Compare/analyze SBOMs - Githubissues

docker / scout-cli

Docker Scout CLI

https://docker.com/products/docker-scout

Other

250 stars 60 forks source link

Closed MPV closed 3 months ago

MPV commented 4 months ago

I've run into Docker Scout having issues trying to compare large images in CI:

...so I'd like Docker Scout to be able to compare SBOMs instead of passing entire/large images around.

What's your thoughts on this?

cdupuis commented 4 months ago

@MPV, yes. We have an internal ticket to allow SBOMs to be used as input for the various commands. We’ll likely start with SPDX. Sound good?

MPV commented 4 months ago

Great to hear, music to my ears. 🎶🎷

cdupuis commented 3 months ago

@MPV, this should be possible now with syft -o spdx-json alpine | docker scout cves sbom://.