GeezerVison

LLM Description written by Claude Code:claude-opus-5-5

Prototype: socket scan create app.war (without --reach) now writes app.war.socket.facts.json next to the archive from the Maven metadata bundled in it, and uploads it with the scan. --reach on archives is out of scope; its design is still open.

How

• A small Java 8 loader (manifest/scripts/archive-loader) walks the archive and its nested archives with java.util.zip, without extracting them. It reads each META-INF/maven/*/*/pom.properties with java.util.Properties and emits records. The TS side (generate-archive-facts.mts) decides what they mean and assembles the facts.
• The jar is built like the Maven extension jar (pnpm run build:archive-loader, publish workflow). A published build fails closed without it.
• An archive target therefore needs Java 8+, from JAVA_HOME or PATH. Without it the scan fails, as a Maven build without mvn does.

Identification rules

• The archive is the project. Every library identified in it is a direct dependency (containment, as Syft reports it; Trivy emits no edges for jars).
• A nested archive is identified by the pom.properties whose coordinate its file name spells out: Trivy's rule, extended to classifiers, timestamped snapshots, wars and ears. Archives without a match are listed as unidentified. There is no SHA-1 or file-name lookup.
• Libraries shaded into the scanned archive itself are reported. Libraries bundled inside a dependency jar (shaded pom.properties, jars in jars) are not, until the SBOM schema can mark bundled libraries (REA-890).
• --exclude-paths applies. .gitignore and projectIgnorePaths do not hide an archive named as a target. The archive must be inside cwd.

Open questions

• A renamed archive (e.g. ROOT.war) cannot be matched to its own pom.properties. It becomes a generic project, and its own coordinate is reported as one of its dependencies.
• The facts file has no metadata: tool is limited to build tools, so stamping the CLI version needs a schema decision.
• The facts file stays next to the archive, so a later directory scan picks up a stale copy.
• Jars built without Maven metadata (Gradle, Ant) are not identified.

Verification

• Unit tests (record → facts rules) and an e2e test running the loader jar on generated archives.
• Facts for real war and jar artifacts from Maven Central pass depscan's parseSocketFacts with no validation alerts.
• The loader gives identical output on a Java 8 and a Java 21 runtime.

🤖 Generated with Claude Code