Skip to content

Syft command restructure #516

@spiffcs

Description

@spiffcs

What would you like to be added:

Currently syft's root and packages commands produce the same package specific output:
syft packages node:latest > /dev/null
syft node:latest > /dev/null

Screen Shot 2021-09-27 at 11 06 10 AM

syft also has a power-user command which produces a more verbose output concerning packages, secrets, file metadata file-digests:
syft power-use node:latest > /dev/null

Screen Shot 2021-09-27 at 11 09 39 AM

I believe the syft [noun] pattern is not the space where we want to be focusing development moving forward.

Given that syft is concerned with sbom generation, I propose we look to move our command structure towards syft [verb], starting with syft create or syft describe in order to generate an sbom.

The goal of this command API change follows improving a few key points.

  1. Our current path of coupling presenter/noun logic and structures will lead to a good bit of unmanageable code sprawl. We can already see here that the poweruser config struct has a host of VERY specific and useful information that only it has access to. Rather than reimplement/confuse these structures for each noun we should look to shift them lower in the program so presenters interpret all possible SBOM entities the same way.

    type JSONDocumentConfig struct {
    ApplicationConfig config.Application
    PackageCatalog *pkg.Catalog
    FileMetadata map[source.Location]source.FileMetadata
    FileDigests map[source.Location][]file.Digest
    FileClassifications map[source.Location][]file.Classification
    FileContents map[source.Location]string
    Secrets map[source.Location][]file.SearchResult
    Distro *distro.Distro
    SourceMetadata source.Metadata
    }

  2. As we move into wanting to describe more SBOM entities, code paths like presenter/secrets presenter/files presenter/relationships just do not scale into the user behavior or usefulness we want for the tool. syft create should already do analysis for the different entities with sane defaults and a config input that can increase/decrease the entities analyzed for the command.

  3. Refocus presenter to be presenter/spdx presenter/json presenter/cyclonedx. Formats as described previously should not be children of nouns like packages. The current program architecture does just this syft/internal/presenter/packages/spdx.go,json_pacakge.go,table,etc. Refactoring to syft [verb] -o [presenter] allows us much more space to design common logic/structures when dealing with different SBOM entities.

Why is this needed:
Remove formal sbom entity semantics from command API to refocus program on its main directive of generating sbom.

Additional context:
TODO

Metadata

Metadata

Assignees

Labels

changelog-ignoreDon't include this issue in the release changelogenhancementNew feature or request

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions