syft: README instructions don't work verbatim

Maybe we just add a note to the effect of “if you encounter a Permission denied, you may need to specify a custom directory”?

Won’t users almost always encounter the permission denied issue if they run the listed instructions verbatim? Why document a command that doesn’t work?

We have a few suggestions here, and I think we would want to keep the download as a single line command. This is done easily as @spiffcs mentioned with:

curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b .

The caveat is you would have to run ./syft, which seems like it would be a simple thing to document. We then add the second variant with some text like: “If you would like to install in your system bin directory, run this as root:”

curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin

That should avoid any confusion for users who do not have root access and that the /usr/local/bin probably needs root access to write to it. Hopefully a user could figure this out from there.

What do you all think?

@spiffcs if there’s only a single binary, that’d be fine, although technically since . isn’t typically in the path, you’d have to use ./syft instead of syft. Truly, you are probably better off with:

mkdir -p "${HOME}/bin"
export PATH="${PATH}:${HOME}/bin"
... sh -s -- -b "${HOME}/bin"
chmod +x "${HOME}/bin/syft"

Users who know whether the first two steps are optional will skip them anyway.