anchore / anchore/syft

Support SBOM query and exploration

Open
#564 4 comments 5 reactions 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
23h 27m
Merged PRs (30d)
48

Description

It would be interesting to add something that would allow you to answer simple questions about your SBOM document:
- "how many packages does it contain?"
- "are there any packages that contain 'libc' in the name?"
- "does the given file hash exist in the SBOM?"
- "are there any packages with zip files?"

Additionally it would be nice to also see basic summary information as well:
- "list all of my packages"
- "list all of my files"

Example CLI usage:

```
syft list packages ./sbom.json # list all packages
syft list files ./sbom.json # list all files

syft query 'package where name == "libc"' ./sbom.json
syft query 'package has file.name == "*.zip"' ./sbom.json

syft query ./sbom.json # interactive prompt if nothing is given
>
```

Implementation question: Inventing a query language seems complex. Is there an existing one that we could leverage more easily?

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the existing CLI entry points implied by `syft list` and `syft query`, along with how the SBOM represents packages and files. Compare existing query-language options before defining the query and interactive modes. Done means the project has an agreed query approach covering the listed package, file, count, and hash examples.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.