-
Notifications
You must be signed in to change notification settings - Fork 748
Description
What would you like to be added:
A command to output more information on what a given cataloger can find, how it finds it, and what the output type (in the sbom) of a cataloger will be so I can easily answer "can Syft find thing X or not". Specifically, the biggest challenge is answering that question for binaries since some can be identified but it isn't generic and there isn't a clear list published anywhere.
Something like this even as simply as a comment/doc string for unstructured output:
syft cataloger list --details
| Cataloger | Findings Type | Comments |
-------------------------------------------------------------------------------------
| binary | binary | Can identify: curl, nginx, java, ruby,... binaries|
------------------------------------------------------------------------------------|
| rpm | rpm | Uses rpm-db metadata to identify installed rpms and dependency information|
........
There could be more structured formats for this kind of information or query options, but I think even just a mechanism where I can grep for the name of the binary I'm asking about. syft cataloger list --details | grep curl would be reasonable.
Why is this needed:
When investigating a "why isn't thing X found", it would be nice to use the tool itself to answer that question rather than looking at code. Documentation would be helpful too, but since there is a cataloger query interface in the tool already, it seems useful to use that to get more information on the entries already there.
Additional context:
Open to other UX options/opinions for how to present this and what can be presented as long as I can have a binary name and find out if there is support for finding that binary.
Metadata
Metadata
Assignees
Labels
Type
Projects
Status