feat: deprecate --sbom in favor of just using -L (#1961)

I think the only difference between the two flags is that `--sbom` will
give you an extra message if you provide a file which we fail to make to
an extractor we give you an extra message about making sure to check the
filename, which I actually think is arguably better with `-L` because
imo you can't reasonably assume the scanner will be able to magically
figure out e.g. `my.awesome.file.json` is meant to be an SBOM unlike
with the current flag?

This is the first of part #1960

Author: G-Rath

cmd/osv-scanner/scan/source/__snapshots__/command_test.snap

@@ -1010,6 +1010,7 @@ No package sources found, --help for usage information.
 ---
 
 [TestCommand/one_file_that_does_not_match_the_supported_sbom_file_names - 1]
+Warning: --sbom has been deprecated in favor of -L
 Failed to parse SBOM "<rootdir>/fixtures/locks-many/composer.lock" with error: could not determine extractor suitable to this file
 If you believe this is a valid SBOM, make sure the filename follows format per your SBOMs specification.
 
@@ -1020,6 +1021,15 @@ could not determine extractor suitable to this file
 
 ---
 
+[TestCommand/one_file_that_does_not_match_the_supported_sbom_file_names_using_-L_flag - 1]
+
+---
+
+[TestCommand/one_file_that_does_not_match_the_supported_sbom_file_names_using_-L_flag - 2]
+could not determine extractor, requested spdx
+
+---
+
 [TestCommand/one_specific_supported_lockfile - 1]
 Scanning dir ./fixtures/locks-many/composer.lock
 Scanned <rootdir>/fixtures/locks-many/composer.lock file and found 1 package
@@ -1059,6 +1069,7 @@ No issues found
 ---
 
 [TestCommand/one_specific_supported_sbom_with_duplicate_PURLs - 1]
+Warning: --sbom has been deprecated in favor of -L
 Scanned <rootdir>/fixtures/sbom-insecure/with-duplicates.cdx.xml file and found 15 packages
 Filtered 1 local/unscannable package/s from the scan.
 +--------------------------------+------+-----------+---------+-----------+------------------------------------------------+
@@ -1075,7 +1086,25 @@ Filtered 1 local/unscannable package/s from the scan.
 
 ---
 
+[TestCommand/one_specific_supported_sbom_with_duplicate_PURLs_using_-L_flag - 1]
+Scanned <rootdir>/fixtures/sbom-insecure/with-duplicates.cdx.xml file and found 15 packages
+Filtered 1 local/unscannable package/s from the scan.
++--------------------------------+------+-----------+---------+-----------+------------------------------------------------+
+| OSV URL                        | CVSS | ECOSYSTEM | PACKAGE | VERSION   | SOURCE                                         |
++--------------------------------+------+-----------+---------+-----------+------------------------------------------------+
+| https://osv.dev/CVE-2025-26519 |      | Alpine    | musl    | 1.2.3-r4  | fixtures/sbom-insecure/with-duplicates.cdx.xml |
+| https://osv.dev/CVE-2018-25032 | 7.5  | Alpine    | zlib    | 1.2.10-r0 | fixtures/sbom-insecure/with-duplicates.cdx.xml |
+| https://osv.dev/CVE-2022-37434 | 9.8  | Alpine    | zlib    | 1.2.10-r0 | fixtures/sbom-insecure/with-duplicates.cdx.xml |
++--------------------------------+------+-----------+---------+-----------+------------------------------------------------+
+
+---
+
+[TestCommand/one_specific_supported_sbom_with_duplicate_PURLs_using_-L_flag - 2]
+
+---
+
 [TestCommand/one_specific_supported_sbom_with_invalid_PURLs - 1]
+Warning: --sbom has been deprecated in favor of -L
 Scanned <rootdir>/fixtures/sbom-insecure/bad-purls.cdx.xml file and found 15 packages
 Filtered 7 local/unscannable package/s from the scan.
 No issues found
@@ -1086,7 +1115,19 @@ No issues found
 
 ---
 
+[TestCommand/one_specific_supported_sbom_with_invalid_PURLs_using_-L_flag - 1]
+Scanned <rootdir>/fixtures/sbom-insecure/bad-purls.cdx.xml file and found 15 packages
+Filtered 7 local/unscannable package/s from the scan.
+No issues found
+
+---
+
+[TestCommand/one_specific_supported_sbom_with_invalid_PURLs_using_-L_flag - 2]
+
+---
+
 [TestCommand/one_specific_supported_sbom_with_vulns - 1]
+Warning: --sbom has been deprecated in favor of -L
 Scanned <rootdir>/fixtures/sbom-insecure/alpine.cdx.xml file and found 15 packages
 Filtered 1 local/unscannable package/s from the scan.
 +--------------------------------+------+-----------+---------+-----------+---------------------------------------+
@@ -1103,6 +1144,23 @@ Filtered 1 local/unscannable package/s from the scan.
 
 ---
 
+[TestCommand/one_specific_supported_sbom_with_vulns_using_-L_flag - 1]
+Scanned <rootdir>/fixtures/sbom-insecure/alpine.cdx.xml file and found 15 packages
+Filtered 1 local/unscannable package/s from the scan.
++--------------------------------+------+-----------+---------+-----------+---------------------------------------+
+| OSV URL                        | CVSS | ECOSYSTEM | PACKAGE | VERSION   | SOURCE                                |
++--------------------------------+------+-----------+---------+-----------+---------------------------------------+
+| https://osv.dev/CVE-2025-26519 |      | Alpine    | musl    | 1.2.3-r4  | fixtures/sbom-insecure/alpine.cdx.xml |
+| https://osv.dev/CVE-2018-25032 | 7.5  | Alpine    | zlib    | 1.2.10-r0 | fixtures/sbom-insecure/alpine.cdx.xml |
+| https://osv.dev/CVE-2022-37434 | 9.8  | Alpine    | zlib    | 1.2.10-r0 | fixtures/sbom-insecure/alpine.cdx.xml |
++--------------------------------+------+-----------+---------+-----------+---------------------------------------+
+
+---
+
+[TestCommand/one_specific_supported_sbom_with_vulns_using_-L_flag - 2]
+
+---
+
 [TestCommand/one_specific_unsupported_lockfile - 1]
 Scanning dir ./fixtures/locks-many/not-a-lockfile.toml
 

cmd/osv-scanner/scan/source/command.go

@@ -28,9 +28,14 @@ func Command(stdout, stderr io.Writer) *cli.Command {
 				TakesFile: true,
 			},
 			&cli.StringSliceFlag{
-				Name:      "sbom",
-				Aliases:   []string{"S"},
-				Usage:     "scan sbom file on this path, the sbom file name must follow the relevant spec",
+				Name:    "sbom",
+				Aliases: []string{"S"},
+				Usage:   "[DEPRECATED] scan sbom file on this path, the sbom file name must follow the relevant spec",
+				Action: func(_ context.Context, _ *cli.Command, _ []string) error {
+					slog.Warn("Warning: --sbom has been deprecated in favor of -L")
+
+					return nil
+				},
 				TakesFile: true,
 			},
 			&cli.BoolFlag{

cmd/osv-scanner/scan/source/command_test.go

@@ -37,24 +37,44 @@ func TestCommand(t *testing.T) {
 			Args: []string{"", "source", "--config=./fixtures/osv-scanner-empty-config.toml", "--sbom", "./fixtures/sbom-insecure/alpine.cdx.xml"},
 			Exit: 1,
 		},
+		{
+			Name: "one specific supported sbom with vulns using -L flag",
+			Args: []string{"", "source", "--config=./fixtures/osv-scanner-empty-config.toml", "-L", "./fixtures/sbom-insecure/alpine.cdx.xml"},
+			Exit: 1,
+		},
 		// one specific supported sbom with vulns and invalid PURLs
 		{
 			Name: "one specific supported sbom with invalid PURLs",
 			Args: []string{"", "source", "--config=./fixtures/osv-scanner-empty-config.toml", "--sbom", "./fixtures/sbom-insecure/bad-purls.cdx.xml"},
 			Exit: 0,
 		},
+		{
+			Name: "one specific supported sbom with invalid PURLs using -L flag",
+			Args: []string{"", "source", "--config=./fixtures/osv-scanner-empty-config.toml", "-L", "./fixtures/sbom-insecure/bad-purls.cdx.xml"},
+			Exit: 0,
+		},
 		// one specific supported sbom with duplicate PURLs
 		{
 			Name: "one specific supported sbom with duplicate PURLs",
 			Args: []string{"", "source", "--config=./fixtures/osv-scanner-empty-config.toml", "--sbom", "./fixtures/sbom-insecure/with-duplicates.cdx.xml"},
 			Exit: 1,
 		},
+		{
+			Name: "one specific supported sbom with duplicate PURLs using -L flag",
+			Args: []string{"", "source", "--config=./fixtures/osv-scanner-empty-config.toml", "-L", "./fixtures/sbom-insecure/with-duplicates.cdx.xml"},
+			Exit: 1,
+		},
 		// one file that does not match the supported sbom file names
 		{
 			Name: "one file that does not match the supported sbom file names",
 			Args: []string{"", "source", "--config=./fixtures/osv-scanner-empty-config.toml", "--sbom", "./fixtures/locks-many/composer.lock"},
 			Exit: 127,
 		},
+		{
+			Name: "one file that does not match the supported sbom file names using -L flag",
+			Args: []string{"", "source", "--config=./fixtures/osv-scanner-empty-config.toml", "-L", "spdx:./fixtures/locks-many/composer.lock"},
+			Exit: 127,
+		},
 		// one specific unsupported lockfile
 		{
 			Name: "one specific unsupported lockfile",

docs/scan-source.md

@@ -37,17 +37,9 @@ There is a [known issue](https://github.com/google/osv-scanner/issues/209) that
 
 The `--no-ignore` flag can be used to force the scanner to scan ignored files.
 
-## Specify SBOM
+## SBOM scanning
 
-If you want to check for known vulnerabilities only in dependencies in your SBOM, you can use the following command:
-
-```bash
-osv-scanner scan source --sbom=/path/to/your/sbom.spdx.json
-```
-
-[SPDX] and [CycloneDX] SBOMs using [Package URLs] are supported.
-
-To identify the correct SBOM format, the file name must follow the SBOM specifications for each format:
+SBOMs will be automatically identified so long as their name follows the specification for the particular format:
 
 - [SPDX Filenames]:
   - `*.spdx.json`
@@ -61,6 +53,12 @@ To identify the correct SBOM format, the file name must follow the SBOM specific
   - `bom.xml`
   - `*.cdx.xml`
 
+```bash
+osv-scanner scan source -L /path/to/your/sbom.spdx.json
+```
+
+[SPDX] and [CycloneDX] SBOMs using [Package URLs] are supported.
+
 [SPDX]: https://spdx.dev/
 [SPDX Filenames]: https://spdx.github.io/spdx-spec/v2.3/conformance/
 [CycloneDX Filenames]: https://cyclonedx.org/specification/overview/#recognized-file-patterns

pkg/osvscanner/osvscanner.go

@@ -40,7 +40,6 @@ import (
 
 type ScannerActions struct {
 	LockfilePaths      []string
-	SBOMPaths          []string
 	DirectoryPaths     []string
 	GitCommits         []string
 	Recursive          bool
@@ -61,6 +60,9 @@ type ScannerActions struct {
 	ScanLicensesSummary   bool
 	ScanLicensesAllowlist []string
 
+	// Deprecated: in favor of LockfilePaths
+	SBOMPaths []string
+
 	ExperimentalScannerActions
 }