docs: ADR-0002: import subcommand

[jhoward-lm]

2. Import subcommand

Date: 2024-07-09

Status

Accepted

Context

There is currently no capability of importing SBOM or protobom data from either stdin or local filesystem path(s).

Decision

Introduce an import command that will accept one of the following options as input:

• stream of bytes piped from stdin by using the argument -
  • use of - is how kubectl accepts stdin (see kubectl examples)
• path to a local file or files as optional positional arguments
  • alternatively, input files could could be specified with an explicit flag, such as --input, --file, --path, etc.

The supported input types will be:

• CycloneDX SBOM
• SPDX SBOM
• Protobom Document (such as the serialized protocol buffer storage format used by the Protobom FileSystemBackend)

The fetch command will now be able to simply fetch raw bytes data and leverage the new import logic to store.

Consequences

Integration between CLI tools

Promotes integration with other CLI tools by accepting their piped output.

For example, this could enable usage patterns such as:

curl --silent --url https://acme.example.com/sbom.cdx.json | bomctl import

Input flexibility

Presents additional input options for users that may feel more natural.

Feature parity

Adds a counterpart to the export command for feature parity and completeness.

References

• kubectl stdin implementation

[idunbarh]

Assuming the last comment gets resolved, this ADR was updated and accepted during the community call on 7/29/2024.