Could I use Tern as a SDK ?

[hectorj2f]

Please read the Code of Conduct before you proceed
Code of Conduct

Ask your question here
I am interested to know if I could use Tern as a SDK so I can call its functions to be used for sbom generation and scanning.

[nishakm]

If you were coding in Python you can absolutely import tern and use its functions :). Are you looking for some equivalent in another language?

[hectorj2f]

I am looking how to consume tern as a plugin, so either exposing its basic functions as grpc endpoints might be an option. Another option would be to mount it as a binary. I am looking at the possible integration points.

[nishakm]

Thanks @hectorj2f for that clarification. Exposing grpc endpoints sounds like a good place to start planning enhancements. We currently have a simple web app that just invokes tern with reporting functions in various formats. Is there anything else you think we should expose?

[hectorj2f]

The idea of having a clear API to know inputs and outputs to interact with. It would be great.

[rnjudge]

Hi @hectorj2f -- as we start to look at implementing an API, can you provide any more information on your requirements (i.e. specific use cases)? Would a REST API work? Do you need this to run on Kubernetes?

[hectorj2f]

@rnjudge Yes, I'd expect a basic API with the main functions to call it. A rest API would work, or a gRPC API would be great. We'd like to run a service on kubernetes to call it on demand when requested.