Question: Architectural approaches for package-level diffing via Syft/Trivy

[rstanevich]

Context

I am looking for an efficient way to display a high-level diff of package (various type) version changes between two OCI images.
Roughly speaking, the output would look like this:

{
    "deb": {
      "libcrypt": {
         "0": ["4.4.27"],
         "1": ["4.4.36"]
      },
       "LibC": {
         "0": ["2.35.0"],
         "1": ["2.39.0"]
      },
       "OpenSSL": {
         "0": ["3.0.2"],
         "1": ["3.0.13"]
      }, 
       ...
    },
    ...
}

Hypothesys

IIUC there are 2 potential workflows and would appreciate your feedback on the best path forward:

1. Post-Process Comparison: Generate full SBOM JSON reports (using Syft or Trivy) for both images independently and compute the diff between the two resulting datasets.
2. Layer-Based Chaining: Use diffoci to isolate changed layers/files first, then pipe that specific context to Syft or Trivy for targeted package parsing.

Questions

1. Performance: Which design do you anticipate being more performant? I suspect the second approach (differential parsing) might be faster for large images, but I’m curious if there are known pitfalls here.
2. Best Practice: To ensure long-term compatibility, would you recommend that users manually pipe the output between these tools (diffoci -> syft), or is there interest in a more native integration?

---

Thank you for your guidance!