fix: scan on windows not identifying jar file

[smirgel]

Description

When running cve-bin-tool on windows and producing an sbom, jar files seem not to be identified at all.

To reproduce

Steps to reproduce the behaviour:

1. Create new directory
2. Download a jar file, for examples this one: https://repo1.maven.org/maven2/org/apache/logging/log4j/log4j-core/2.24.3/log4j-core-2.24.3.jar
3. Run a scan and produce an sbom, for example: cve-bin-tool . --sbom-format json --sbom-type cyclonedx --sbom-output sbom-output.json

Expected behaviour:
Running the same scan on linux, the jar file is identified as:

    {
      "type": "library",
      "bom-ref": "2-log4j",
      "name": "log4j",
      "version": "2.24.3",
      "supplier": {
        "name": "apache"
      },
      "cpe": "cpe:/a:apache:log4j:2.24.3",
      "evidence": {
        "occurrences": [
          {
            "location": "/tmp/cve-bin-tool-lc9c7g5g/log4j-core-2.24.3.jar.extracted/META-INF/maven/org.apache.logging.log4j/log4j-core/pom.xml"
          }
        ]
      }
    }

Version/platform info

Version of CVE-bin-tool: 3.4
Installed from pypi or github? pypi
Operating system:

OS Name:                   Microsoft Windows Server 2022 Datacenter
OS Version:                10.0.20348 N/A Build 20348

Python version: 3.12.10

Anything else?

scan.log

[terriko]

Hm. that's a weird one. Since it's a windows-only issue I'd guess that it may have something to do with line endings not getting handled correctly (our most common windows issue) but it could be something about the extraction libraries available too.

[smirgel]

In the log I see:

DEBUG    cve_bin_tool.VersionScanner - Scanning file:                                                                                                     version_scanner.py:212
                    C:\ctmp\cve-bin-tool-mk87mlqh\log4j-core-2.24.3.jar.extracted\META-INF\maven\org.apache.logging.log4j\log4j-core\pom.xml

But I don't see the corresponding Done scanning file.

I'm looking at parsers/java.py but it's hard to understand what is going on without knowing the code base.

[terriko]

Moving this to the next release since we don't have any progress on it yet and we need to do a release soonish for other reasons.