It is possible for a JAR file to start off with a bash script, instead of the normal ZIP header. Claircore does not allow this, though, and it always checks for the header.

The Go standard library accounts for this, so we should just try to open it with the standard library and let it decide if it's a valid ZIP or not.