ZIP support for rootfs

[tetzla]

Description

Hello,

I'm creating SBOMs via rootfs. JARs, WARs and EARs are automatically and recursively searched/unpacked. ZIPs, on the other hand, are skipped/ignored. Is this behavior intentional or this a bug?

Regards, Aline

Target

SBOM

Scanner

None

[knqyf263]

Do you mean ZIP for Java archives?

[tetzla]

No, just ZIPs (see attached example for reproduction).

I have to create SBOMs for deep nested directory structures containing ZIPs, EARs, WARs and JARs. These archives are often nested within each other (e.g. ZIP in ZIP, JAR in ZIP,...). At the beginning, I didn't even notice that ZIP files were being skipped, since there is no appropriate log message.

It would be nice if Trivy includes the contents of ZIP files when creating an SBOM.

wildfly-quickstart.zip