Support SBOM query and exploration
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 954
- Avg merge
- 23h 27m
- Merged PRs (30d)
- 48
Description
It would be interesting to add something that would allow you to answer simple questions about your SBOM document:
- "how many packages does it contain?"
- "are there any packages that contain 'libc' in the name?"
- "does the given file hash exist in the SBOM?"
- "are there any packages with zip files?"
Additionally it would be nice to also see basic summary information as well:
- "list all of my packages"
- "list all of my files"
Example CLI usage:
```
syft list packages ./sbom.json # list all packages
syft list files ./sbom.json # list all files
syft query 'package where name == "libc"' ./sbom.json
syft query 'package has file.name == "*.zip"' ./sbom.json
syft query ./sbom.json # interactive prompt if nothing is given
>
```
Implementation question: Inventing a query language seems complex. Is there an existing one that we could leverage more easily?
Contributor guide
Research direction
Start by reviewing the existing CLI entry points implied by `syft list` and `syft query`, along with how the SBOM represents packages and files. Compare existing query-language options before defining the query and interactive modes. Done means the project has an agreed query approach covering the listed package, file, count, and hash examples.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100