# Corretly identifying jar file with only pom.xml **URL:** \ **Category:** Syft\ **Created:** [October 2, 2025, 8:42pm UTC](https://anchorecommunity.discourse.group/t/corretly-identifying-jar-file-with-only-pom-xml/573 "2025-10-02T20:42:29Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![douglasclarke](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/douglasclarke/32/364_2.png) [@douglasclarke](https://anchorecommunity.discourse.group/u/douglasclarke)\ **Post date:** [October 2, 2025, 8:42pm UTC](https://anchorecommunity.discourse.group/t/corretly-identifying-jar-file-with-only-pom-xml/573/1 "2025-10-02T20:42:29Z")
I have seen a couple of somewhat related issues but wanted to ask specifically. As best I can read the java archive parser it looks for pom.properties and pom.xml and only uses the pom.xml (project) if the properties file exists and aligns. I many of the io.micronaut jar files there is only a pom.xml and the manfest entries lead to wrong group id being used. I took a stab at a fix but really struggling with getting a test case to pass and it does feel very specific to a single pom.xml when there are also uber jars with many pom.xml files indicating the combined contents. > > > …om.properties file > > Regression test added but not working - need assistance > … > \# Description > > Please include a summary of the changes along with any relevant motivation and context, > or link to an issue where this is explained. > > > > \- Fixes > > \## Type of change > > > > \- \[\] Bug fix (non-breaking change which fixes an issue) > \- \[\] New feature (non-breaking change which adds functionality) > \- \[\] Breaking change (please discuss with the team first; Syft is 1.0 software and we won't accept breaking changes without going to 2.0) > \- \[\] Documentation (updates the documentation) > \- \[\] Chore (improve the developer experience, fix a test flake, etc, without changing the visible behavior of Syft) > \- \[\] Performance (make Syft run faster or use less memory, without changing visible behavior much) > > \# Checklist: > > \- \[\] I have added unit tests that cover changed behavior > \- \[\] I have tested my code in common scenarios and confirmed there are no regressions > \- \[\] I have added comments to my code, particularly in hard-to-understand sections Just looking for guidance. I did also look at syft/pkg/cataloger/internal/cpegenerate/java\_groupid\_map.go but believe processing the xml is better then adding hundreds entries to that map. ---
**Author:** ![kzantow](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/kzantow/32/17_2.png) [@kzantow](https://anchorecommunity.discourse.group/u/kzantow)\ **Post date:** [October 6, 2025, 6:06pm UTC](https://anchorecommunity.discourse.group/t/corretly-identifying-jar-file-with-only-pom-xml/573/2 "2025-10-06T18:06:22Z")
Hey @douglasclarke 👋, Just so I understand, the problem you’re encountering: a JAR file with a `pom.xml` present but a `pom.properties` _not_ present, you are having trouble getting a test case recognizing the jar, but your testing seems to have correct behavior when running syft directly? I agree we should use `pom.xml` if that’s the only thing we find. ---
**Author:** ![douglasclarke](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/douglasclarke/32/364_2.png) [@douglasclarke](https://anchorecommunity.discourse.group/u/douglasclarke)\ **Post date:** [October 7, 2025, 11:22am UTC](https://anchorecommunity.discourse.group/t/corretly-identifying-jar-file-with-only-pom-xml/573/3 "2025-10-07T11:22:39Z")
That is it. My test of the fix identifies correctly but I believe I need some additional work to have the pom.xml captured as the metadata data used for identification. ---
**Author:** ![douglasclarke](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/douglasclarke/32/364_2.png) [@douglasclarke](https://anchorecommunity.discourse.group/u/douglasclarke)\ **Post date:** [October 7, 2025, 10:37pm UTC](https://anchorecommunity.discourse.group/t/corretly-identifying-jar-file-with-only-pom-xml/573/4 "2025-10-07T22:37:59Z")
made some progress with a potential fix and tests running PR: [Proposed fix for identifying jar files with a single pom.xml and no p… by douglasclarke · Pull Request #8 · douglasclarke/syft · GitHub](https://github.com/douglasclarke/syft/pull/8) Bug report: [jar parsing does not use pom.xml when pom.properties is missing · Issue #4260 · anchore/syft · GitHub](https://github.com/anchore/syft/issues/4260) ---
**Author:** ![system](https://global.discourse-cdn.com/free1/uploads/anchorecommunity/original/1X/b871ec64f30d7ccc67399c1d430b97e12416b9e1.png) [@system](https://anchorecommunity.discourse.group/u/system)\ **Post date:** [March 6, 2026, 2:32am UTC](https://anchorecommunity.discourse.group/t/corretly-identifying-jar-file-with-only-pom-xml/573/5 "2026-03-06T02:32:40Z")
---
**Author:** ![system](https://global.discourse-cdn.com/free1/uploads/anchorecommunity/original/1X/b871ec64f30d7ccc67399c1d430b97e12416b9e1.png) [@system](https://anchorecommunity.discourse.group/u/system)\ **Post date:** [March 9, 2026, 12:56pm UTC](https://anchorecommunity.discourse.group/t/corretly-identifying-jar-file-with-only-pom-xml/573/6 "2026-03-09T12:56:48Z")