
...

There are a lot more examples in that output too.

Do you have any example public docker images that you can share that show this behavior? (with java packages you were expecting to have a main manifest section that you are seeing as null?)

from syft.