Add support for java "nar" files

[ZENinjaneer]

https://github.com/anchore/syft/blob/b20310eaf847c259beb4fe5128c842bd8aa4d4fc/syft/pkg/cataloger/java/archive_filename.go#L111

could you please add "nar" to this case statement so it can support grype scanning NiFi nars?

[wagoodman]

curious! is a nar just a jar? That is, is it the same metadata (like with war, ear, etc) just with a different name? Or is there more metadata to parse?

[ZENinjaneer]

A nar is basically a shaded jar. It's very similar to a WAR but instead of a WEB-INF the root is META-INF (like in a JAR). Under the META-INF there are other text files that essentially have to do with licensing. A short and sweet overview can be found here: https://medium.com/hashmapinc/nifi-nar-files-explained-14113f7796fd

[tgerla]

Thanks for the details! I think this would be a reasonable addition to the list of archive filenames. We will add this to our backlog but please let us know if you want to submit a pull request yourself--we can help you through the process if you need.

We think the only things that need to change are a new glob for .nar files here:

https://github.com/anchore/syft/blob/b20310eaf847c259beb4fe5128c842bd8aa4d4fc/syft/pkg/cataloger/java/archive_parser.go#L22

And in the list here:

https://github.com/anchore/syft/blob/b20310eaf847c259beb4fe5128c842bd8aa4d4fc/syft/pkg/cataloger/java/archive_filename.go#L111

[shanedell]

@tgerla Could I tackle this? If @ZENinjaneer doesn't plan to of course

[wagoodman]

@Shanedell have at it!