-
Couldn't load subscription status.
- Fork 727
Description
Syft can output multiple SBOM formats, however, once you have that format you can't convert to another format. This could be most useful if you have a syftjson formatted document and you want to produce SPDX (which should be lossless). In these cases something like this would be nice:
syft my-image:latest -o json > original.json
syft convert original.json --to spdx > original.spdx
syft convert original.json --to cyclonedx > original-cyclonedx.xml
It's not clear what to do in cases where there is potentially lossy behavior (e.g. convert from cyclonedx to syftjson):
- Warn the user that this is a lossy conversion and continue
- Stop the conversation (possibly bypass with
--forceor similar option) - Do nothing --this is an end user concern (I feel that this is not a good option)
- Possibly guarantee non-lossy behavior by including all additional (not in specification) fields into all document formats (there is a heavy pro, and several cons)
One question that comes to mind: do we want to restrict these conversions to only documents that syft created to begin with? Or be able to generically convert between formats for a document that was generated from another (non-syft) tool? (does thing bring on more complexity? or not?... if so, how much?)