Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Command output to give more information on what catalogers look for and what they can find #4155

@zhill

Description

@zhill

What would you like to be added:
A command to output more information on what a given cataloger can find, how it finds it, and what the output type (in the sbom) of a cataloger will be so I can easily answer "can Syft find thing X or not". Specifically, the biggest challenge is answering that question for binaries since some can be identified but it isn't generic and there isn't a clear list published anywhere.

Something like this even as simply as a comment/doc string for unstructured output:

syft cataloger list --details
| Cataloger        |  Findings Type            |  Comments                                                         |
-------------------------------------------------------------------------------------
| binary              | binary                          | Can identify: curl, nginx, java, ruby,... binaries|
------------------------------------------------------------------------------------|
| rpm                  | rpm                              | Uses rpm-db metadata to identify installed rpms and dependency information|
........

There could be more structured formats for this kind of information or query options, but I think even just a mechanism where I can grep for the name of the binary I'm asking about. syft cataloger list --details | grep curl would be reasonable.

Why is this needed:
When investigating a "why isn't thing X found", it would be nice to use the tool itself to answer that question rather than looking at code. Documentation would be helpful too, but since there is a cataloger query interface in the tool already, it seems useful to use that to get more information on the entries already there.

Additional context:
Open to other UX options/opinions for how to present this and what can be presented as long as I can have a binary name and find out if there is support for finding that binary.

Metadata

Metadata

Assignees

Labels

enhancementNew feature or request

Type

No type

Projects

Status

Done

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions