anchore / anchore/syft

[Request] Ability to customize top level metadata

Open
#3,397 2 comments 0 reactions 0 assignees View on GitHub
enhancement needs-investigation
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
23h 27m
Merged PRs (30d)
48

Description

**What would you like to be added**:

Users are looking to create SBOMs that meet the NTIA Minimum Fields requirements. Users typically do this through a two step process.
1. Generate an SBOM with syft
2. Augment it with additional top level data
- Who the top level component supplier is
- What license
- etc ...

This second step often requires a lot of custom scripting with `jq`, python or using a tool like [sbomasm](https://github.com/interlynk-io/sbomasm).

This feature request is to include a method to specify user defined top level metadata as options when calling syft or through a configuration file.

The files proposed are ...

- Document
- author
- supplier
- lifecycle
- Top Level Component
- author
- supplier
- name
- version
- description
- copyright
- repository
- cpe
- purl
- hash
- license

**Why is this needed**:

Most of the fields required for NTIA Minimum Field compliance need to be defined by the creator of the software product and there is no easy way for syft to discover their values. Allowing users to specify these field in a syft call reduces the steps required to create a "complete" SBOM.

**Additional context**:

This is a recommendation that originates from the CISA SBOM Generation Reference Implementation Tiger Team. Today https://github.com/interlynk-io/sbomasm is being used in the reference implementations.

CC/ @joshbressers

Contributor guide

Open the contributing guide

Research direction

The issue names no specific files, tests, or entry points. Start by locating syft's CLI and configuration handling, then identify the SBOM document and top-level component models for the listed metadata fields. Done means users can provide the requested values through a command invocation or configuration file and have them appear in generated SBOMs.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.