+
Skip to content

Support SBOM creation for container image indexes #1683

@eliaslevy

Description

@eliaslevy

What would you like to be added:
Create an SBOM when given a container reference that points to a container image index that includes the dependencies of all the image manifests the index points to.

Why is this needed:
Multi-architecture and multi-platform container images are becoming more common.

Additional context:
Syft supports creating an SBOM from a container reference. When given a reference, Syft will pull the reference to download the container image. When the reference points to a container image index, Syft will download one of the underlaying images depending on that platform the tool is run on, and generate an SBOM from that image. That means that the dependencies of the alternate images are not cataloged and documented in the SBOM, creating a visibility gap.

Syft should optionally download each underlaying image and document the dependencies in all of them. Ideally Syft would model the image index and image manifests as packages in the SBOM with appropriate relationships, so that the dependency graph information is recorded.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    Status

    Backlog

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

      点击 这是indexloc提供的php浏览器服务,不要输入任何密码和下载