anchore / syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems
Apache License 2.0
6.21k stars 572 forks source link

Rename top-level JSON fields #1842

Open wagoodman opened 1 year ago

wagoodman commented 1 year ago

There are a couple of fields that feel like they should be renamed to better represent what they contain:

wagoodman commented 1 year ago

If we have a config switch that allows to legacy behavior we can leverage https://github.com/anchore/go-struct-converter in the same way as done in spdx/tools-golang to support x many versions in the future (where the first would be "legacy" and "current").

wagoodman commented 1 year ago

dev note: draft branch started at https://github.com/anchore/syft/compare/rename-top-level-json-fields

This should be coordinated with #1419 so we can get the last remaining breaking changes before syft 1.0 in.

wagoodman commented 9 months ago

I think there is good reason to wait until syft 2.0 to make this change:

  1. this change will break 99% of consumers (ok, not 99% exactly, but a lot of folks for common use cases)

  2. currently we do not bump syft versions with schema versions (where a breaking change in one is a breaking change in another), so folks would not have much warning that this could happen

  3. we are planning to allow for multiple supported encoding versions for the syft-json format in the future, which would be a very nice way to facilitate a controlled fallback for users that want the latest syft capabilities but not the latest schema versions

  4. given the previous point, we could develop breaking changes in a version called dev and incorporate such breaking schema changes into multiple releases ahead of switching the default schema version that syft outputs

So though we could make this change for syft 1.0, we ought to wait until we implement #846 to make this transition smoother.

wagoodman commented 8 months ago

Moving back to the backlog since this will land after https://github.com/anchore/syft/issues/846 , which isn't ready yet.