Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Automatically detect source based on local context #2084

Open
wagoodman opened this issue Aug 31, 2023 · 0 comments
Open

Automatically detect source based on local context #2084

wagoodman opened this issue Aug 31, 2023 · 0 comments
Labels
enhancement New feature or request

Comments

@wagoodman
Copy link
Contributor

What would you like to be added:
Derived from #558 (comment) it would be ideal to try and get more specific metadata for sources that would be directory scans, but could be more specific, such as a GitSource (and we capture things like the current git commit, tag, state, etc).

Why is this needed:
This would allow for the SBOM to capture more complete information for a source when the input is not detailed enough. For instance, if scanning . we don't want the source name to be . if this is a git source, instead we should report the url for the repo, such as github.com/anchore/syft.

The same can be said for other content in a directory: if the directory is a source directory for a python project, then pull in information from the pyproject.toml to get the name of the source.

This implies that this could allow for multiple metadata sources for a single input directive (e.g. scan . might resolve in a list of a GitSource and a PythonSource [made up]).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

1 participant