Segrep

segrep-sbom scanner

Opt-in local SBOM scanner with optional Syft parity shadow

Opt-in SBOM scanner for Segrep that prioritizes local lockfile parsing and can optionally run a parity shadow comparison against external Syft.

segrep-sbom is designed for controlled rollout of local SBOM generation without changing default syft behavior.

Why use segrep-sbom

  • Keeps syft unchanged for teams that need Anchore Syft output path by default.
  • Enables local lockfile SBOM generation for fast, dependency-focused scans.
  • Supports shadow parity against external Syft so drift can be measured in CI.

Scanner behavior

segrep-sbom runs as an opt-in scanner.

pnpm segrep scan . --scanners segrep-sbom --format json

It writes SBOM artifacts to:

  • .segrep/sbom.cyclonedx.json

When parity shadow is enabled, it also writes:

  • .segrep/segrep-sbom-parity.json

Modes

Configure execution mode with SEGREP_SBOM_MODE:

  • auto (default): local lockfile SBOM first, external Syft fallback
  • local: require local lockfile path; fail if unsupported lockfiles are absent
  • external: force external Syft path only
SEGREP_SBOM_MODE=auto pnpm segrep scan . --scanners segrep-sbom

Parity shadow mode

Enable parity shadow to compare local and external component sets:

SEGREP_SBOM_PARITY_SHADOW=true pnpm segrep scan . --scanners segrep-sbom --format json

Parity report fields include:

  • status (compared or skipped)
  • summary.localComponentCount
  • summary.externalComponentCount
  • summary.localOnlyCount
  • summary.externalOnlyCount
  • sample component IDs from both delta sets

If external Syft is unavailable, parity status is skipped and the scan still succeeds in best-effort mode.

CI parity gate

Use the parity verifier script to enforce drift thresholds:

node scripts/ci-verify-sbom-parity.js \
  apps/cli/fixtures/vulnerable-repo/.segrep/segrep-sbom-parity.json \
  --max-local-only 0 \
  --max-external-only 0

Optional flag:

  • --allow-skipped for environments where external Syft parity is not always available

Docker usage

docker run --rm -v "$(pwd):/repo" \
  -e SEGREP_SBOM_PARITY_SHADOW=true \
  security-scanner:local \
  scan /repo --scanners segrep-sbom --format json

Relationship to syft scanner

  • syft scanner: external Syft wrapper (local binary or Docker image)
  • segrep-sbom scanner: local SBOM implementation with optional parity shadow

Use both when validating migration:

pnpm segrep scan . --scanners syft,segrep-sbom --format json

Related docs