Repository navigation
Detect licenses from comments in embedded Maven POMs #5248
Description
What would you like to be added:
When scanning Fat/Uber JARs, Syft detects Java packages from embedded META-INF/maven/**/pom.xml files.
We have a case where the embedded POM does not contain a <licenses> element, but the license is clearly stated in the XML header comment (see http://www.apache.org/licenses/LICENSE-2.0 below).
Example: com.sun.xml.fastinfoset:FastInfoset:2.1.0
<!--
DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
Copyright (c) 2012, 2021 Oracle and/or its affiliates. All rights reserved.
Oracle licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
<parent>
<groupId>com.sun.xml.fastinfoset</groupId>
<artifactId>fastinfoset-project</artifactId>
<version>2.1.0</version>
<relativePath>../pom.xml</relativePath>
</parent>
<modelVersion>4.0.0</modelVersion>
<groupId>com.sun.xml.fastinfoset</groupId>
<artifactId>FastInfoset</artifactId>
<packaging>jar</packaging>
<version>2.1.0</version>
<name>fastinfoset</name>
<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-jar-plugin</artifactId>
<configuration>
<archive>
<manifest>
<addDefaultEntries>false</addDefaultEntries>
</manifest>
<manifestFile>${project.build.outputDirectory}/META-INF/MANIFEST.MF</manifestFile>
</archive>
</configuration>
</plugin>
<plugin>
<groupId>org.apache.felix</groupId>
<artifactId>maven-bundle-plugin</artifactId>
<configuration>
<instructions>
<Specification-Title>ITU-T Rec. X.891 | ISO/IEC 24824-1 (Fast Infoset)</Specification-Title>
<Specification-Version>1.0</Specification-Version>
<Implementation-Title>Fast Infoset Implementation</Implementation-Title>
<Implementation-Vendor>${vendor.name}</Implementation-Vendor>
<Implementation-Vendor-Id>${project.groupId}</Implementation-Vendor-Id>
<Extension-Name>com.sun.xml.fastinfoset</Extension-Name>
</instructions>
</configuration>
</plugin>
</plugins>
</build>
</project>The license is also available in the parent POM, but that parent POM is typically not embedded in the Fat JAR.
Syft can resolve the parent via Maven metadata, but this may require either a populated local Maven repository or network access. For self-contained/offline SBOM generation, this is undesirable.
Note: Maven Central seems to reject syft when using use-network: true, since we see this in the logs (TRACE level -vvv)
2026-09-03T13:45:07.1820936Z This tool has been identified as abusive and/or wasteful in the way it interacts with Maven Central. Use a caching proxy to limit your impact on the ecosystem. https://www.linkedin.com/feed/update/urn:li:activity:7456004385634992128/=== /home/runner/.cache/syft/java/maven/repo/v1/repo.maven.apache.org/maven2/com/sun/xml/fastinfoset/fastinfoset-project/2.1.0/fastinfoset-project-2.1.0.pom ===
Syft then is not able to lookup the parent pom from the local-maven-repo:
2026-09-03T13:45:04.7030011Z [0007] TRACE resolving expression: 'com.sun.xml.fastinfoset' in context: [0x305183ae44b0]
2026-09-03T13:45:04.7030424Z [0007] TRACE resolving expression: 'FastInfoset' in context: [0x305183ae44b0]
2026-09-03T13:45:04.7030790Z [0007] TRACE resolving expression: '2.1.0' in context: [0x305183ae44b0]
2026-09-03T13:45:04.7031160Z [0007] TRACE resolving expression: 'fastinfoset' in context: [0x305183ae44b0]
2026-09-03T13:45:04.7031715Z [0007] TRACE parsing pom.xml artifactID=FastInfoset name=fastinfoset path=META-INF/maven/com.sun.xml.fastinfoset/FastInfoset/pom.xml projectURL=
2026-09-03T13:45:04.7032307Z [0007] TRACE resolving expression: 'com.sun.xml.fastinfoset' in context: [0x305183ae44b0]
2026-09-03T13:45:04.7032749Z [0007] TRACE resolving expression: 'fastinfoset-project' in context: [0x305183ae44b0]
2026-09-03T13:45:04.7033147Z [0007] TRACE resolving expression: '2.1.0' in context: [0x305183ae44b0]
2026-09-03T13:45:04.7033535Z [0007] TRACE resolving expression: 'com.sun.xml.fastinfoset' in context: [0x305183ae44b0]
2026-09-03T13:45:04.7033943Z [0007] TRACE resolving expression: 'FastInfoset' in context: [0x305183ae44b0]
2026-09-03T13:45:04.7034312Z [0007] TRACE resolving expression: '2.1.0' in context: [0x305183ae44b0]
2026-09-03T13:45:04.7034700Z [0007] TRACE resolving expression: 'com.sun.xml.fastinfoset' in context: [0x305185484f00]
2026-09-03T13:45:04.7035133Z [0007] TRACE resolving expression: 'fastinfoset-project' in context: [0x305185484f00]
2026-09-03T13:45:04.7035514Z [0007] TRACE resolving expression: '2.1.0' in context: [0x305185484f00]
2026-09-03T13:45:04.7036670Z [0007] TRACE no cache entry for /home/runner/.cache/syft/java/maven/repo/v1 repo.maven.apache.org/maven2/com/sun/xml/fastinfoset/fastinfoset-project/2.1.0/fastinfoset-project-2.1.0.pom: open /home/runner/.cache/syft/java/maven/repo/v1/repo.maven.apache.org/maven2/com/sun/xml/fastinfoset/fastinfoset-project/2.1.0/fastinfoset-project-2.1.0.pom: no such file or directory
2026-09-03T13:45:04.7038042Z [0007] INFO fetching parent pom from remote maven repository url=https://repo.maven.apache.org/maven2/com/sun/xml/fastinfoset/fastinfoset-project/2.1.0/fastinfoset-project-2.1.0.pom
2026-09-03T13:45:04.7115774Z [0007] TRACE error attempting to resolve licenses error=unable to resolve pom com.sun.xml.fastinfoset fastinfoset-project 2.1.0: open /home/runner/.m2/repository/com/sun/xml/fastinfoset/fastinfoset-project/2.1.0/fastinfoset-project-2.1.0.pom: no such file or directory
2026-09-03T13:45:04.7118269Z pom for (groupId: com.sun.xml.fastinfoset artifactId: fastinfoset-project version: 2.1.0) not found in any remote repository: unable to parse pom from Maven repository url https://repo.maven.apache.org/maven2/com/sun/xml/fastinfoset/fastinfoset-project/2.1.0/fastinfoset-project-2.1.0.pom: unable to unmarshal pom.xml: EOF mavenID=(groupId: com.sun.xml.fastinfoset artifactId: FastInfoset version: 2.1.0)
Request
It would be useful if Syft could optionally inspect comments in Maven POM files for recognizable license information when no structured <licenses> metadata is available.
Possible sources could include:
- SPDX identifiers in comments
- well-known license names such as
Apache License, Version 2.0 - well-known license URLs such as
https://www.apache.org/licenses/LICENSE-2.0
Why is this needed:
This would improve license detection for dependencies embedded in Fat/Uber JARs without requiring network access or external Maven metadata.
Additional context:
Example fake uber.jar (in the zip): fake-uber.jar.zip
This contains a generated fake jar which could be useful for developing fix:
Maybe related: #4747
Activity