Rose Judge

Denote container package type in SPDX docs

2

**Describe the Feature** SPDX 2.3 is proposing adding a package purpose field which could be used to denote when the package is a container (among other package types). Once the...

Map cve_bin_tool data into Tern's data model

2

**Describe the Feature** cvs_bin_tool is currently available to run as an extension in Tern but it will just print the output to console and so it cannot be used in...

**Description** A change to the SPDX 2.3 spec made [currently required licensing fields optional](https://github.com/spdx/spdx-spec/pull/635). **To Do** The omission of these fields, by default, now assumes a NOASSERTION value. If we...

Add test for expand_from_images in test_analyze_docker_dockerfile.py

6

**Describe the Feature** Add a test in `tests/test_analyze_docker_dockerfile.py` named `testExpandFromImages` that will test the functionality of the `expand_from_images` function. In order to implement this a few things will have to...

**Description** We would like to run Tern in some number of persistent containers as a service in a K8s cluster, scaled to the resource environment. Ideally, something calls out to...

Enable Tern to run on Kubernetes

1

**Describe the Feature** Tern can be package as a container. Next, let's make it run on Kubernetes so users can deploy and utilize Tern at scale or as part of...

Add source package metadata to CycloneDX format report

2

**Describe the Feature** Source package name (`src_name`) and version (`src_version`) properties are available for Package objects for dpkg and rpm package managers collection methods. **Use Cases** It would be great...

Overhaul Tern's continuous integration testing

1

**Describe the Feature** Currently Tern uses `ci/test_files_touched.py` to run various Tern tests based on which files were changed in a commit. This way of testing has proved to be porous,...

**Describe the Feature** In order to test the Dockerfile lock functionality in Tern we need to be able to have a consistent sha sum for the base OS and consistent...

May need to adjust scancode parsing variable names

1

**Description** Potentially revert or modify https://github.com/tern-tools/tern/commit/ce5c76305c577e089879d28c7e9e0fdeac20045e when resolution has been reached for https://github.com/nexB/scancode-toolkit/issues/2803. The `declared_license` naming field is perhaps not something Tern should collect as it is currently only the...