fix(java): set per-file digest for nested JARs

Nested JAR/WAR/EAR archives (e.g. libraries inside a Spring Boot repackaged JAR) were reported with the SHA-1 digest of the enclosing archive instead of their own file digest, because the digest was calculated once per scanned file and assigned to every package.

The jar parser now computes the SHA-1 of each (possibly nested) archive and stamps it onto the packages that belong to it, so every component carries the digest of its own file.

Author: DmitriyLewen

pkg/dependency/parser/java/jar/parse.go

@@ -4,8 +4,6 @@ import (
 	"archive/zip"
 	"bufio"
 	"context"
-	"crypto/sha1" // nolint:gosec
-	"encoding/hex"
 	"errors"
 	"io"
 	"os"
@@ -18,6 +16,7 @@ import (
 	mavenversion "github.com/masahiro331/go-mvn-version"
 	"golang.org/x/xerrors"
 
+	"github.com/aquasecurity/trivy/pkg/digest"
 	ftypes "github.com/aquasecurity/trivy/pkg/fanal/types"
 	"github.com/aquasecurity/trivy/pkg/log"
 	xio "github.com/aquasecurity/trivy/pkg/x/io"
@@ -38,6 +37,7 @@ type Parser struct {
 	logger       *log.Logger
 	rootFilePath string
 	offline      bool
+	checksum     bool
 	size         int64
 
 	client Client
@@ -57,6 +57,14 @@ func WithOffline(offline bool) Option {
 	}
 }
 
+// WithChecksum enables calculation of the SHA-1 digest for every archive
+// (not only the ones that are looked up by SHA-1) and saving it to Package.Digest.
+func WithChecksum(checksum bool) Option {
+	return func(p *Parser) {
+		p.checksum = checksum
+	}
+}
+
 func WithSize(size int64) Option {
 	return func(p *Parser) {
 		p.size = size
@@ -85,6 +93,25 @@ func (p *Parser) Parse(_ context.Context, r xio.ReadSeekerAt) ([]ftypes.Package,
 }
 
 func (p *Parser) parseArtifact(filePath string, size int64, r xio.ReadSeekerAt) ([]ftypes.Package, []ftypes.Dependency, error) {
+	pkgs, deps, err := p.parsePackages(filePath, size, r)
+	if err != nil {
+		return nil, nil, err
+	}
+
+	// When a checksum is requested, every package must carry the digest of its
+	// own file. Packages from nested archives (and the one resolved by
+	// searchBySHA1) already have it, so fill in this archive's digest only for
+	// the packages that are still missing one.
+	if p.checksum {
+		if err := fillArchiveDigest(pkgs, r); err != nil {
+			return nil, nil, xerrors.Errorf("unable to set digest for %s: %w", filePath, err)
+		}
+	}
+
+	return pkgs, deps, nil
+}
+
+func (p *Parser) parsePackages(filePath string, size int64, r xio.ReadSeekerAt) ([]ftypes.Package, []ftypes.Dependency, error) {
 	p.logger.Debug("Parsing Java artifacts...", log.FilePath(filePath))
 
 	// Try to extract artifactId and version from the file name
@@ -122,9 +149,9 @@ func (p *Parser) parseArtifact(filePath string, size int64, r xio.ReadSeekerAt)
 	}
 
 	// If groupId and artifactId are not found, call Maven Central's search API with SHA-1 digest.
-	props, err := p.searchBySHA1(r, filePath)
+	pkg, err := p.searchBySHA1(r, filePath)
 	if err == nil {
-		return append(pkgs, props.Package()), nil, nil
+		return append(pkgs, pkg), nil, nil
 	} else if !errors.Is(err, ArtifactNotFoundErr) {
 		return nil, nil, xerrors.Errorf("failed to search by SHA1: %w", err)
 	}
@@ -150,6 +177,29 @@ func (p *Parser) parseArtifact(filePath string, size int64, r xio.ReadSeekerAt)
 	return pkgs, nil, nil
 }
 
+// fillArchiveDigest sets the SHA-1 digest of the archive (r) on every package
+// that does not have a digest yet. The digest is calculated lazily, so the
+// archive is not read when all packages already carry their own digest.
+func fillArchiveDigest(pkgs []ftypes.Package, r xio.ReadSeekerAt) error {
+	var d digest.Digest
+	for i := range pkgs {
+		if pkgs[i].Digest != "" {
+			continue
+		}
+		if d == "" {
+			if _, err := r.Seek(0, io.SeekStart); err != nil {
+				return xerrors.Errorf("file seek error: %w", err)
+			}
+			var err error
+			if d, err = digest.CalcSHA1(r); err != nil {
+				return xerrors.Errorf("unable to calculate SHA-1: %w", err)
+			}
+		}
+		pkgs[i].Digest = d
+	}
+	return nil
+}
+
 func (p *Parser) traverseZip(filePath string, size int64, r xio.ReadSeekerAt, fileProps Properties) (
 	[]ftypes.Package, manifest, bool, error) {
 	var pkgs []ftypes.Package
@@ -231,22 +281,28 @@ func (p *Parser) parseInnerJar(zf *zip.File, rootPath string) ([]ftypes.Package,
 	return innerPkgs, innerDeps, nil
 }
 
-func (p *Parser) searchBySHA1(r io.ReadSeeker, filePath string) (Properties, error) {
+func (p *Parser) searchBySHA1(r io.ReadSeeker, filePath string) (ftypes.Package, error) {
 	if _, err := r.Seek(0, io.SeekStart); err != nil {
-		return Properties{}, xerrors.Errorf("file seek error: %w", err)
+		return ftypes.Package{}, xerrors.Errorf("file seek error: %w", err)
 	}
-
-	h := sha1.New() // nolint:gosec
-	if _, err := io.Copy(h, r); err != nil {
-		return Properties{}, xerrors.Errorf("unable to calculate SHA-1: %w", err)
+	d, err := digest.CalcSHA1(r)
+	if err != nil {
+		return ftypes.Package{}, xerrors.Errorf("unable to calculate SHA-1: %w", err)
 	}
-	s := hex.EncodeToString(h.Sum(nil))
-	prop, err := p.client.SearchBySHA1(s)
+
+	prop, err := p.client.SearchBySHA1(d.Encoded())
 	if err != nil {
-		return Properties{}, err
+		return ftypes.Package{}, err
 	}
 	prop.FilePath = filePath
-	return prop, nil
+
+	pkg := prop.Package()
+	// searchBySHA1 has already calculated the archive's SHA-1, so stamp it on the
+	// resolved package to avoid recalculating it in fillArchiveDigest.
+	if p.checksum {
+		pkg.Digest = d
+	}
+	return pkg, nil
 }
 
 func isArtifact(name string) bool {

pkg/fanal/analyzer/language/analyze.go

@@ -101,7 +101,11 @@ func toApplication(fileType types.LangType, filePath, libFilePath string, r xio.
 			pkgs[i].FilePath = libFilePath
 		}
 		pkgs[i].DependsOn = deps[pkg.ID]
-		pkgs[i].Digest = d
+		// Save the digest only if it has not been calculated for the package yet.
+		// For example, the digest for JAR files is calculated inside the parser.
+		if pkgs[i].Digest == "" {
+			pkgs[i].Digest = d
+		}
 		pkgs[i].Indirect = isIndirect(pkg.Relationship) // For backward compatibility
 	}
 

pkg/fanal/analyzer/language/java/jar/jar.go

@@ -57,8 +57,12 @@ func (a *javaLibraryAnalyzer) PostAnalyze(ctx context.Context, input analyzer.Po
 
 	// It will be called on each JAR file
 	onFile := func(path string, info fs.FileInfo, r xio.ReadSeekerAt) (*types.Application, error) {
-		p := jar.NewParser(client, jar.WithSize(info.Size()), jar.WithFilePath(path))
-		return language.ParsePackage(ctx, types.Jar, path, r, p, input.Options.FileChecksum)
+		p := jar.NewParser(client, jar.WithSize(info.Size()), jar.WithFilePath(path),
+			jar.WithChecksum(input.Options.FileChecksum))
+		// The jar parser calculates a per-file digest for every (possibly nested)
+		// artifact itself, so language.ParsePackage must not overwrite them with
+		// the enclosing archive's digest.
+		return language.ParsePackage(ctx, types.Jar, path, r, p, false)
 	}
 
 	var apps []types.Application

pkg/fanal/analyzer/language/java/jar/jar_test.go

@@ -79,6 +79,47 @@ func Test_javaLibraryAnalyzer_Analyze(t *testing.T) {
 			},
 		},
 		{
+			// The top-level WAR and each inner JAR must have the digest of
+			// their own file, not the digest of the enclosing WAR.
+			// `repackaged-app` is the WAR itself (resolved via its pom.properties),
+			// `inner-lib-1.2.3.jar` is resolved via its pom.properties,
+			// `tomcat-embed-websocket-9.0.65.jar` is resolved by SHA-1 in trivy-java-db.
+			// cf. https://github.com/aquasecurity/trivy/discussions/10847
+			name:            "happy path (repackaged WAR with checksum)",
+			inputFile:       "testdata/repackaged.war",
+			includeChecksum: true,
+			want: &analyzer.AnalysisResult{
+				Applications: []types.Application{
+					{
+						Type:     types.Jar,
+						FilePath: "testdata/repackaged.war",
+						Packages: types.Packages{
+							{
+								Name:     "com.example:repackaged-app",
+								FilePath: "testdata/repackaged.war",
+								Version:  "2.0.0",
+								Digest:   "sha1:5ea8e9906f162e5287e788cf464ec96a8a815bcc",
+							},
+							{
+								Name:     "com.example:inner-lib",
+								FilePath: "testdata/repackaged.war/WEB-INF/lib/inner-lib-1.2.3.jar",
+								Version:  "1.2.3",
+								Digest:   "sha1:a22f48b888dd3b7ed9f6fea047e968479eac736f",
+							},
+							{
+								Name:     "org.apache.tomcat.embed:tomcat-embed-websocket",
+								FilePath: "testdata/repackaged.war/WEB-INF/lib/tomcat-embed-websocket-9.0.65.jar",
+								Version:  "9.0.65",
+								Digest:   "sha1:bd70dfeb39cc83c6934be24fa377b21e541dbe76",
+							},
+						},
+					},
+				},
+			},
+		},
+		{
+			// The PAR itself (resolved via its pom.properties) and the nested
+			// `jackson-core` JAR must each carry the digest of their own file.
 			name:            "happy path (PAR file)",
 			inputFile:       "testdata/test.par",
 			includeChecksum: true,
@@ -88,11 +129,17 @@ func Test_javaLibraryAnalyzer_Analyze(t *testing.T) {
 						Type:     types.Jar,
 						FilePath: "testdata/test.par",
 						Packages: types.Packages{
+							{
+								Name:     "com.example:par-app",
+								FilePath: "testdata/test.par",
+								Version:  "3.0.0",
+								Digest:   "sha1:bdce3e13cc5d39960ab7f7644ae24d82becd2ba2",
+							},
 							{
 								Name:     "com.fasterxml.jackson.core:jackson-core",
 								FilePath: "testdata/test.par/lib/jackson-core-2.9.10.jar",
 								Version:  "2.9.10",
-								Digest:   "sha1:d40913470259cfba6dcc90f96bcaa9bcff1b72e0",
+								Digest:   "sha1:66b715dec9dd8b0f39f3296e67e05913bf422d0c",
 							},
 						},
 					},