anchore / anchore/syft

Support to stack multiple Syft SBOM files into a single one

Open
#617 18 comments 6 reactions 0 assignees View on GitHub
blocked enhancement multiple-sources
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
23h 27m
Merged PRs (30d)
48

Description

**What would you like to be added**:
CycloneDX supports merging multiple SBOM files into a single one. However Syft SBOM does not support merging multiple Syft SBOM files. One way could be done by manual merging the artifacts however that is limited to SBOM files whose `distro` is the same for all the different files.

We would like that Syft SBOM can be merged into a single one without lacking of accuracy to identify vulnerabilities.

**Why is this needed**:

We generate a bundle and store it in a registry, but the artifacts linked to that bundle are composed of multiple SBOMS from each component that forms that bundle. When using CycloneDX, those SBOM files can be merged into one without losing accuracy to identify vulnerabilities. This can be achieved because the `purl` contains the arch (or distro) injected into the value. We would like to find a solution to satisfy the same scenario with Syft SBOM format.

**Additional context**:

Contributor guide

Open the contributing guide

Research direction

Start by comparing the requested Syft SBOM merge behavior with the CycloneDX approach described in the issue, focusing on artifacts, distro differences, and purl values. The work is done when multiple Syft SBOM files can be combined without losing accuracy when identifying vulnerabilities; the issue does not name files, tests, or an entry point.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.