anchore / anchore/syft

Update "artifact" to "package" in output

Open
#417 0 comments 0 reactions 0 assignees View on GitHub
enhancement I/O
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
1d 5h
Merged PRs (30d)
42

Description

**Context:** The primary function of Syft is to report packages found in a given image or directory. `Package` is a central object throughout much of the Syft code. But in Syft's output ("presenter" logic), the package concept is referred to as an "artifact". (For example, in the JSON output, the first field of the root object is `artifacts`.)

**Requirement:** We can increase clarity and decrease confusion by updating instances of using "artifact" with "package".

**CAUTION:** This change will break several notable downstream consumers of Syft's data. As this change is made, it's vital that we coordinate with these consumers to minimize the breakage of our own tools. Here's a list, and **please add to this** if you know of another use of this data by **_Anchore's_** tools/apps.

Known uses of Syft data that would be impacted:

- Grype (SBOM input) (e.g. [here](https://github.com/anchore/grype/blob/f97f56b6d1edec72faf45b460a88eac8b9227305/grype/pkg/syft_json_provider.go#L74))
- Anchore Engine (image import) (e.g. [here](https://github.com/anchore/anchore-engine/blob/8b25aa65e64949f8d2edb06277356592dbf1fc1f/anchore_engine/services/apiext/swagger/swagger.yaml#L4989))
- Anchore Engine (analyzer mappers) (e.g. [here](https://github.com/anchore/anchore-engine/blob/8b25aa65e64949f8d2edb06277356592dbf1fc1f/anchore_engine/analyzers/syft/__init__.py#L71), terminology used throughout)
-

Contributor guide

Open the contributing guide

Research direction

Start by locating Syft's presenter logic and every output instance that uses "artifact" instead of "package". Review the linked Grype and Anchore Engine consumers before changing the output contract; done means the terminology is updated and downstream breakage is coordinated.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, security
Issue type
Refactor
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.