From cdd34ff529e3a4e847c4ff221a19a0a72571d73a Mon Sep 17 00:00:00 2001 From: jcamilomolinar Date: Wed, 8 Jul 2026 15:45:03 -0500 Subject: [PATCH] feat: add SPEC_VERSION config with syft --- docs/Docusaurus/docs/modules/engine_core.md | 2 ++ .../engine_core/ConfigTool.json | 1 + .../infrastructure/driven_adapters/syft/syft.py | 16 ++++++++++++++-- 3 files changed, 17 insertions(+), 2 deletions(-) diff --git a/docs/Docusaurus/docs/modules/engine_core.md b/docs/Docusaurus/docs/modules/engine_core.md index 231a46151..69b54117a 100644 --- a/docs/Docusaurus/docs/modules/engine_core.md +++ b/docs/Docusaurus/docs/modules/engine_core.md @@ -127,6 +127,7 @@ Configuration of the driven adapters in the main layer and management of on/off "SYFT": { "SYFT_VERSION": "1.17.0", "OUTPUT_FORMAT": "cyclonedx-json", + "SPEC_VERSION": "1.6", "EXCLUDE_PATHS": ["**/test/**", "**/node_modules/**"], "EXCLUDE_CATALOGERS": [], "DEBUG_PIPELINES": ["pipeline_name1", "pipeline_name2"] @@ -361,6 +362,7 @@ Configuration of the driven adapters in the main layer and management of on/off - **SYFT** - **SYFT_VERSION**: Version of Syft to download and use. Example: `"1.17.0"`. - **OUTPUT_FORMAT**: Output format for the SBOM. Default: `"cyclonedx-json"`. Other options include `"spdx-json"`, `"syft-json"`, `"table"`. + - **SPEC_VERSION**: Schema version to use for the SBOM output. Default: `"1.6"`. Only applied when `OUTPUT_FORMAT` supports versioning (`cyclonedx-json`, `cyclonedx-xml`, `spdx-json`, `spdx-tag-value`), appended to the format as `@` (e.g. `cyclonedx-json@1.6`). Ignored for formats without version support (e.g. `syft-json`, `table`). - **EXCLUDE_PATHS**: Array of glob patterns to exclude directories/files from analysis. Example: `["**/test/**", "**/node_modules/**"]`. Useful for skipping test files, build artifacts, or vendor directories. - **EXCLUDE_CATALOGERS**: Array of cataloger names to exclude from the default set. Catalogers are specialized modules that detect specific package types (e.g., `"java-archive-cataloger"`, `"python-package-cataloger"`). When specified, Syft uses `--select-catalogers -NAME` to remove these catalogers from analysis. Example: `["java-archive-cataloger", "binary-cataloger"]`. - **DEBUG_PIPELINES**: Array of pipeline names where Syft should run in verbose mode (`-v` flag). Useful for troubleshooting SBOM generation issues in specific pipelines. Example: `["pipeline_name1", "pipeline_name2"]`. diff --git a/example_remote_config_local/engine_core/ConfigTool.json b/example_remote_config_local/engine_core/ConfigTool.json index 595ba35af..987748d71 100644 --- a/example_remote_config_local/engine_core/ConfigTool.json +++ b/example_remote_config_local/engine_core/ConfigTool.json @@ -107,6 +107,7 @@ "SYFT": { "SYFT_VERSION": "1.42.2", "OUTPUT_FORMAT": "cyclonedx-json", + "SPEC_VERSION": "1.6", "EXCLUDE_PATHS": ["**/test/**"], "EXCLUDE_CATALOGERS": ["java-archive-cataloger"], "DEBUG_PIPELINES": ["pipeline_name1", "pipeline_name2"] diff --git a/tools/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/syft/syft.py b/tools/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/syft/syft.py index e5581f769..8761d4e2f 100644 --- a/tools/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/syft/syft.py +++ b/tools/devsecops_engine_tools/engine_core/src/infrastructure/driven_adapters/syft/syft.py @@ -21,6 +21,13 @@ logger = MyLogger.__call__(**settings.SETTING_LOGGER).get_logger() +VERSIONED_OUTPUT_FORMATS = ( + "cyclonedx-json", + "cyclonedx-xml", + "spdx-json", + "spdx-tag-value", +) + @dataclass class Syft(SbomManagerGateway): @@ -62,12 +69,17 @@ def get_components(self, artifact, config, service_name) -> "list[Component]": def _run_syft(self, command_prefix, artifact, config, service_name): result_file = f"{service_name}_SBOM.json" syft_config = config['SYFT'] - + + output_format = syft_config['OUTPUT_FORMAT'] + spec_version = syft_config.get('SPEC_VERSION', "") + if spec_version and output_format in VERSIONED_OUTPUT_FORMATS: + output_format = f"{output_format}@{spec_version}" + command = [ command_prefix, artifact, "-o", - f"{syft_config['OUTPUT_FORMAT']}={result_file}", + f"{output_format}={result_file}", ] exclude_paths = syft_config.get('EXCLUDE_PATHS', [])