Add --enrich flag to expose syft's metadata enrichment during scan - #319
Merged
Conversation
Adds an --enrich flag to `vulncheck scan` that mirrors syft's own
--enrich directive: a comma-separated scope list drawn from
{all, golang, java, javascript, python}, with the `+scope` / `-scope`
prefixes syft accepts. Off by default.
When set, syft's per-language cataloger configs get the same fields
flipped that syft's own CLI flips for --enrich, letting syft fetch
license and metadata info from proxy.golang.org, Maven Central,
NPM, and PyPI. This closes the customer ask for richer SBOM metadata
while keeping the default behaviour offline-safe (no network calls
unless the flag is set).
Implementation:
- New bill.SBOMOptions struct threaded through bill.GetSBOM so future
toggles don't churn every caller.
- bill.buildSBOMConfig converts SBOMOptions.Enrich into a
syft.CreateSBOMConfig with a customised pkgcataloging.Config.
Returns nil when Enrich is empty so syft's own defaults still apply.
- bill.enrichmentScope reproduces syft's own precedence
(explicit `+scope`/`-scope` beats `all`/`none`). Syft keeps the
equivalent under an internal/ package we can't import.
- --enrich has no meaning when reading an existing SBOM via
--sbom-input-file; scan hard-fails on the combination rather than
silently no-op'ing (same pattern as the existing --include-cpes
online-mode check).
- New i18n.C.FlagEnrich entry keeps the help text where every other
scan flag's help text lives.
Testing:
- TestBuildSBOMConfig locks in the mapping: empty Enrich yields nil,
`all` flips every language, single scopes stay isolated, `all,-java`
excludes only Java, `none` disables everything.
- TestEnrichmentScope covers the precedence rules exhaustively.
- Manually verified end-to-end: scanning a tiny go module without
--enrich returns 0 licenses; with --enrich all, syft fetches
license data remotely and populates it. Also verified the
--enrich + --sbom-input-file mutual-exclusion errors correctly.
Enrichment fetches metadata over the network (proxy.golang.org, Maven Central, NPM, PyPI); --offline exists so the CLI can run without any network access. Combining the two silently produces an SBOM missing the metadata the user opted in for. Hard-fail the combination with a clear message, matching the pattern used for the existing --enrich + --sbom-input-file check. Updates the flag's help text to state both mutual-exclusion rules inline. Adds the flag to the scan command's flag table in README.md.
Syft accepts additional scope names per language beyond the ones its --help publicises: `go` alongside `golang`, `node` and `npm` alongside `javascript`, `maven` alongside `java` (internal/task/package_tasks.go). The previous implementation only matched the primary names, so a user typing `--enrich node` or `--enrich maven` got a silent no-op even though syft would have honoured either. Refactors enrichmentScope to accept a variadic alias list and updates the per-language dispatch in buildSBOMConfig to pass every alias syft accepts. Also picks up golang.UsePackagesLib, which syft flips under --enrich golang and which we were previously missing (a no-op in practice because syft's default is already true, but included for completeness). Extends TestBuildSBOMConfig with alias assertions and a UsePackagesLib check.
tcampbPPU
approved these changes
Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
--enrichflag onvulncheck scanthat mirrors syft's own--enrichdirective: a comma-separated scope list drawn from{all, golang, java, javascript, python}with syft's+scope/-scopeprefix conventions. Off by default, so existing behaviour is preserved and no unexpected network calls happen.--enrich, letting syft fetch license and package metadata fromproxy.golang.org, Maven Central, NPM, and PyPI.--enrichis combined with--sbom-input-file(enrichment only applies during SBOM generation) or--offline(enrichment requires network access). Matches the "explicit error over silent no-op" pattern used elsewhere in scan.empty → nil,allflips every scope, single scopes stay isolated,all,-scopeexcludes only that scope,nonedisables everything) and the scope-precedence rules (+scope/-scopebeatall/none).README.mdupdated.Why
Customers asked for a way to include richer package metadata (licenses in particular) in generated SBOMs. Syft already supports this via its
--enrichdirective; the CLI just wasn't exposing it. Adding a flag rather than always-on keeps the default offline-safe and avoids the extra runtime cost when the extra metadata isn't needed.Test plan
go test ./pkg/bill/...passes (includesTestBuildSBOMConfig,TestEnrichmentScope)go build ./...cleanvulncheck scan <dir> --sbom-only --enrich all --sbom-output-file out.jsonon a Go module populates.components[].licenseswhere a plain run does notvulncheck scan -i <sbom> --enrich allprints--enrich has no effect when reading a pre-built SBOM via --sbom-input-fileand exits non-zerovulncheck scan <dir> --enrich all --offlineprints--enrich requires network access and cannot be combined with --offlineand exits non-zerovulncheck scan --helpshows the new flag with the mutual-exclusion notes