Enhance scoping selections about syft HOT 6 OPEN

note: package de-dup is done, so this should be unblocked 🥳

from syft.

In order to continue with these package de duplication needs to be concluded first (or concurrently) (see #32)

from syft.

There is an extra vote for some of these via #1035

from syft.

Some other related asks:

• #1809
• #1818

I believe if we included each layer that a component is present in the locations, in order, that matches the order the container was built, we could be able to answer both of the questions posed:

• Remove all packages with layer X (e.g. the base layer; this could be removed and re-added, though)
• Determine all packages which are on the final layer

There would have to be a change somewhere or possibly a new scope to do this (which seems like all-layers might work like this by default -- some aspect of this may actually be done already) such that we don't include layers where we see files introduced but rather we include all layers where files are present.

from syft.

I think there is one unsolved problem with this that needs to be addressed early in the design: how will we deal with multiple packages stored in a single file? It could look like that large sets of packages were introduced together in a single layer, when in fact they were introduced across layers. (e.g. RPMs and the RPM DB)

from syft.

can be a very useful feature!

from syft.