Syft looks for the config file in $PWD, not in the target directory. Intentional?

[chmeliik]

What happened:

When a processing a directory, e.g. syft ~/repos/syft, Syft does not read the .syft.yaml config file in the target directory. It reads the one in the current directory instead.

What you expected to happen:

Expected Syft to read <target directory>/.syft.yaml rather than $PWD/.syft.yaml

Steps to reproduce the issue:

In the root of this repository:

cat << EOF > .syft.yaml
exclude:
- "**/test-fixtures"
- "./.github"
EOF

function count_packages_by_purl_type() {
  local dir=$1
  syft "$dir" -o cyclonedx-json |
    jq '.components[].purl | try match("pkg:[^/]*").string catch "<no purl>"' |
    sort | uniq -c | sort -h
}

count_packages_by_purl_type . 2>/dev/null 
#   1675 "pkg:golang"

cd ..

count_packages_by_purl_type ./syft 2>/dev/null 
#      1 "pkg:rpm"
#      2 "pkg:ebuild"
#      2 "pkg:nix"
#      4 "pkg:composer"
#     10 "pkg:swift"
#     13 "pkg:cargo"
#     13 "pkg:pub"
#     18 "pkg:apk"
#     18 "pkg:conan"
#     28 "pkg:nuget"
#     30 "<no purl>"
#     39 "pkg:github"
#     39 "pkg:pypi"
#     44 "pkg:hex"
#     46 "pkg:cocoapods"
#     47 "pkg:generic"
#     55 "pkg:hackage"
#     57 "pkg:npm"
#     59 "pkg:maven"
#    109 "pkg:gem"
#   1690 "pkg:golang"

Environment:

• Output of syft version:

Application: syft
Version:    0.99.0-SNAPSHOT-0e5fb8e0
BuildDate:  2024-01-03T13:16:47Z
GitCommit:  0e5fb8e01fd0b4f48b69b5cedefd876e756f6d61
GitDescription: v0.99.0-8-g0e5fb8e0
Platform:   linux/amd64
GoVersion:  go1.21.5
Compiler:   gc

(built with make build from 0e5fb8e)

• OS (e.g: cat /etc/os-release or similar): Fedora Linux 39 (Workstation Edition)

[tgerla]

Hi @chmeliik, thanks for the report. I think our intention here is indeed to find the syft configuration file in the current working directory, and not in the target directory. However, if you'd like to include a config file in the directory to be scanned, you can specify a particular config file using --config or -c on the syft command line. Would that suit your needs? I can definitely understand the need for custom configurations per directory being scanned.

[chmeliik]

Given that some of the configuration options feel like they're scoped to the thing I'm scanning (e.g. exclude), it seemed strange that Syft should read the configuration in the current directory rather than the one it is scanning.

But if that's intended that's OK, using --config or making sure I'm in the right directory will work for me 👍

[tgerla]

Sure, I understand your reasoning here, but I think we will preserve existing behavior. Glad the --config method will work for you. I'll close this issue out but please let us know if you need anything else. For reference, here's the section of the README docs describing the config parsing: https://github.com/anchore/syft#configuration