Add support for java "nar" files

[ZENinjaneer]

syft/syft/pkg/cataloger/java/archive_filename.go

Line 111 in b20310e

case "jar", "war", "ear", "lpkg", "par", "sar":

could you please add "nar" to this case statement so it can support grype scanning NiFi nars?

[wagoodman]

curious! is a nar just a jar? That is, is it the same metadata (like with war, ear, etc) just with a different name? Or is there more metadata to parse?

[ZENinjaneer]

A nar is basically a shaded jar. It's very similar to a WAR but instead of a WEB-INF the root is META-INF (like in a JAR). Under the META-INF there are other text files that essentially have to do with licensing. A short and sweet overview can be found here: https://medium.com/hashmapinc/nifi-nar-files-explained-14113f7796fd

[tgerla]

Thanks for the details! I think this would be a reasonable addition to the list of archive filenames. We will add this to our backlog but please let us know if you want to submit a pull request yourself--we can help you through the process if you need.

We think the only things that need to change are a new glob for .nar files here:

syft/syft/pkg/cataloger/java/archive_parser.go

Line 22 in b20310e

var archiveFormatGlobs = []string{

And in the list here:

syft/syft/pkg/cataloger/java/archive_filename.go

Line 111 in b20310e

case "jar", "war", "ear", "lpkg", "par", "sar":

[shanedell]

@tgerla Could I tackle this? If @ZENinjaneer doesn't plan to of course

[wagoodman]

@shanedell have at it!