Inconsistent package name reported for some JAVA packages on multiple runs

[sakky016]

Description

I am running trivy to collect JAVA packages. For some JAR files, package name is reported differently on multiple runs. E.g:
Jar file: usr/local/tomcat/webapps/ROOT/WEB-INF/lib/boilerpipe-1.2.0-xwiki.jar
"Name": "com.syncthemall:boilerpipe"
"Version": "1.2.0-xwiki"

For most of the runs, the package name that get reported is com.syncthemall:boilerpipe. But sometimes I get below result:
Jar file: usr/local/tomcat/webapps/ROOT/WEB-INF/lib/boilerpipe-1.2.0-xwiki.jar
"Name": "de.l3s.boilerpipe::boilerpipe"
"Version": "1.2.0-xwiki"

Desired Behavior

Multiple runs should give consistent results, i.e same package name.

Actual Behavior

Most runs give package name as com.syncthemall:boilerpipe. On some runs, the reported package name is de.l3s.boilerpipe::boilerpipe.

Reproduction Steps

1. Scan imageX in online scan mode so that java files are analyzed. Unfortunately I cannot share the image name here.
2. Run step 1 several times. Keep checking the list of reported packages.
3. On some runs, the reported packages are a bit different. I've notices that the group ID for JAVA package is different across multiple runs.

Target

Container Image

Scanner

Vulnerability

Output Format

JSON

Mode

Standalone

Debug Output

./trivy image <#######> --scanners vuln --list-all-pkgs -f json

Operating System

Oracle Linux Server 7.9

Version

Version: 0.42.1
Vulnerability DB:
  Version: 2
  UpdatedAt: 2024-06-18 06:11:42.309175838 +0000 UTC
  NextUpdate: 2024-06-18 12:11:42.309175167 +0000 UTC
  DownloadedAt: 2024-06-18 11:22:20.709956279 +0000 UTC
Java DB:
  Version: 1
  UpdatedAt: 2024-05-29 01:02:42.771482943 +0000 UTC
  NextUpdate: 2024-06-01 01:02:42.771482773 +0000 UTC
  DownloadedAt: 2024-05-29 11:40:46.96976218 +0000 UTC

Checklist

• Run trivy image --reset
• Read the troubleshooting

[DmitriyLewen]

Hello @sakky016
Thanks for your report!

We have added several fixes for jar files.
Can you check this issue using the latest version of Trivy?

Regards, Dmitriy

[sakky016]

Thanks for your quick response @DmitriyLewen. I checked in v0.52.2, the package boilerpipe and the jar usr/local/tomcat/webapps/ROOT/WEB-INF/lib/boilerpipe-1.2.0-xwiki.jar is not even detected now.

I'm not sure what are the changes in latest w.r.t 0.42.1. Do you have list of changes that might be impacting jar collection?

[DmitriyLewen]

Take a look #6233 (comment)
Looks like this is same case