Add ability to append labels to SBOM
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 954
- Avg merge
- 1d 5h
- Merged PRs (30d)
- 42
Description
**What would you like to be added**:
When generating (and especially uploading) an SBOM I want to collect meta-data about where the command was run, who ran it, or other relevant information that could be used later.
**Why is this needed**:
To provide a building block so that wrapping tools can help differentiate where and how an SBOM was generated.
**Additional context**:
I'd imagine this could be amended to the /.syft.yaml config e.g.
```
sbom-labels:
name: value
```
Contributor guide
Research direction
Start with the /.syft.yaml configuration example and trace how generation and uploading consume configuration. Define how sbom-labels name/value entries should be carried into generated and uploaded SBOMs, then verify both paths support metadata for wrapper tools.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100