feat: 3098 add support for user to flag root package supplier and supplier inheritance

cmd/syft/internal/commands/scan.go

@@ -218,8 +218,9 @@ func getSource(ctx context.Context, opts *options.Catalog, userInput string, sou
 	cfg := syft.DefaultGetSourceConfig().
 		WithRegistryOptions(opts.Registry.ToOptions()).
 		WithAlias(source.Alias{
-			Name:    opts.Source.Name,
-			Version: opts.Source.Version,
+			Name:     opts.Source.Name,
+			Version:  opts.Source.Version,
+			Supplier: opts.Source.Supplier,
 		}).
 		WithExcludeConfig(source.ExcludeConfig{
 			Paths: opts.Exclusions,

cmd/syft/internal/options/catalog.go

@@ -242,6 +242,9 @@ func (cfg *Catalog) AddFlags(flags clio.FlagSet) {
 
 	flags.StringVarP(&cfg.Source.BasePath, "base-path", "",
 		"base directory for scanning, no links will be followed above this directory, and all paths will be reported relative to this directory")
+
+	flags.StringVarP(&cfg.Source.Supplier, "source-supplier", "",
+		"a supplier may also be known as a manufacturer, vendor, developer, integrator, maintainer, or provider of the software")
 }
 
 func (cfg *Catalog) DescribeFields(descriptions fangs.FieldDescriptionSet) {

cmd/syft/internal/options/format.go

@@ -43,9 +43,9 @@ over to the final syft 1.0 json output this option can be used to ease the trans
 
 Note: long term support for this option is not guaranteed (it may change or break at any time)`)
 
-	descriptions.Add(&o.Template.Path, `path to the template file to use when rendering the output with the template output format. 
+	descriptions.Add(&o.Template.Path, `path to the template file to use when rendering the output with the template output format.
 Note that all template paths are based on the current syft-json schema`)
-	descriptions.Add(&o.Template.Legacy, `if true, uses the go structs for the syft-json format for templating. 
+	descriptions.Add(&o.Template.Legacy, `if true, uses the go structs for the syft-json format for templating.
 if false, uses the syft-json output for templating (which follows the syft JSON schema exactly).
 
 Note: long term support for this option is not guaranteed (it may change or break at any time)`)

cmd/syft/internal/options/source.go

@@ -17,6 +17,7 @@ type sourceConfig struct {
 	Name     string      `json:"name" yaml:"name" mapstructure:"name"`
 	Version  string      `json:"version" yaml:"version" mapstructure:"version"`
 	BasePath string      `yaml:"base-path" json:"base-path" mapstructure:"base-path"` // specify base path for all file paths
+	Supplier string      `json:"supplier" yaml:"supplier" mapstructure:"supplier"`    // optional field for NTIA supplier
 	File     fileSource  `json:"file" yaml:"file" mapstructure:"file"`
 	Image    imageSource `json:"image" yaml:"image" mapstructure:"image"`
 }
@@ -32,6 +33,7 @@ var _ interface {
 var _ clio.PostLoader = (*imageSource)(nil)
 
 func (o *sourceConfig) DescribeFields(descriptions clio.FieldDescriptionSet) {
+	descriptions.Add(&o.Supplier, `optional field for syft user to configure the supplier of the root software component being analyzed`)
 	descriptions.Add(&o.File.Digests, `the file digest algorithms to use on the scanned file (options: "md5", "sha1", "sha224", "sha256", "sha384", "sha512")`)
 	descriptions.Add(&o.Image.DefaultPullSource, `allows users to specify which image source should be used to generate the sbom
 valid values are: registry, docker, podman`)

internal/constants.go

@@ -3,5 +3,5 @@ package internal
 const (
 	// JSONSchemaVersion is the current schema version output by the JSON encoder
 	// This is roughly following the "SchemaVer" guidelines for versioning the JSON schema. Please see schema/json/README.md for details on how to increment.
-	JSONSchemaVersion = "16.0.21"
+	JSONSchemaVersion = "16.0.22"
 )