Improve the performance of scanning a large number of jars

[jasinner]

The hashes are not of a file, but of normalized classes. I can understand the motivation behind it. However, what we also need is a possibility to identify a .jar with a vulnerability very quickly. Imagine we have apps that have around 1 GB of Java classes. Normalizing these would take quite a long time. We need to be able to do just the checksum of a file and say "this is the X library and contains CVE ###, fixed in version Y.

[gcmurphy]

My memory is a little foggy on this but I'm pretty sure that victim-lib does that under the covers Maybe @abn can remember ?