Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Files

The Files view tracks file-level records from an SBOM separately from its components. When an SBOM declares individual files — source files, scripts, binaries — Interlynk imports them as dedicated file artifacts rather than mixing them into the component dependency tree.

Overview

A file artifact represents a single file declared in an SBOM document. Files are stored apart from components, so the Components tab stays focused on packages and dependencies while file-level detail lives on its own Files tab.

File artifacts are imported from:

  • SPDX — entries in the SBOM's files array (SPDX 2.x).

  • CycloneDX — components with type: "file".

Each file record carries its own name, version, checksums, license expressions, copyright, notice text, external references, and properties. Files can be annotated and linked back to the components they belong to.

SPDX packages are not treated as files even when their primary package purpose is SOURCE, ARCHIVE, FILE, or INSTALL. Only explicit SPDX file entries and CycloneDX file components become file artifacts. Packages remain components so they continue to participate in vulnerability scanning and policy evaluation.

Files vs. Components

Components
Files

Represents

Packages and dependencies

Individual file-level entries

Source

SPDX packages, CycloneDX non-file components

SPDX files array, CycloneDX type: "file"

Vulnerability scanning

Yes

No

Policy evaluation

Yes

No

Health and metrics

Yes

No

View

Components tab

Files tab

File artifacts are excluded from component workflows — they are not scanned for vulnerabilities, evaluated against policies, or counted in component metrics. They serve as a license and attribution record at the file level.

Files Tab

The Files tab appears on the SBOM detail view alongside General, Components, Vulnerabilities, and Licenses.

Viewing Files

  1. Open a Product and navigate to a Version.

  2. Click the Files tab on the SBOM detail page.

  3. The table lists one row per file artifact.

Column
Description

Name

File name

Declared License

License as declared in the SBOM

Concluded License

Concluded license expression

Copyright

Copyright text

Updated

When the file record was last updated

Filtering

Filter
Description

Search

Filter by file name

License

Filter files by license expression

Include Parts

Include file artifacts from referenced Part SBOMs

When Include Parts is enabled, the table also shows files contributed by the Version's Parts, with a Parts filter to narrow to specific Parts.

Editing Files

Each file row offers the following actions:

Action
Description

Edit File

Edit the file's license expressions, copyright, notice, external references, checksums, and properties

Edit Notes

Add or update annotations on the file

Apply File Attribution

Copy license, copyright, and notice information from the file to a linked component

File Attribution

A file artifact can be linked to a component as its source — a source_for relationship. This records that a given file is the source for a component, which is useful when a component's license or copyright is best evidenced at the file level.

Apply File Attribution copies attribution fields from a file to the component it is the source for:

  • Declared license expression

  • Concluded license expression

  • Copyright

  • Notice

Use this when a component lacks license or copyright metadata but the originating file carries it.

Including Files in Exports

By default, CycloneDX exports contain only package components. To include file artifacts in the exported document:

  1. Open the SBOM download dialog.

  2. Set the format to CycloneDX.

  3. Enable the File Artifacts option.

  4. Download.

When enabled, the export adds each file artifact as a CycloneDX file component and includes the file-level dependency relationships imported from the original CycloneDX SBOM. The option is available for CycloneDX exports only (not SPDX or PDF).

Exporting the Files Table as CSV

To export the file artifacts themselves rather than embed them in an SBOM, use the CSV export on the Files tab. This downloads the Files table — file name, license, copyright, and related columns — as a CSV file for offline review or sharing.

GraphQL API

File artifacts are exposed through the GraphQL API for automation:

  • The sbomFiles connection on an SBOM returns its file artifacts, with search and license filtering and optional inclusion of Part files.

  • SbomFileType exposes a file's name, version, checksums, declared and concluded license expressions, copyright, notice, external URLs, properties, annotations, and the components it is a source for.

  • Mutations support editing a file's attribution fields, creating and removing source_for links between a file and a component, and adding annotations.

For API access details, see API Key Management.

Recommended Best Practices

  • Use file artifacts for file-level license evidence. When component metadata is incomplete, link the originating file and apply its attribution.

  • Enable File Artifacts in CycloneDX exports when downstream consumers need file-level detail, and leave it off for a lighter, package-only document.

  • Annotate files with review notes to keep attribution decisions auditable.

  • Don't expect vulnerability data on files. Vulnerability scanning runs against components; keep packages classified as components for accurate scanning.

PreviousPackagesNextRequests

Last updated