Labels

Last updated: Oct 28, 2026

Rationale

Fluid Attacks developed Labels as a custom SBOM generator for its internal requirements of accuracy, integration, and metadata coverage.

The available tools did not support essential metadata, for example, file-level and line-level location information.
The internal parsers of other tools reported many more dependencies.
Compatibility with the results of the internal software composition analysis (SCA) system was necessary.
A custom JSON structure was necessary for good communication with the internal platform.
The logic had to be in a lightweight, installable, and versioned Python library that internal tools can use again.
Fluid Attacks thought that control over the data model, the output, and the changes of the tool had strategic importance.
An important technical requirement was to prevent external architectural mismatches and complexity that is not necessary.
Fluid Attacks has in-house expertise in parsers and code analysis tools. It can use this expertise to make the detection more accurate and to adapt the metadata extraction to its internal workflows.

Use Syft without changes:

No initial development work is necessary.
The open-source community maintains it.
It reports a smaller number of dependencies than the internal tools.
It does not support detailed metadata (for example, line numbers).
It is not compatible with the internal SCA results.
It adds a Go-based runtime, which makes the stack more complex.
It gives almost no control over its behavior or its changes. Thus, it is hard to adapt it to internal requirements.

Start from Syft and adapt it:

You can build on an available foundation, and its team continues to release new versions.
You can extend its functions to satisfy some internal requirements.
You must develop in Go and know the internals of Syft better. Also, you must apply patches to integrate it correctly with the current stack.
It adds maintenance work, because it becomes different from upstream.
It makes the stack more complex, because it mixes language runtimes.
It gives some control and flexibility to change the tool, but the core design of Syft continues to limit it.

Fluid Attacks last reviewed Syft on July 25, 2023.

Fluid Attacks uses Labels in these ways:

To give data to other tools, for example, the scanners of Fluid Attacks, to complete the final report of vulnerabilities
To show detailed information about packages in their own view in the platform
To make SBOM files on demand in standard formats, for example, CycloneDX and SPDX