grype
grype copied to clipboard
Add option to exclude packages sourced from the SBOM cataloger
Today syft has an SBOM cataloger that is on by default. In the use case of syft, which is to create an SBOM, this being on by default is useful for some and not useful for others https://github.com/anchore/syft/issues/1555 . If we don't elect to turn off SBOM cataloging by default in syft, we could make it default behavior in grype to ignore packages discovered by the SBOM cataloger in syft. This would mean that we would have to detect this case in the lib path and from any SBOM format used as input, which could be tricky.
Ideally we'd implement https://github.com/anchore/syft/issues/1555 and make SBOM cataloging an opt-in feature (and not implement this feature in grype).