fix(java): resolve uber-jar version from root version.properties (issue #5163) - #5219
Open
CAOShurong wants to merge 3 commits into
Open
fix(java): resolve uber-jar version from root version.properties (issue #5163)#5219CAOShurong wants to merge 3 commits into
CAOShurong wants to merge 3 commits into
Conversation
…ons.lock lockfiles Signed-off-by: Shurong Cao <CAOShurong@users.noreply.github.com>
anchore#5163) Some build tools (e.g. Clojure's build.clj, used by Metabase) record the version only in a root-level `version.properties` file (key `tag`), not in the manifest, filename, or pom.properties. Syft previously emitted `UNKNOWN`, dropping the version from the purl and CPE and breaking downstream vulnerability matching. Add a final fallback in discoverNameVersionLicense that reads the `tag` (or `version`) key from a root `version.properties` after the existing manifest/filename/pom checks fail. Verified end-to-end: a minimal metabase.jar (no version in manifest or filename, only version.properties with tag=v0.63.5) now catalogs as metabase@v0.63.5 (pkg:maven/metabase/metabase@v0.63.5, CPE with version) instead of metabase@UNKNOWN. Signed-off-by: Shurong Cao <CAOShurong@users.noreply.github.com>
CAOShurong
force-pushed
the
codex/5163-uberjar-versionproperties
branch
from
August 24, 2026 12:11
57c28bf to
62f34ea
Compare
…back The glob **/version.properties also matches nested third-party version.properties files that uber-jars commonly vendor (the real Metabase jar ships ~40 of them). Any vendored copy containing a tag= or version= key could win depending on zip entry order and attach a dependency's version to the application package. Tighten the match to the exact root entry and defensively filter matches to the root path before extraction. Regression test: a nested clojure/version.properties carrying a poison value is added to the metabase-version-properties fixture; the cataloged version stays v0.63.5 from the root file (the previous glob resolves the poison value instead). Signed-off-by: Shurong Cao <CAOShurong@users.noreply.github.com> Signed-off-by: Shurong Cao <170531907+CAOShurong@users.noreply.github.com>
Contributor
Author
|
Pushed a hardening commit (
Verified with a real regression test: added a vendored Note for reviewers: running the java cataloger suite on Windows hits pre-existing path-separator mismatches ( |
9 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Resolves #5163.
Some build tools (e.g. Clojure's
build.clj, used by Metabase) record the version only in a root-levelversion.propertiesfile (keytag), not in the manifest, filename, orpom.properties. Syft previously emittedUNKNOWN, which dropped the version from the purl and CPE and broke downstream vulnerability matching (e.g. the recent Metabase security advisory).This adds a final fallback in
discoverNameVersionLicensethat reads thetag(orversion) key from a rootversion.propertiesafter the existing manifest/filename/pom checks fail.Verification
End-to-end, scanning a minimal
metabase.jar(no version in manifest or filename; onlyversion.propertieswithtag=v0.63.5):metabase@UNKNOWN, purlpkg:maven/metabase/metabase(no version), CPE wildcardmetabase@v0.63.5, purlpkg:maven/metabase/metabase@v0.63.5, CPEcpe:2.3:a:metabase:metabase:v0.63.5:*:*:*:*:*:*:*A regression test fixture (
metabase-version-properties) and aTest_parseJavaArchive_regressionscase are included.Checklist
go vet ./syft/pkg/cataloger/java/passes