Could I use Tern as a SDK ?

tern-tools / tern

Tern is a software composition analysis tool and Python library that generates a Software Bill of Materials for container images and Dockerfiles. The SBOM that Tern generates will give you a layer-by-layer view of what's inside your container in a variety of formats including human-readable, JSON, HTML, SPDX and more.

BSD 2-Clause "Simplified" License

967 stars 188 forks source link

Could I use Tern as a SDK ? #1096

Open hectorj2f opened 2 years ago

hectorj2f commented 2 years ago

Please read the Code of Conduct before you proceed Code of Conduct

Ask your question here I am interested to know if I could use Tern as a SDK so I can call its functions to be used for sbom generation and scanning.

nishakm commented 2 years ago

If you were coding in Python you can absolutely import tern and use its functions :). Are you looking for some equivalent in another language?

hectorj2f commented 2 years ago

I am looking how to consume tern as a plugin, so either exposing its basic functions as grpc endpoints might be an option. Another option would be to mount it as a binary. I am looking at the possible integration points.

nishakm commented 2 years ago

Thanks @hectorj2f for that clarification. Exposing grpc endpoints sounds like a good place to start planning enhancements. We currently have a simple web app that just invokes tern with reporting functions in various formats. Is there anything else you think we should expose?

hectorj2f commented 2 years ago

The idea of having a clear API to know inputs and outputs to interact with. It would be great.

rnjudge commented 2 years ago

Hi @hectorj2f -- as we start to look at implementing an API, can you provide any more information on your requirements (i.e. specific use cases)? Would a REST API work? Do you need this to run on Kubernetes?

hectorj2f commented 2 years ago

@rnjudge Yes, I'd expect a basic API with the main functions to call it. A rest API would work, or a gRPC API would be great. We'd like to run a service on kubernetes to call it on demand when requested.