anchore / anchore/syft

Encapsulate all artifacts in syft JSON output

Open
#555 3 comments 2 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
23h 27m
Merged PRs (30d)
48

Description

Today we output a json structure similar to the following:
```
{
artifacts: [
# list of packages
],
relationships: [
# list of package relationships
]
distro: {...},
...
}
```

As we move forward and want to capture more kinds of artifacts we could consider moving to something closer to this:

```
{
artifacts: {
packages: [
# list of packages
],
files: [
# list of files
],
distro: {...},
# more artifact types...
},
relationships: [
# list of relationships for ANY artifact
],
...
}
```

In this way we can agnostically express all artifacts kinds without filling the root-level object up with new elements.

Contributor guide

Open the contributing guide

Research direction

The issue names no files, tests, or entry points. Start by locating the current JSON output schema and serialization path, then determine how package and file artifacts are represented. Done means artifact kinds are nested under an artifacts object while relationships remain able to reference any artifact.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.