-
Notifications
You must be signed in to change notification settings - Fork 716
Description
What would you like to be added:
Create an SBOM when given a container reference that points to a container image index that includes the dependencies of all the image manifests the index points to.
Why is this needed:
Multi-architecture and multi-platform container images are becoming more common.
Additional context:
Syft supports creating an SBOM from a container reference. When given a reference, Syft will pull the reference to download the container image. When the reference points to a container image index, Syft will download one of the underlaying images depending on that platform the tool is run on, and generate an SBOM from that image. That means that the dependencies of the alternate images are not cataloged and documented in the SBOM, creating a visibility gap.
Syft should optionally download each underlaying image and document the dependencies in all of them. Ideally Syft would model the image index and image manifests as packages in the SBOM with appropriate relationships, so that the dependency graph information is recorded.
Metadata
Metadata
Assignees
Labels
Type
Projects
Status