Syft – generate Software Bills of Materials

Syft is a command-line tool for generating Software Bills of Materials from container images, filesystems and archives.

It inventories the software packages present in a target, making the resulting data useful for software supply-chain analysis, compliance work and downstream vulnerability scanning. Syft understands a broad range of package ecosystems rather than being tied to a particular programming language or Linux distribution. It can inspect local directories as well as container images and can feed its results directly into other security tooling such as Anchore’s Grype scanner.

This is free and open source software.

Key Features

• Catalogs packages from container images, filesystems and archives.
• Recognises packages from Alpine, Debian and RPM-based systems.
• Supports Go, Python, Java, JavaScript, Ruby, Rust, PHP and .NET ecosystems.
• Understands OCI, Docker and Singularity container image formats.
• Produces CycloneDX and SPDX Software Bills of Materials.
• Offers its own detailed Syft JSON output format.
• Can emit multiple output formats from a single scan.
• Converts between supported SBOM representations.
• Integrates with Grype for vulnerability analysis.
• Creates signed SBOM attestations using the in-toto specification.
• Supports direct inspection of directories without first building a container image.
• Available as both a command-line application and a Go library.
• Configuration can be supplied through files, environment variables and command-line options.
• Suitable for local use and automated CI/CD workflows.

Website: github.com/anchore/syft
Support:
Developer: Anchore
License: Apache License 2.0

Syft is written in Go. Learn Go with our recommended free books and free tutorials.

Explore our comprehensive directory of recommended free and open source software. Our carefully curated collection spans every major software category. This directory is part of our ongoing series of informative articles for Linux enthusiasts. It features hundreds of detailed reviews, along with open source alternatives to proprietary solutions from major corporations such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. You’ll also find interesting projects to try, hardware coverage, free programming books and tutorials, and much more. Discovered a useful open source Linux program that we haven’t covered yet? Let us know by completing this form.