feat: Generate SBOM for a single file #330
Open
+177
−43
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Enable users to generate an SBOM for a single file, without having to create a config file. If a file name ends with
.json
it is treated as a specimen config file, rather than generating a single-file SBOM for the JSON file. To override this behavior, several prefixes can be prepended to the file path so the argument to Surfactant will be in the formprefix:filepath
-- e.g.file:abc.json
.The prefixes recognized are:
file
to force Surfactant to generate an SBOM from the single file given after the prefix. Likely only needed to generate a single file SBOM for a JSON file or a file whose name starts with one of the special prefixes as part of the file name, both of which should be rare. e.g.file:config:abc.xyz
would generate a single file SBOM for a file with the (odd) nameconfig:abc.xyz
config
to force Surfactant to treat the given file path as a Surfactant specimen config file. This should never be needed, unless a user decides to omit a.json
file extension for their Surfactant specimen config file names.dir
to force Surfactant to treat the given file path as a specific directory to generate an SBOM for, with "implied" specimen config file settings (summarized below). This should only be needed if a directory has one of these special prefixes at the start of its name, which is very rare. e.g.dir:config:mydirectory
would generate an SBOM over the contents in a directory namedconfig:mydirectory
.For generating a single file or single directory SBOM some assumptions are made for parameters that a specimen config file would usually contain:
extractPaths
: the path given as an argument to SurfactantinstallPrefix
: either the directory given as the argument to Surfactant, or the parent directory if the path given to Surfactant is for a single file SBOM; a relative path to a file will result in this being a relative path while an absolute path will result in this being the absolute path, which gives some control over the install paths present in the resulting SBOMResolves #126