Imported manifest
Parses a single uploaded file as the Seal Project's package picture.
In imported manifest mode, you give Seal a single file describing your dependencies. The Seal Platform parses the file once and uses that snapshot as the Seal Project's picture of your environment. The mode is well-suited to one-shot evaluation and to importing data from another tool, but it does not refresh.
What it sees
Imported manifest mode sees whatever was in the file you uploaded, and nothing more. Supported file types include:
Dependency manifests (
package-lock.json,requirements.txt,pom.xml,composer.lock, and other ecosystem-specific files).Software Bill of Materials (SBOM) files in CycloneDX or SPDX format.
Snyk exports (CSV from a Snyk project, or via the Snyk integration).
What imported manifest mode does not see:
Anything that changes after the upload. The snapshot ages from the moment it is uploaded; subsequent commits, builds, or pulls do not refresh it.
Anything not in the file. If the manifest only declares direct dependencies, Seal does not infer transitives.
What Seal needs
The file. No SCM connection, no CLI integration, no artifact-server pull required.
When to choose this mode
You want a quick evaluation of Seal against an existing snapshot of your environment, without setting up an integration.
A vendor or another team has provided you with an SBOM you need to assess.
You have an existing Snyk export and want to bring its data into Seal.
For ongoing remediation, you will eventually want a higher-reliability mode (CLI or source code). Imported manifest mode is most useful as a starting point or for one-shot work.
Setting it up
To upload a file, see Importing manifests & SBOMs.
Related
Importing manifests & SBOMs: the upload flows for each supported file type.
How Seal discovers your packages: how imported manifest mode compares to the other three.
Last updated