-
Notifications
You must be signed in to change notification settings - Fork 792
Description
What would you like to be added:
Currently syft's root and packages commands produce the same package specific output:
syft packages node:latest > /dev/null
syft node:latest > /dev/null
syft also has a power-user command which produces a more verbose output concerning packages, secrets, file metadata file-digests:
syft power-use node:latest > /dev/null
I believe the syft [noun] pattern is not the space where we want to be focusing development moving forward.
Given that syft is concerned with sbom generation, I propose we look to move our command structure towards syft [verb], starting with syft create or syft describe in order to generate an sbom.
The goal of this command API change follows improving a few key points.
-
Our current path of coupling
presenter/nounlogic and structures will lead to a good bit of unmanageable code sprawl. We can already see here that thepoweruserconfig struct has a host of VERY specific and useful information that only it has access to. Rather than reimplement/confuse these structures for eachnounwe should look to shift them lower in the program so presenters interpret all possible SBOM entities the same way.
syft/internal/presenter/poweruser/json_document_config.go
Lines 11 to 21 in e5caba0
type JSONDocumentConfig struct { ApplicationConfig config.Application PackageCatalog *pkg.Catalog FileMetadata map[source.Location]source.FileMetadata FileDigests map[source.Location][]file.Digest FileClassifications map[source.Location][]file.Classification FileContents map[source.Location]string Secrets map[source.Location][]file.SearchResult Distro *distro.Distro SourceMetadata source.Metadata } -
As we move into wanting to describe more SBOM entities, code paths like
presenter/secretspresenter/filespresenter/relationshipsjust do not scale into the user behavior or usefulness we want for the tool.syft createshould already do analysis for the different entities with sane defaults and a config input that can increase/decrease the entities analyzed for the command. -
Refocus presenter to be
presenter/spdxpresenter/jsonpresenter/cyclonedx. Formats as described previously should not be children of nouns likepackages. The current program architecture does just thissyft/internal/presenter/packages/spdx.go,json_pacakge.go,table,etc. Refactoring tosyft [verb] -o [presenter]allows us much more space to design common logic/structures when dealing with different SBOM entities.
Why is this needed:
Remove formal sbom entity semantics from command API to refocus program on its main directive of generating sbom.
Additional context:
TODO

