anchore / anchore/syft

Allow scanning sub dir within a larger search context

Open
#3,213 1 comment 3 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
23h 27m
Merged PRs (30d)
48

Description

**What would you like to be added**:
We have multiple issues that want to be able to search within a small space, but reference things outside of that space:
- https://github.com/anchore/syft/issues/2574
- https://github.com/anchore/syft/issues/3145 (for performance reasons)
- https://github.com/anchore/syft/issues/3207
- #3345

It would be nice to allow for something like this:
```
syft ./my/dir/project-1 --reference ./my/dir
```

Were I only want to catalog packages within `./my/dir/project-1 ` but I want to be able to reference file system material from a specific parent directory `./my/dir`

In this way if there is a pom.xml in the project dir but the parent pom has required properties, we can reference that material to get the correct version. This applies to any ecosystem where manifests can reference other manifests in parent directories for correct resolution.

Today we have the `--exclude` flag to tailor the search space, but this doesn't help in a large set of cases (and may result in cumbersome number of flags or brittle configuration).

Contributor guide

Open the contributing guide

Research direction

Start by tracing the CLI handling for the scan path and existing --exclude option, then follow how manifest references are resolved across parent directories. Define the change around the --reference example: catalog only the requested subdirectory while allowing referenced material from the parent; done means parent manifests can supply resolution data without expanding the catalog scope.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.