anchore / anchore/syft

Support lossless conversion to any SBOM format

Open
#723 2 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
23h 27m
Merged PRs (30d)
48

Description

_This idea came from @samj1912 on a recent community meeting as well as a previous prototype._

Today we've started adding the ability to encode and decode from any SBOM format. However, not all fields are translatable from every format to every other format. The syft-json format contains all possible information that we can express and converting to SPDX or CycloneDX is usually lossy. This means when we start to implement the `syft convert` command in the future, there will be paths that would lead to information loss which are not apparent to the user.

We could keep extra information in all SBOM formats encoded out-of-band of the spec in select fields. For instance, in cyclone DX we could preserve most unsupported package fields within the `properties` of the package object. For SPDX we could encode the original unsupported fields into a comments field with bas64 encoding.

Something similar to this was done in the past as a prototype with SPDX json: https://github.com/anchore/syft/pull/578 We ended up not going that directing and keep as in-spec as possible.

Contributor guide

Open the contributing guide

Research direction

Start by reading the existing SBOM encode/decode paths and the planned `syft convert` entry point, then review the SPDX JSON prototype in PR 578. Define how unsupported fields would be retained across SPDX and CycloneDX conversions, with done meaning conversions no longer silently lose information.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli, devtools
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
28/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.