Supported inputs
This matrix is generated from the recognized-input catalog, so it is the exact truth of what a default sbomflow analyze/audit run reads — not a hand-written promise. "Supported" means corpus-tested: the parser has a regression corpus, nothing more. A recognized-but-unparsed input is detected, hashed into the artifact manifest, and surfaced with a stable warning — it is never silently ignored. Anything not listed here is not recognized as inventory in the default scan.
Parsed by default (29 tested)
| Input | Family | Kind |
|---|---|---|
Cargo.lock | cargo | Lockfile |
composer.lock | composer | Lockfile |
conan.lock | conan | Lockfile |
go.mod | go | Lockfile |
go.sum | go | Lockfile |
npm-shrinkwrap.json | npm | Lockfile |
package-lock.json | npm | Lockfile |
pnpm-lock.yaml | npm | Lockfile |
yarn.lock | npm | Lockfile |
packages.lock.json | nuget | Lockfile |
Pipfile.lock | python | Lockfile |
poetry.lock | python | Lockfile |
uv.lock | python | Lockfile |
Gemfile.lock | rubygems | Lockfile |
host-manifest.csv | buildroot | Manifest |
manifest.csv | buildroot | Manifest |
Cargo.toml | cargo | Manifest |
*.cmake (glob) | cmake | Manifest |
CMakeLists.txt | cmake | Manifest |
firmware-manifest.txt | generic | Manifest |
product-manifest.txt | generic | Manifest |
go.mod | go | Manifest |
package.json | npm | Manifest |
Dockerfile | oci | Manifest |
requirements.txt | python | Manifest |
*.manifest (glob) | yocto | Manifest |
license.manifest | yocto | Manifest |
west.yaml | zephyr | Manifest |
west.yml | zephyr | Manifest |
Recognized but not parsed yet (15 warn, never silent)
Each surfaces an actionable warning naming the exact file; use the matching opt-in importer where one exists, or review the recorded file manually.
| Input | Family | Kind | Notes |
|---|---|---|---|
.config | kconfig | Build evidence | Retained and hashed; use the matching build-evidence importer. |
*.map.summary.json (glob) | linker-map | Build evidence | — |
colcon-events.log | ros2 | Build evidence | — |
zephyr.meta.json | zephyr | Build evidence | — |
index.json | oci | Container | — |
oci-layout | oci | Container | — |
*.dts (glob) | device-tree | Device tree | — |
*.dtsi (glob) | device-tree | Device tree | — |
dependencies.lock | esp-idf | Lockfile | — |
gradle.lockfile | gradle | Lockfile | — |
pom.xml | maven | Lockfile | — |
requirements.lock | python | Lockfile | — |
Package.resolved | swiftpm | Lockfile | — |
vcpkg.json | vcpkg | Lockfile | — |
pyproject.toml | python | Manifest | Warned only when it declares dependencies; otherwise it is not treated as inventory. |