Should I create a template, or just post-process to get an SPDX SBOM containing PURLs only?

Syft
1

I would like to have syft generate SPDX SBOMs containing PURLs only, no CPEs. My thought is that using a template would be the “clean” way to do it. The alternative is to generate an SPDX SBOM, then post-process the output and strip out CPEs, leaving only PURLs. I would like some guidance on which approach I should take. If someone has already done the same thing using a template, I’d like to get a copy of the template.

Thanks in advance!

1 Like
2

Is it just CPEs you want to rip out, or something more?
Making an SBOM small is great, but making it compliant is even better! :slight_smile:

I don’t think there’s a template yet, unless someone speaks up below :down_arrow:

3

I would like the SBOM to also be compliant (part of “clean” in my mind)! The project I’m working on is focused on PURLs so removing CPEs greatly reduces the size.