Print table view when generating output file

anchore / sbom-action

GitHub Action for creating software bill of materials using Syft.

Apache License 2.0

161 stars 28 forks source link

Print table view when generating output file #46

Open kzantow opened 2 years ago

kzantow commented 2 years ago

There is currently no support in Syft for this but it can be accomplished by executing multiple times. This is less than ideal, as scans have the potential to be slow. Once Syft has some support, we can look at adding this to sbom-action.

See:

wagoodman commented 2 years ago

From refinement:

Always output the syft json format, additionally allow other outputs (defaulting to today's behavior of outputting SPDX json). This will help to enable grype scanning (with high efficiency) between the sbom-action and the scan-action.

jonasagx commented 2 years ago

After a talk with @kzantow I learned this issue was made to allow the generation of syft json AND spdx files, the former meant for vulnerability scanning, the latter for publishing purposes. But currently vuln scanning can ingest either format, so the two files aren't required. The use case where multiple outputs may be relevant, for SBOM action and CLI, is to generate a file while also printing SBOM as a table -- the table here is a visual helper to whoever ran the tool.

jonasagx commented 2 years ago

Depends on https://github.com/anchore/syft/issues/563