Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Support format SBOM conversion #563

@wagoodman

Description

@wagoodman

Syft can output multiple SBOM formats, however, once you have that format you can't convert to another format. This could be most useful if you have a syftjson formatted document and you want to produce SPDX (which should be lossless). In these cases something like this would be nice:

syft my-image:latest -o json > original.json
syft convert original.json --to spdx > original.spdx
syft convert original.json --to cyclonedx > original-cyclonedx.xml

It's not clear what to do in cases where there is potentially lossy behavior (e.g. convert from cyclonedx to syftjson):

  • Warn the user that this is a lossy conversion and continue
  • Stop the conversation (possibly bypass with --force or similar option)
  • Do nothing --this is an end user concern (I feel that this is not a good option)
  • Possibly guarantee non-lossy behavior by including all additional (not in specification) fields into all document formats (there is a heavy pro, and several cons)

One question that comes to mind: do we want to restrict these conversions to only documents that syft created to begin with? Or be able to generically convert between formats for a document that was generated from another (non-syft) tool? (does thing bring on more complexity? or not?... if so, how much?)

Metadata

Metadata

Assignees

Labels

enhancementNew feature or request

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions