Enriching the project.

[ijbranch]

I would like to suggest a --manifest option that reads a components.json to enrich your SBOM with vendor/licence metadata.
Have a look at: https://codeberg.org/GITLAK/DelphiSBOM

Regards,
Ian

[omonien]

Thanks Ian — great suggestion and a natural fit with the rest of the SBOM enrichment work. Tracking it as the canonical --manifest feature request.

Initial sketch of how I'd implement it:

• New CLI flag --manifest=<path> (default components.json when bare) and a .dxcomply.json equivalent "manifest".
• Schema: same shape as DelphiSBOM's components.json (you linked the project — I'll cross-check the exact field set) so users can share a single file between tools. Keys at minimum: name, version, supplier/vendor, license, purl (optional), description (optional).
• Resolution: by filename match against artefact RelativePath and against external-reference names; manifest values win over auto-detected values, missing files in the manifest just don't enrich.
• Output: the writers already support per-component supplier / licenses / description, so the plumbing is small once the parser is in.

This won't ride the current wave of bugfix PRs — it deserves its own branch and a bit more design care. I'll ping you here when there's a preview to try. If you already have a sample components.json from DelphiSBOM that you'd like to keep working unchanged, please paste it (or link it) — that'll help me lock down the schema.