feat: Add experimental flag --include-provenance to support package provenance work #6233

calhar-snyk · 2025-10-16T16:57:36Z

Pull Request Submission Checklist

Follows CONTRIBUTING guidelines
Commit messages
are release-note ready, emphasizing
what was changed, not how.
Includes detailed description of changes
Contains risk assessment (Low | Medium | High)
Highlights breaking API changes (if applicable)
Links to automated tests covering new functionality
Includes manual testing instructions (if necessary)
Updates relevant GitBook documentation (PR link: https://app.gitbook.com/o/-M4tdxG8qotLgGZnLpFR/s/-MdwVZ6HOZriajCf5nXH/~/diff/~/changes/9908/developer-tools/snyk-cli/commands/sbom)
Includes product update to be announced in the next stable release notes

What does this PR do?

This updates snyk-mvn-plugin and introduces some new command options to enable these PRS:

Additionally, updates the associated cli extensions to enable the command option for snyk sbom:

This enables the use of the --include-provenance flag for the test and sbom commands on maven projects.
--include-provenance will result in the DepGraph produced by snyk test including a purl entry for the packages, which if artifacts were present in the local repository will contain a checksum qualifier. This can be visibly observed via the --print-graph option. e.g.:

❯ ~/code/cli/binary-releases/snyk-macos-arm64 test --file=pom.xml --include-provenance --print-graph
DepGraph data:
{"schemaVersion":"1.3.0","pkgManager":{"name":"maven"},"pkgs":[{"id":"io.snyk.os-managed:[email protected]","info":{"name":"io.snyk.os-managed:snapshot-child","version":"1.0.0","purl":"pkg:maven/io.snyk.os-managed/[email protected]?checksum=sha1%3A200129d570b96779b8dc966befc9d8eee0ef11fc"}},{"id":"com.google.guava:[email protected]","info":{"name":"com.google.guava:guava","version":"33.3.1-jre","purl":"pkg:maven/com.google.guava/[email protected]?checksum=sha1%3A852f8b363da0111e819460021ca693cacca3e8db"}},{"id":"com.google.j2objc:[email protected]","info":{"name":"com.google.j2objc:j2objc-annotations","version":"3.0.0","purl":"pkg:maven/com.google.j2objc/[email protected]?checksum=sha1%3A7399e65dd7e9ff3404f4535b2f017093bdb134c7"}},{"id":"com.google.errorprone:[email protected]","info":{"name":"com.google.errorprone:error_prone_annotations","version":"2.28.0","purl":"pkg:maven/com.google.errorprone/[email protected]?checksum=sha1%3A59fc00087ce372de42e394d2c789295dff2d19f0"}},{"id":"org.checkerframework:[email protected]","info":{"name":"org.checkerframework:checker-qual","version":"3.43.0","purl":"pkg:maven/org.checkerframework/[email protected]?checksum=sha1%3A9425eee39e56b116d2b998b7c2cebcbd11a3c98b"}},{"id":"com.google.code.findbugs:[email protected]","info":{"name":"com.google.code.findbugs:jsr305","version":"3.0.2","purl":"pkg:maven/com.google.code.findbugs/[email protected]?checksum=sha1%3A25ea2e8b0c338a877313bd4672d3fe056ea78f0d"}},{"id":"com.google.guava:[email protected]","info":{"name":"com.google.guava:listenablefuture","version":"9999.0-empty-to-avoid-conflict-with-guava","purl":"pkg:maven/com.google.guava/[email protected]?checksum=sha1%3Ab421526c5f297295adef1c886e5246c39d4ac629"}},{"id":"com.google.guava:[email protected]","info":{"name":"com.google.guava:failureaccess","version":"1.0.2","purl":"pkg:maven/com.google.guava/[email protected]?checksum=sha1%3Ac4a06a64e650562f30b7bf9aaec1bfed43aca12b"}}],"graph":{"rootNodeId":"root-node","nodes":[{"nodeId":"root-node","pkgId":"io.snyk.os-managed:[email protected]","deps":[{"nodeId":"com.google.guava:guava:jar:33.3.1-jre:compile"}]},{"nodeId":"com.google.guava:guava:jar:33.3.1-jre:compile","pkgId":"com.google.guava:[email protected]","deps":[{"nodeId":"com.google.j2objc:j2objc-annotations:jar:3.0.0:compile"},{"nodeId":"com.google.errorprone:error_prone_annotations:jar:2.28.0:compile"},{"nodeId":"org.checkerframework:checker-qual:jar:3.43.0:compile"},{"nodeId":"com.google.code.findbugs:jsr305:jar:3.0.2:compile"},{"nodeId":"com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava:compile"},{"nodeId":"com.google.guava:failureaccess:jar:1.0.2:compile"}]},{"nodeId":"com.google.j2objc:j2objc-annotations:jar:3.0.0:compile","pkgId":"com.google.j2objc:[email protected]","deps":[]},{"nodeId":"com.google.errorprone:error_prone_annotations:jar:2.28.0:compile","pkgId":"com.google.errorprone:[email protected]","deps":[]},{"nodeId":"org.checkerframework:checker-qual:jar:3.43.0:compile","pkgId":"org.checkerframework:[email protected]","deps":[]},{"nodeId":"com.google.code.findbugs:jsr305:jar:3.0.2:compile","pkgId":"com.google.code.findbugs:[email protected]","deps":[]},{"nodeId":"com.google.guava:listenablefuture:jar:9999.0-empty-to-avoid-conflict-with-guava:compile","pkgId":"com.google.guava:[email protected]","deps":[]},{"nodeId":"com.google.guava:failureaccess:jar:1.0.2:compile","pkgId":"com.google.guava:[email protected]","deps":[]}]}}
DepGraph target:
pom.xml
DepGraph end

This is also available via snyk sbom which will produce an sbom where the purl also has these qualifiers, e.g.:

❯ ~/code/cli/binary-releases/snyk-macos-arm64 sbom --format=cyclonedx1.6+json --include-provenance | jq '.'
{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:9e712a07-a81b-4634-88ad-16940fa22173",
  "version": 1,
  "metadata": {
    "timestamp": "2025-10-17T12:15:11Z",
    "tools": {
      "components": [
        {
          "type": "application",
          "author": "Snyk",
          "name": "snyk-cli",
          "version": "1.1301.0-dev.8078eba1c0c9e10a3c7a8a7f6137e809789b3359"
        }
      ],
      "services": [
        {
          "provider": {
            "name": "Snyk"
          },
          "name": "SBOM Export API",
          "version": "v1.112.2-3-gc8f4500"
        }
      ]
    },
    "component": {
      "bom-ref": "1-io.snyk.os-managed:[email protected]",
      "type": "application",
      "name": "io.snyk.os-managed:snapshot-child",
      "version": "1.0.0",
      "purl": "pkg:maven/io.snyk.os-managed/[email protected]?checksum=sha1%3A200129d570b96779b8dc966befc9d8eee0ef11fc"
    }
  },
  "components": [
    {
      "bom-ref": "2-com.google.guava:[email protected]",
      "type": "library",
      "group": "com.google.guava",
      "name": "com.google.guava:guava",
      "version": "33.3.1-jre",
      "licenses": [
        {
          "expression": "Apache-2.0"
        }
      ],
      "purl": "pkg:maven/com.google.guava/[email protected]?checksum=sha1%3A852f8b363da0111e819460021ca693cacca3e8db"
    },
    {
      "bom-ref": "3-com.google.j2objc:[email protected]",
      "type": "library",
      "group": "com.google.j2objc",
      "name": "com.google.j2objc:j2objc-annotations",
      "version": "3.0.0",
      "licenses": [
        {
          "expression": "Apache-2.0"
        }
      ],
      "purl": "pkg:maven/com.google.j2objc/[email protected]?checksum=sha1%3A7399e65dd7e9ff3404f4535b2f017093bdb134c7"
    },
    {
      "bom-ref": "4-com.google.errorprone:[email protected]",
      "type": "library",
      "group": "com.google.errorprone",
      "name": "com.google.errorprone:error_prone_annotations",
      "version": "2.28.0",
      "licenses": [
        {
          "expression": "Apache-2.0"
        }
      ],
      "purl": "pkg:maven/com.google.errorprone/[email protected]?checksum=sha1%3A59fc00087ce372de42e394d2c789295dff2d19f0"
    },
    {
      "bom-ref": "5-org.checkerframework:[email protected]",
      "type": "library",
      "group": "org.checkerframework",
      "name": "org.checkerframework:checker-qual",
      "version": "3.43.0",
      "licenses": [
        {
          "expression": "MIT"
        }
      ],
      "purl": "pkg:maven/org.checkerframework/[email protected]?checksum=sha1%3A9425eee39e56b116d2b998b7c2cebcbd11a3c98b"
    },
    {
      "bom-ref": "6-com.google.code.findbugs:[email protected]",
      "type": "library",
      "group": "com.google.code.findbugs",
      "name": "com.google.code.findbugs:jsr305",
      "version": "3.0.2",
      "licenses": [
        {
          "expression": "Apache-2.0"
        }
      ],
      "purl": "pkg:maven/com.google.code.findbugs/[email protected]?checksum=sha1%3A25ea2e8b0c338a877313bd4672d3fe056ea78f0d"
    },
    {
      "bom-ref": "7-com.google.guava:[email protected]",
      "type": "library",
      "group": "com.google.guava",
      "name": "com.google.guava:listenablefuture",
      "version": "9999.0-empty-to-avoid-conflict-with-guava",
      "licenses": [
        {
          "expression": "Apache-2.0"
        }
      ],
      "purl": "pkg:maven/com.google.guava/[email protected]?checksum=sha1%3Ab421526c5f297295adef1c886e5246c39d4ac629"
    },
    {
      "bom-ref": "8-com.google.guava:[email protected]",
      "type": "library",
      "group": "com.google.guava",
      "name": "com.google.guava:failureaccess",
      "version": "1.0.2",
      "licenses": [
        {
          "expression": "Apache-2.0"
        }
      ],
      "purl": "pkg:maven/com.google.guava/[email protected]?checksum=sha1%3Ac4a06a64e650562f30b7bf9aaec1bfed43aca12b"
    }
  ],
  "dependencies": [
    {
      "ref": "1-io.snyk.os-managed:[email protected]",
      "dependsOn": [
        "2-com.google.guava:[email protected]"
      ]
    },
    {
      "ref": "2-com.google.guava:[email protected]",
      "dependsOn": [
        "3-com.google.j2objc:[email protected]",
        "4-com.google.errorprone:[email protected]",
        "5-org.checkerframework:[email protected]",
        "6-com.google.code.findbugs:[email protected]",
        "7-com.google.guava:[email protected]",
        "8-com.google.guava:[email protected]"
      ]
    },
    {
      "ref": "3-com.google.j2objc:[email protected]"
    },
    {
      "ref": "4-com.google.errorprone:[email protected]"
    },
    {
      "ref": "5-org.checkerframework:[email protected]"
    },
    {
      "ref": "6-com.google.code.findbugs:[email protected]"
    },
    {
      "ref": "7-com.google.guava:[email protected]"
    },
    {
      "ref": "8-com.google.guava:[email protected]"
    }
  ]
}

Where should the reviewer start?

The tests outline some of the expected behaviour, they may also wish to examine the underlying PRS:

How should this be manually tested?

For correctly testing any maven project, it will first need to have the artifacts present in the local repository. Either via mvn clean install -DskipTests or similar commands.

Build cliv2 locally via npm install && npm run build-cli:prod, then make clean pre-build build.
I have run into various issues trying to build this locally, requiring some local changes and re-running make build.

This builds a release at /path/to/cli/binary-releases/snyk-${arch}, e.g. ~/code/cli/binary-releases/snyk-macos-arm64

/path/to/cli/binary-releases/snyk-macos-arm64 auth

Then test projects via:

/path/to/cli/binary-releases/snyk-macos-arm64 test --file=pom.xml --include-provenance --print-graph
/path/to/cli/binary-releases/snyk-macos-arm64 sbom --format=cyclonedx1.6+json --include-provenance

What's the product update that needs to be communicated to CLI users?

test(maven): A new experimental flag --include-provenance that will produce DepGraphs containing purls with checksum qualifiers for each package. Primarily to be used via --print-graph, not yet used in the main testing flow.
sbom(maven): A new experimental flag --include-provenance that will produce an SBOM with checksum qualifiers in each purl.

Risk assessment Low

Optional flag, no negative impact on snyk test or snyk sbom commands:

❯ ~/code/cli/binary-releases/snyk-macos-arm64 test --file=pom.xml --include-provenance

Testing /Users/calumharrison/IdeaProjects/snapshot-child...

Organization:      randd-enablement-template
Package manager:   maven
Target file:       pom.xml
Project name:      io.snyk.os-managed:snapshot-child
Open source:       no
Project path:      /Users/calumharrison/IdeaProjects/snapshot-child
Licenses:          enabled

✔ Tested 7 dependencies for known issues, no vulnerable paths found.

Next steps:
- Run `snyk monitor` to be notified about new related vulnerabilities.
- Run `snyk test` as part of your CI/test.

Any background context you want to provide?

In order to support more accurate package provenance we're going to add support to the package issues api for checksum qualifiers on the purl in the request. Beginning with the Maven ecosystem, this will use the provided checksum to check whether the dependency is an exact match to the one we have recorded, or if there is some mismatch. API responses can then be adjusted accordinly

What are the relevant tickets?

OSE-104

snyk-io · 2025-10-16T16:57:58Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

github-actions · 2025-10-16T16:58:39Z

	Warnings
⚠️	Please make changes to `snyk help` text in Gitbook. Changes will be automatically synchronised to Snyk CLI as a scheduled PR. For more information, see: `help/README.md`.
⚠️	Since the CLI is unifying on a standard and improved tooling, we're starting to migrate old-style `import`s and `export`s to ES6 ones. A file you've modified is using either `module.exports` or `require()`. If you can, please update them to ES6 import syntax and export syntax. Files found: `src/cli/args.ts`

Generated by 🚫 dangerJS against 5b8fe0a

calhar-snyk · 2025-10-17T11:34:55Z

Warnings
⚠️
Please make changes to snyk help text in Gitbook. Changes will be automatically synchronised to Snyk CLI as a scheduled PR. For more information, see: help/README.md.

⚠️
Since the CLI is unifying on a standard and improved tooling, we're starting to migrate old-style imports and exports to ES6 ones. A file you've modified is using either module.exports or require(). If you can, please update them to ES6 import syntax and export syntax. Files found:

src/cli/args.ts

Generated by 🚫 dangerJS against 5a10f49

Re: these warnings.

Will updated gitbook text after merging: https://app.gitbook.com/o/-M4tdxG8qotLgGZnLpFR/s/-MdwVZ6HOZriajCf5nXH/~/diff/~/changes/9908/developer-tools/snyk-cli/commands/sbom
src/cli/args.ts contains a few comments like this, so I'll be leaving that for cli maintainers:

  // By passing `-d` to the CLI, we enable the debugging output.
  // It needs to happen BEFORE any of the `debug(namespace)` calls needed to create loggers.
  // Therefore, the code used by the CLI should create the loggers in a lazy fashion
  // or be `require`d after this code.
  ...
  // Late require, see the note re "debug" option above.

calhar-snyk force-pushed the feat/OSM-3052-support-maven-artifact-fingerprinting branch 7 times, most recently from 7b30388 to 5a10f49 Compare October 17, 2025 11:05

calhar-snyk changed the title ~~Feat/osm 3052 support maven artifact fingerprinting~~ feat: Add experimental flag --include-provenance to support package provenance work Oct 17, 2025

calhar-snyk marked this pull request as ready for review October 17, 2025 14:30

calhar-snyk requested review from a team as code owners October 17, 2025 14:30

calhar-snyk force-pushed the feat/OSM-3052-support-maven-artifact-fingerprinting branch 2 times, most recently from 73ce97c to d5ee351 Compare October 20, 2025 11:06

danlucian approved these changes Oct 20, 2025

View reviewed changes

calhar-snyk force-pushed the feat/OSM-3052-support-maven-artifact-fingerprinting branch from d5ee351 to ccc4227 Compare October 21, 2025 10:58

feat: Adds experimental support for package provenance in test/sbom

5b8fe0a

calhar-snyk force-pushed the feat/OSM-3052-support-maven-artifact-fingerprinting branch from ccc4227 to 5b8fe0a Compare October 21, 2025 12:48

calhar-snyk merged commit f03c662 into main Oct 21, 2025
8 checks passed

calhar-snyk deleted the feat/OSM-3052-support-maven-artifact-fingerprinting branch October 21, 2025 13:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: Add experimental flag --include-provenance to support package provenance work #6233

feat: Add experimental flag --include-provenance to support package provenance work #6233

Uh oh!

calhar-snyk commented Oct 16, 2025 •

edited

Loading

Uh oh!

snyk-io bot commented Oct 16, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Oct 16, 2025 •

edited

Loading

Uh oh!

calhar-snyk commented Oct 17, 2025 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

feat: Add experimental flag --include-provenance to support package provenance work #6233

feat: Add experimental flag --include-provenance to support package provenance work #6233

Uh oh!

Conversation

calhar-snyk commented Oct 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Submission Checklist

What does this PR do?

Where should the reviewer start?

How should this be manually tested?

What's the product update that needs to be communicated to CLI users?

Risk assessment Low

Any background context you want to provide?

What are the relevant tickets?

Uh oh!

snyk-io bot commented Oct 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

github-actions bot commented Oct 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

calhar-snyk commented Oct 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

calhar-snyk commented Oct 16, 2025 •

edited

Loading

snyk-io bot commented Oct 16, 2025 •

edited

Loading

github-actions bot commented Oct 16, 2025 •

edited

Loading

calhar-snyk commented Oct 17, 2025 •

edited

Loading