Syft is a command-line tool for generating Software Bills of Materials from container images, filesystems and archives.
It inventories the software packages present in a target, making the resulting data useful for software supply-chain analysis, compliance work and downstream vulnerability scanning. Syft understands a broad range of package ecosystems rather than being tied to a particular programming language or Linux distribution. It can inspect local directories as well as container images and can feed its results directly into other security tooling such as Anchore’s Grype scanner.
This is free and open source software.
Key Features
- Catalogs packages from container images, filesystems and archives.
- Recognises packages from Alpine, Debian and RPM-based systems.
- Supports Go, Python, Java, JavaScript, Ruby, Rust, PHP and .NET ecosystems.
- Understands OCI, Docker and Singularity container image formats.
- Produces CycloneDX and SPDX Software Bills of Materials.
- Offers its own detailed Syft JSON output format.
- Can emit multiple output formats from a single scan.
- Converts between supported SBOM representations.
- Integrates with Grype for vulnerability analysis.
- Creates signed SBOM attestations using the in-toto specification.
- Supports direct inspection of directories without first building a container image.
- Available as both a command-line application and a Go library.
- Configuration can be supplied through files, environment variables and command-line options.
- Suitable for local use and automated CI/CD workflows.
Website: github.com/anchore/syft
Support:
Developer: Anchore
License: Apache License 2.0
Syft is written in Go. Learn Go with our recommended free books and free tutorials.
Related Software
| Software Bills of Materials | |
|---|---|
| Syft | Catalog packages and dependencies in images and filesystems |
| ScanCode Toolkit | Detect licences, copyrights and package metadata in source code |
| ORT | Automate dependency analysis, licence compliance and policy checks |
| SBOM Tool | Create SPDX-compatible component inventories at scale |
| Trivy | Scan containers and filesystems for vulnerabilities and licence issues |
| bom | Create, inspect, transform and validate SPDX manifests |
| CycloneDX CLI | Analyse, merge, convert, sign and validate CycloneDX documents |
| sbomnix | Analyse Nix packages for dependencies, licences and vulnerabilities |
Read our verdict in the software roundup.
 Explore our carefully curated directory of recommended free and open source software, covering every major software category.The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form. |
Please read our Comment Policy before commenting.