spack is a package manager similar to conan or vcpkg that can build software from source covering a wide array of languages, runtimes, compilers, and configurations (it can also use signed packages from its public binary caches). Recently, support was added to generate SBOM data in SPDX format (support for Cyclone-DX is being considered). I am adding spack as a PURL type, and would like grype to be able to consume spack’s SBOMs for scanning.
I have a few questions on getting started making a matcher for spack.
Since spack can generate the SBOM, it seems like I don’t need to add anything to Syft. Is this correct?
No. You must implement a cataloger to satisfy the grype matcher interface. Specifically,
PackageTypes() []syftPkg.Type
Is there documentation on the grype/matcher interface? In particular, what features are required to be overridden by a new matcher. The level of complexity in the current matchers varies quite a lot, so it’s not entirely clear to me which parts are essential.
There is excellent documentation of the architecture of the entire anchore ecosystem.
anchore.com/docs/architecture/and for grype specifically
https://oss.anchore.com/docs/architecture/grype/
Ideally, I would like to have spack work like the other scan targets such that grype --from spack /path/to/spack/install works and grype /path/to/spack/install automatically detects it as a spack source.
Many thanks in advance for your help!
- Tim
EDIT As is usual for me, I found the answers to my questions right after I posted this. 