diff --git a/syft/format/common/cyclonedxhelpers/to_format_model.go b/syft/format/common/cyclonedxhelpers/to_format_model.go index 7cae828c64b..a52c5f7e4ea 100644 --- a/syft/format/common/cyclonedxhelpers/to_format_model.go +++ b/syft/format/common/cyclonedxhelpers/to_format_model.go @@ -54,6 +54,14 @@ func ToFormatModel(s sbom.SBOM) *cyclonedx.BOM { artifacts := s.Artifacts + // if the source under analysis is a single file (e.g., a lockfile like conan.lock), + // do not add that source file itself as a component entry in the SBOM components list. + // This keeps behavior consistent across OSes and avoids listing the input document as a component. + var srcFilePath string + if fm, ok := s.Source.Metadata.(source.FileMetadata); ok { + srcFilePath = fm.Path + } + for _, coordinate := range coordinates { var metadata *file.Metadata // File Info @@ -72,6 +80,11 @@ func ToFormatModel(s sbom.SBOM) *cyclonedx.BOM { } metadata = &fileMetadata + // Skip adding the source file itself as a component (e.g., conan.lock when scanned directly) + if srcFilePath != "" && metadata.Path == srcFilePath { + continue + } + // Digests var digests []file.Digest if digestsForLocation, exists := artifacts.FileDigests[coordinate]; exists {