Compare two SBOMs
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 962
- Avg merge
- 23h 27m
- Merged PRs (30d)
- 48
Description
It would be interesting to enable the ability to provide a previous SBOM result and natively "diff" the results without having to result in scripting. Something like:
```
syft -o json my-image:latest > sbom-1.json
# ... time passes ...
syft -o json my-image:latest > sbom-2.json
# what are the differences between these two SBOMs?
syft diff sbom-1.json sbom-2.json
Packages added:
- package name 1 (java)
- package name 2 (java)
Packages removed:
- package name 3 (python)
Packages changed:
- package name 4 (ruby)
```
The output should probably support both a summary and JSON output formats, the example output format is only for illustration.
In this way a user can get a feeling for what's changing across your product SBOM overtime.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No implementation files, tests, or entry points are named. Start by tracing Syft’s CLI command structure and SBOM output handling; done means comparing two SBOM results with added, removed, and changed packages, supporting both summary and JSON output.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100