anchore / anchore/syft

Add ability to append labels to SBOM

Open
#347 3 comments 5 reactions 0 assignees View on GitHub
enhancement good-first-issue
Dominant language
Go
Stars
9.6k
Forks
954
Avg merge
1d 5h
Merged PRs (30d)
42

Description

**What would you like to be added**:
When generating (and especially uploading) an SBOM I want to collect meta-data about where the command was run, who ran it, or other relevant information that could be used later.

**Why is this needed**:
To provide a building block so that wrapping tools can help differentiate where and how an SBOM was generated.

**Additional context**:
I'd imagine this could be amended to the /.syft.yaml config e.g.

```
sbom-labels:
name: value
```

Contributor guide

Open the contributing guide

Research direction

Start with the /.syft.yaml configuration example and trace how generation and uploading consume configuration. Define how sbom-labels name/value entries should be carried into generated and uploaded SBOMs, then verify both paths support metadata for wrapper tools.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
cli
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.