Labels

Rationale

We decided to develop Labels as a custom SBOM generator to meet internal needs for accuracy, integration, and metadata coverage.

Existing tools lacked support for essential metadata, such as file-level and line-level location information.
Internal parsers developed for other tools reported significantly more dependencies.
Compatibility with the results produced by the internal software composition analysis (SCA) system was required.
A tailored JSON structure was needed for seamless communication with the internal platform.
The logic had to be encapsulated in a lightweight, installable, and versioned Python library for internal reuse.
Control over the data model, output, and evolution was considered strategically important.
Avoiding external architectural mismatches and unnecessary complexity was a key technical requirement.
In-house expertise in parsers and code analysis tools to improve detection accuracy and tailor metadata extraction to internal workflows.

Use Syft as-is:

Requires no initial development effort.
Maintained by the open-source community.
Reports fewer dependencies than internal tools.
Lacks support for detailed metadata (e.g., line numbers).
Breaks compatibility with internal SCA results.
Introduces a Go-based runtime, increasing stack complexity.
Offers minimal control over behavior or evolution, making adaptation to internal needs difficult.

Use Syft as a base and tailor it:

Allows building on an existing and actively maintained foundation.
Enables extending functionality to partially meet internal requirements.
Requires development in Go and a deeper understanding of Syft’s internals, as well as applying patches to ensure proper integration with the current stack.
Introduces maintenance overhead due to divergence from upstream.
Adds complexity to the stack by mixing language runtimes.
Provides moderate control and flexibility to evolve the tool, but is still constrained by Syft’s core design.

Syft was last reviewed on July 25, 2023.

We use Labels in the following ways:

To feed other tools, such as Fluid Attacks’ scanners, in order to complete the final report of vulnerabilities.
To display detailed information about packages in their dedicated view within the platform.
To generate SBOM files on demand in standard formats such as CycloneDX and SPDX.