anchore / anchore/syft

[DOCS] Document your CycloneDX properties

Open
#3,497 3 comments 0 reactions 0 assignees View on GitHub
enhancement needs-research
Dominant language
Go
Stars
9.6k
Forks
962
Avg merge
23h 27m
Merged PRs (30d)
48

Description

**What would you like to be added**:

I would love to see a documentation of the CycloneDX property taxonomy used by `syft`.
Maybe I just missed it? At least it was not linked in the official registry

I guess, the documentation could be done in a regularly updated file in this repo, or even in this repo's [wiki](https://github.com/anchore/syft/wiki).

**Why is this needed**:

You have a CycloneDX property top-level namespace `syft` [registered](https://github.com/CycloneDX/cyclonedx-property-taxonomy/blob/c0a11edb4d51e200cc20cbe27a450ced546e3855/README.md?plain=1#L116). I did not find any documentation for it.
You are using own CycloneDX properties - see https://github.com/anchore/syft/blob/1af70d766d4ff2ad2ec8805847e60ad47c2676b8/syft/format/cyclonedxjson/test-fixtures/identify/1.6.json#L31-L55

To me, it is unclear when these properties are used, what they mean, and which ones exist in the first place.
It would help if I had a documentation for the `syft:` CycloneDX property taxonomy.

**Additional context**:

CycloneDX property taxonomy registry:

Contributor guide

Open the contributing guide

Research direction

Start with the referenced fixture at syft/format/cyclonedxjson/test-fixtures/identify/1.6.json and search the repository for the syft: properties it contains. Compare those properties with the CycloneDX property taxonomy registry and trace where each is used. Done means a maintained repository document or wiki page explains the existing syft: properties, their meanings, and when they are emitted.

Written by the indexing model from the issue text.

Assessment

Domain
documentation
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.