Support to stack multiple Syft SBOM files into a single one
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 954
- Avg merge
- 23h 27m
- Merged PRs (30d)
- 48
Description
**What would you like to be added**:
CycloneDX supports merging multiple SBOM files into a single one. However Syft SBOM does not support merging multiple Syft SBOM files. One way could be done by manual merging the artifacts however that is limited to SBOM files whose `distro` is the same for all the different files.
We would like that Syft SBOM can be merged into a single one without lacking of accuracy to identify vulnerabilities.
**Why is this needed**:
We generate a bundle and store it in a registry, but the artifacts linked to that bundle are composed of multiple SBOMS from each component that forms that bundle. When using CycloneDX, those SBOM files can be merged into one without losing accuracy to identify vulnerabilities. This can be achieved because the `purl` contains the arch (or distro) injected into the value. We would like to find a solution to satisfy the same scenario with Syft SBOM format.
**Additional context**:
Contributor guide
Research direction
Start by comparing the requested Syft SBOM merge behavior with the CycloneDX approach described in the issue, focusing on artifacts, distro differences, and purl values. The work is done when multiple Syft SBOM files can be combined without losing accuracy when identifying vulnerabilities; the issue does not name files, tests, or an entry point.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100