-
Couldn't load subscription status.
- Fork 727
Description
Today the package command is a single task that is responsible for invoking all of the package catalogers and returning a presenter capable of encoding an SBOM in a particular format.
At the same time, the power-user command can enable and disable different catalogers and format the SBOM document more dynamically. Internally the power-user command is made of a set of tasks that is dynamic based on the configuration. Additionally, all tasks write to a single result document instance, encapsulating all possible things that can be cataloged.
There are elements of the internal power-user command approach that would be ideal to promote forward as patterns we want to see on the package command (or any command that will do cataloging in the future).
Goals:
- Have a singular analysis result document to encapsulate all things discovered. Possibly a new
sbompackage with a struct calledDocument. (tracked in Encapsulate all artifacts in syft JSON output #555) - Move towards a task-based approach for separating work and attaching the result to the analysis document
These goals focus on how the work of cataloging is completed and persisting in a programmatic way that is useful to others.