Squashed all layers resolver

Syft
1

Hi!
I saw an old PR related to try and find out when a package was first added. The PR had few drawbacks, however another suggestion was made and I think it is now more relevant to discuss if it might be useful now for users.
The goal can be find out in which layer a package (or CVE in case exists) was added to a docker container.
Here is the link to the PR - Squashed all layers by tomersein · Pull Request #3138 · anchore/syft · GitHub
Here is the link to the issue - Enhance scoping selections · Issue #15 · anchore/syft · GitHub

What do you think?
It can be a great baseline to the “base-image” resolver in the future.

2

Hi @TimBrown1611 thanks for the reminder. @wagoodman is taking a look at the PR soon. We’ll follow up on GitHub. I’m closing this thread to keep the conversation in one place.