Support lossless conversion to any SBOM format
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 954
- Avg merge
- 23h 27m
- Merged PRs (30d)
- 48
Description
_This idea came from @samj1912 on a recent community meeting as well as a previous prototype._
Today we've started adding the ability to encode and decode from any SBOM format. However, not all fields are translatable from every format to every other format. The syft-json format contains all possible information that we can express and converting to SPDX or CycloneDX is usually lossy. This means when we start to implement the `syft convert` command in the future, there will be paths that would lead to information loss which are not apparent to the user.
We could keep extra information in all SBOM formats encoded out-of-band of the spec in select fields. For instance, in cyclone DX we could preserve most unsupported package fields within the `properties` of the package object. For SPDX we could encode the original unsupported fields into a comments field with bas64 encoding.
Something similar to this was done in the past as a prototype with SPDX json: https://github.com/anchore/syft/pull/578 We ended up not going that directing and keep as in-spec as possible.
Contributor guide
Research direction
Start by reading the existing SBOM encode/decode paths and the planned `syft convert` entry point, then review the SPDX JSON prototype in PR 578. Define how unsupported fields would be retained across SPDX and CycloneDX conversions, with done meaning conversions no longer silently lose information.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, devtools
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 28/100