search

docker / go-imageinspect

Apache License 2.0
15 stars 2 forks source link

Add files import from SPDX #6

Closed jedevc closed 2 years ago

jedevc commented 2 years ago

List package files in output.

Note: this produces strange results if duplicate files appear in hasFiles, so we skip over them to prevent a panic (though we still produce the wrong result). For syft, this should be fixed in https://github.com/anchore/syft/pull/1168.

tonistiigi commented 2 years ago

Is the files list something that end users would find useful or is it something that could help associate the package with the command that added the package. And in that case we would add a reference to the command in here instead of the file list itself.

jedevc commented 2 years ago

I think both have valid use cases. Knowing the command that added the package is helpful for automated patching tools, etc, but the raw file list by itself is useful I think - if after build, a user discovers an issue with a file, the package file list is an audit trail for "how did this file get here".