Merge branch 'main' of github.com:aquasecurity/trivy into fix-nested-jar-digest

# Conflicts:
#	pkg/dependency/parser/java/jar/parse.go
#	pkg/fanal/analyzer/language/java/jar/jar.go
#	pkg/fanal/analyzer/language/java/jar/jar_test.go

Author: DmitriyLewen

docs/guide/coverage/language/java.md

@@ -38,9 +38,15 @@ To find information about these JARs[^2], the same logic is used as for the base
 `table` format only contains the name of root JAR[^2] . To get the full path to inner JARs[^2] use the `json` format.
 
 ### Licenses
-Trivy detects licenses declared in the `<licenses>` block of the embedded `META-INF/maven/<groupId>/<artifactId>/pom.xml` and attaches them to the matching package.
+Trivy detects licenses for a JAR[^2] from two sources, in this order:
 
-Coverage is limited: many JARs declare a license only in a parent POM (which is not expanded in the embedded `pom.xml`) or ship no Maven descriptor at all.
+1. **Embedded POM** — the `<licenses>` block of the embedded `META-INF/maven/<groupId>/<artifactId>/pom.xml`, matched to the package by `groupId:artifactId`.
+2. **License files** — `LICENSE`, `LICENCE` or `COPYRIGHT` files (including variants like `LICENSE.txt`) located at the JAR[^2] root or directly under `META-INF/`. Their content is classified with the [license classifier](../../scanner/license.md). A license file carries no `groupId:artifactId`, so it is attached only when the JAR[^2] contains a single artifact; in uber/shaded JARs[^2] (multiple artifacts) the owner is ambiguous and such files are skipped.
+
+Notes and limitations:
+
+- Coverage is limited: many JARs[^2] declare a license only in a parent POM (which is not expanded in the embedded `pom.xml`) or ship no Maven descriptor at all.
+- A single license file may bundle the texts of third-party components (e.g. Spring or Tomcat artifacts), so a package can be reported with several licenses found in that file, not only its own.
 
 ## pom.xml
 Trivy parses your `pom.xml` file and tries to find files with dependencies from these local locations.

go.mod

@@ -37,7 +37,7 @@ require (
 	github.com/bmatcuk/doublestar/v4 v4.10.0
 	github.com/cenkalti/backoff/v6 v6.0.1
 	github.com/cheggaaa/pb/v3 v3.1.7
-	github.com/containerd/containerd/v2 v2.3.1
+	github.com/containerd/containerd/v2 v2.3.2
 	github.com/containerd/platforms v1.0.0-rc.4
 	github.com/distribution/reference v0.6.0
 	github.com/docker/cli v29.5.2+incompatible
@@ -113,12 +113,12 @@ require (
 	github.com/zclconf/go-cty v1.18.1
 	github.com/zclconf/go-cty-yaml v1.2.0
 	go.etcd.io/bbolt v1.4.3
-	golang.org/x/crypto v0.52.0
+	golang.org/x/crypto v0.53.0
 	golang.org/x/mod v0.36.0
 	golang.org/x/net v0.55.0
-	golang.org/x/sync v0.20.0
-	golang.org/x/term v0.43.0
-	golang.org/x/text v0.37.0
+	golang.org/x/sync v0.21.0
+	golang.org/x/term v0.44.0
+	golang.org/x/text v0.38.0
 	golang.org/x/tools v0.45.0
 	golang.org/x/vuln v1.3.0
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da
@@ -463,7 +463,7 @@ require (
 	go.yaml.in/yaml/v4 v4.0.0-rc.3 // indirect
 	golang.org/x/exp v0.0.0-20260508232706-74f9aab9d74a // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sys v0.45.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
 	golang.org/x/telemetry v0.0.0-20260508192327-42602be52be6 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/api v0.274.0 // indirect

go.sum

@@ -302,8 +302,8 @@ github.com/containerd/cgroups/v3 v3.1.3 h1:eUNflyMddm18+yrDmZPn3jI7C5hJ9ahABE5q6
 github.com/containerd/cgroups/v3 v3.1.3/go.mod h1:PKZ2AcWmSBsY/tJUVhtS/rluX0b1uq1GmPO1ElCmbOw=
 github.com/containerd/containerd/api v1.11.1 h1:h8nfoDW9+fNsC/9TwiAHj8B1GzXKtR4eFtkhi/X5RLU=
 github.com/containerd/containerd/api v1.11.1/go.mod h1:CaQFRu+N1MtbgL6JDOJLUB1hCKESU1lD6MuTJhgtdlw=
-github.com/containerd/containerd/v2 v2.3.1 h1:4dVXBdlvotRBlaP2TmNbY/EGc06KJrMDDUqQdxX/HOk=
-github.com/containerd/containerd/v2 v2.3.1/go.mod h1:xVoxGPWZBwwph8DF2IbDhriLKdHfjdpO0b3wFP9wQ1I=
+github.com/containerd/containerd/v2 v2.3.2 h1:eLven1YxRMkeiKu7IcMrPKE+gn8sGR1DqHbbshMEvWM=
+github.com/containerd/containerd/v2 v2.3.2/go.mod h1:rHKGm3VW6wNrINb3x8mNT+w7qYXFVElTt/8HTuxVhD4=
 github.com/containerd/continuity v0.5.0 h1:7a85HZpCSs+1Zps0Ee3DPSuAWY+0SJM1JNM51nlEVDg=
 github.com/containerd/continuity v0.5.0/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
@@ -1306,8 +1306,8 @@ golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8U
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210513164829-c07d793c2f9a/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8=
 golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
-golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
-golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
+golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
+golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20260508232706-74f9aab9d74a h1:+3jdDGGB8NGb1Zktc737jlt3/A5f6UlwSzmvqUuufxw=
 golang.org/x/exp v0.0.0-20260508232706-74f9aab9d74a/go.mod h1:d2fgXJLVs4dYDHUk5lwMIfzRzSrWCfGZb0ZqeLa/Vcw=
@@ -1346,8 +1346,8 @@ golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4=
-golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
+golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
 golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -1380,22 +1380,22 @@ golang.org/x/sys v0.0.0-20220412211240-33da011f77ad/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY=
-golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/telemetry v0.0.0-20260508192327-42602be52be6 h1:HjU6IWBiAgRIdAJ9/y1rwCn+UELEmwV+VsTLzj/W4sE=
 golang.org/x/telemetry v0.0.0-20260508192327-42602be52be6/go.mod h1:Eqhaxk/wZsWEH8CRxLwj6xzEJbz7k1EFGqx7nyCoabE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
-golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4=
-golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk=
+golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
+golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
-golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
+golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
+golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
 golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
 golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

integration/testdata/spring4shell-jre11.json.golden

@@ -257,7 +257,7 @@
           "PkgPath": "usr/local/tomcat/webapps/helloworld.war/WEB-INF/lib/spring-beans-5.3.15.jar",
           "PkgIdentifier": {
             "PURL": "pkg:maven/org.springframework/spring-beans@5.3.15",
-            "UID": "382ba53322e3ac2a"
+            "UID": "59399c43172e6917"
           },
           "InstalledVersion": "5.3.15",
           "FixedVersion": "5.3.18",

integration/testdata/spring4shell-jre8.json.golden

@@ -257,7 +257,7 @@
           "PkgPath": "usr/local/tomcat/webapps/helloworld.war/WEB-INF/lib/spring-beans-5.3.15.jar",
           "PkgIdentifier": {
             "PURL": "pkg:maven/org.springframework/spring-beans@5.3.15",
-            "UID": "382ba53322e3ac2a"
+            "UID": "59399c43172e6917"
           },
           "InstalledVersion": "5.3.15",
           "FixedVersion": "5.3.18",

pkg/dependency/parser/java/jar/export_test.go

@@ -5,4 +5,5 @@ package jar
 var (
 	EmbeddedPomGAV    = embeddedPomGAV
 	DecodePomLicenses = decodePomLicenses
+	IsJarLicenseFile  = isJarLicenseFile
 )

pkg/dependency/parser/java/jar/parse.go

@@ -20,6 +20,7 @@ import (
 
 	"github.com/aquasecurity/trivy/pkg/digest"
 	ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
+	"github.com/aquasecurity/trivy/pkg/licensing"
 	"github.com/aquasecurity/trivy/pkg/log"
 	xio "github.com/aquasecurity/trivy/pkg/x/io"
 	xos "github.com/aquasecurity/trivy/pkg/x/os"
@@ -36,11 +37,12 @@ type Client interface {
 }
 
 type Parser struct {
-	logger       *log.Logger
-	rootFilePath string
-	offline      bool
-	checksum     bool
-	size         int64
+	logger                 *log.Logger
+	rootFilePath           string
+	offline                bool
+	checksum               bool
+	size                   int64
+	licenseConfidenceLevel float64
 
 	client Client
 }
@@ -73,6 +75,12 @@ func WithSize(size int64) Option {
 	}
 }
 
+func WithLicenseClassifierConfidenceLevel(level float64) Option {
+	return func(p *Parser) {
+		p.licenseConfidenceLevel = level
+	}
+}
+
 func NewParser(c Client, opts ...Option) *Parser {
 	p := &Parser{
 		logger: log.WithPrefix("jar"),
@@ -120,15 +128,15 @@ func (p *Parser) parsePackages(filePath string, size int64, r xio.ReadSeekerAt)
 	// e.g. spring-core-5.3.4-SNAPSHOT.jar => sprint-core, 5.3.4-SNAPSHOT
 	fileProps := parseFileName(filePath)
 
-	pkgs, m, foundPomProps, err := p.traverseZip(size, r, fileProps)
+	pkgs, m, foundPomProps, licenseFile, err := p.traverseZip(size, r, fileProps)
 	if err != nil {
 		return nil, nil, xerrors.Errorf("zip error: %w", err)
 	}
 
 	// If pom.properties is found, it should be preferred than MANIFEST.MF.
 	// Otherwise, resolve the artifact of the jar itself from MANIFEST.MF / SHA-1 / file name.
 	// Such an artifact has no embedded pom.xml (maven-archiver writes pom.xml and
-	// pom.properties together), so it carries no license.
+	// pom.properties together), so it carries no pom.xml license.
 	if !foundPomProps {
 		pkg, found, err := p.resolveArtifact(r, m, fileProps)
 		if err != nil {
@@ -139,6 +147,10 @@ func (p *Parser) parsePackages(filePath string, size int64, r xio.ReadSeekerAt)
 		}
 	}
 
+	// Classify and attach the LICENSE file now that the jar's own artifact is resolved
+	// (it may have been added above from MANIFEST.MF / SHA-1 / file name).
+	p.attachFileLicenses(pkgs, fileProps.FilePath, licenseFile)
+
 	return pkgs, nil, nil
 }
 
@@ -219,40 +231,44 @@ func fillArchiveDigest(pkgs []ftypes.Package, r xio.ReadSeekerAt) error {
 }
 
 func (p *Parser) traverseZip(size int64, r xio.ReadSeekerAt, fileProps Properties) (
-	[]ftypes.Package, manifest, bool, error) {
+	[]ftypes.Package, manifest, bool, *zip.File, error) {
 	var pkgs []ftypes.Package
 	var m manifest
 	var foundPomProps bool
+	var licenseFiles []*zip.File
 
 	// Licenses declared in embedded META-INF/maven/<g>/<a>/pom.xml, keyed by "groupID:artifactID".
 	// The path carries no version, so packages are matched by G:A after the loop
 	// (file order in the zip is not guaranteed).
-	licenses := make(map[string][]string)
+	pomLicenses := make(map[string][]string)
 
 	zr, err := zip.NewReader(r, size)
 	if err != nil {
-		return nil, manifest{}, false, xerrors.Errorf("zip error: %w", err)
+		return nil, manifest{}, false, nil, xerrors.Errorf("zip error: %w", err)
 	}
 
 	for _, fileInJar := range zr.File {
-		// Collect licenses declared in the embedded META-INF/maven/<g>/<a>/pom.xml.
-		if groupID, artifactID, ok := embeddedPomGAV(fileInJar.Name); ok {
+		switch {
+		case filepath.Base(fileInJar.Name) == "pom.xml":
+			// Collect licenses declared in the embedded META-INF/maven/<g>/<a>/pom.xml.
+			groupID, artifactID, ok := embeddedPomGAV(fileInJar.Name)
+			if !ok {
+				break
+			}
 			names, err := parsePomLicenses(fileInJar)
 			if err != nil {
 				p.logger.Debug("Failed to parse licenses", log.String("file", fileInJar.Name), log.Err(err))
-				continue
+				break
 			}
 			if len(names) > 0 {
-				licenses[packageName(groupID, artifactID)] = names
+				pomLicenses[packageName(groupID, artifactID)] = names
 			}
-			continue
-		}
-
-		switch {
+		case isJarLicenseFile(fileInJar.Name):
+			licenseFiles = append(licenseFiles, fileInJar)
 		case filepath.Base(fileInJar.Name) == "pom.properties":
 			props, err := parsePomProperties(fileInJar, fileProps.FilePath)
 			if err != nil {
-				return nil, manifest{}, false, xerrors.Errorf("failed to parse %s: %w", fileInJar.Name, err)
+				return nil, manifest{}, false, nil, xerrors.Errorf("failed to parse %s: %w", fileInJar.Name, err)
 			}
 			// Validation of props to avoid getting packages with empty Name/Version
 			if props.Valid() {
@@ -266,7 +282,7 @@ func (p *Parser) traverseZip(size int64, r xio.ReadSeekerAt, fileProps Propertie
 		case filepath.Base(fileInJar.Name) == "MANIFEST.MF":
 			m, err = parseManifest(fileInJar)
 			if err != nil {
-				return nil, manifest{}, false, xerrors.Errorf("failed to parse MANIFEST.MF: %w", err)
+				return nil, manifest{}, false, nil, xerrors.Errorf("failed to parse MANIFEST.MF: %w", err)
 			}
 		case isArtifact(fileInJar.Name):
 			innerPkgs, _, err := p.parseInnerJar(fileInJar, fileProps.FilePath) // TODO process inner deps
@@ -279,18 +295,67 @@ func (p *Parser) traverseZip(size int64, r xio.ReadSeekerAt, fileProps Propertie
 	}
 
 	// Attach licenses from embedded pom.xml, matched by "groupID:artifactID".
+	attachPomLicenses(pkgs, pomLicenses)
+
+	var licenseFile *zip.File
+	if len(licenseFiles) == 1 {
+		licenseFile = licenseFiles[0]
+	}
+
+	return pkgs, m, foundPomProps, licenseFile, nil
+}
+
+// attachPomLicenses attaches licenses declared in embedded pom.xml files to packages,
+// matched by "groupID:artifactID". Packages that already have a license (e.g. set by a
+// nested jar from its own pom.xml) are left untouched.
+func attachPomLicenses(pkgs []ftypes.Package, pomLicenses map[string][]string) {
 	for i := range pkgs {
 		pkg := &pkgs[i]
-		// Keep licenses already set by a nested jar from its own pom.xml.
 		if len(pkg.Licenses) > 0 {
 			continue
 		}
-		if names, ok := licenses[pkg.Name]; ok {
+		if names, ok := pomLicenses[pkg.Name]; ok {
 			pkg.Licenses = names
 		}
 	}
+}
+
+// attachFileLicenses classifies the LICENSE file packed in a jar and attaches it to the
+// jar's own package, but only when the owner is unambiguous: a single LICENSE file, a
+// single package belonging to this jar, and no license from its pom.xml yet.
+func (p *Parser) attachFileLicenses(pkgs []ftypes.Package, filePath string, licenseFile *zip.File) {
+	if licenseFile == nil {
+		return
+	}
+
+	var pkg *ftypes.Package
 
-	return pkgs, m, foundPomProps, nil
+	for i := range pkgs {
+		if pkgs[i].FilePath != filePath {
+			continue
+		}
+		if pkg != nil {
+			return // more than one package belongs to this jar
+		}
+		pkg = &pkgs[i]
+	}
+
+	if pkg == nil {
+		return // no package belongs to this jar
+	}
+
+	if len(pkg.Licenses) > 0 {
+		return
+	}
+
+	names, err := p.classifyPackedLicense(licenseFile)
+	if err != nil {
+		p.logger.Debug("Failed to classify license file", log.FilePath(licenseFile.Name), log.Err(err))
+		return
+	}
+	if len(names) > 0 {
+		pkg.Licenses = names
+	}
 }
 
 func (p *Parser) parseInnerJar(zf *zip.File, rootPath string) ([]ftypes.Package, []ftypes.Dependency, error) {
@@ -463,6 +528,43 @@ func decodePomLicenses(r io.Reader) ([]string, error) {
 	return names, nil
 }
 
+// isJarLicenseFile reports whether a zip entry is a license file eligible for
+// classification: located at the jar root or directly under META-INF/ (not in a subdirectory),
+// with a base name whose stem is license/licence/copyright (e.g. LICENSE, LICENSE.txt).
+// Vendored licenses use prefixed names (e.g. FastDoubleParser-LICENSE) or nested
+// paths, so they are intentionally excluded.
+func isJarLicenseFile(name string) bool {
+	dir := path.Dir(name)
+	if dir != "." && dir != "META-INF" {
+		return false
+	}
+	base := path.Base(name)
+	if isArtifact(base) {
+		return false // e.g. license.jar is a nested archive, not a license file
+	}
+	stem := strings.TrimSuffix(base, path.Ext(base))
+	return licensing.LicenseFileNames.Contains(stem)
+}
+
+// classifyPackedLicense classifies a LICENSE file packed in a jar and returns the
+// detected license names.
+func (p *Parser) classifyPackedLicense(f *zip.File) ([]string, error) {
+	file, err := f.Open()
+	if err != nil {
+		return nil, xerrors.Errorf("unable to open %s: %w", f.Name, err)
+	}
+	defer file.Close()
+
+	lf, err := licensing.Classify(f.Name, file, p.licenseConfidenceLevel)
+	if err != nil {
+		return nil, xerrors.Errorf("license classification error: %w", err)
+	}
+	if lf == nil {
+		return nil, nil
+	}
+	return lf.Findings.Names(), nil
+}
+
 type manifest struct {
 	implementationVersion  string
 	implementationTitle    string