[Request] Ability to customize top level metadata
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 954
- Avg merge
- 23h 27m
- Merged PRs (30d)
- 48
Description
**What would you like to be added**:
Users are looking to create SBOMs that meet the NTIA Minimum Fields requirements. Users typically do this through a two step process.
1. Generate an SBOM with syft
2. Augment it with additional top level data
- Who the top level component supplier is
- What license
- etc ...
This second step often requires a lot of custom scripting with `jq`, python or using a tool like [sbomasm](https://github.com/interlynk-io/sbomasm).
This feature request is to include a method to specify user defined top level metadata as options when calling syft or through a configuration file.
The files proposed are ...
- Document
- author
- supplier
- lifecycle
- Top Level Component
- author
- supplier
- name
- version
- description
- copyright
- repository
- cpe
- purl
- hash
- license
**Why is this needed**:
Most of the fields required for NTIA Minimum Field compliance need to be defined by the creator of the software product and there is no easy way for syft to discover their values. Allowing users to specify these field in a syft call reduces the steps required to create a "complete" SBOM.
**Additional context**:
This is a recommendation that originates from the CISA SBOM Generation Reference Implementation Tiger Team. Today https://github.com/interlynk-io/sbomasm is being used in the reference implementations.
CC/ @joshbressers
Contributor guide
Research direction
The issue names no specific files, tests, or entry points. Start by locating syft's CLI and configuration handling, then identify the SBOM document and top-level component models for the listed metadata fields. Done means users can provide the requested values through a command invocation or configuration file and have them appear in generated SBOMs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100