Syft is a command-line tool for generating Software Bills of Materials from container images, filesystems and archives.
It inventories the software packages present in a target, making the resulting data useful for software supply-chain analysis, compliance work and downstream vulnerability scanning. Syft understands a broad range of package ecosystems rather than being tied to a particular programming language or Linux distribution. It can inspect local directories as well as container images and can feed its results directly into other security tooling such as Anchore’s Grype scanner.
This is free and open source software.
Key Features
- Catalogs packages from container images, filesystems and archives.
- Recognises packages from Alpine, Debian and RPM-based systems.
- Supports Go, Python, Java, JavaScript, Ruby, Rust, PHP and .NET ecosystems.
- Understands OCI, Docker and Singularity container image formats.
- Produces CycloneDX and SPDX Software Bills of Materials.
- Offers its own detailed Syft JSON output format.
- Can emit multiple output formats from a single scan.
- Converts between supported SBOM representations.
- Integrates with Grype for vulnerability analysis.
- Creates signed SBOM attestations using the in-toto specification.
- Supports direct inspection of directories without first building a container image.
- Available as both a command-line application and a Go library.
- Configuration can be supplied through files, environment variables and command-line options.
- Suitable for local use and automated CI/CD workflows.
Website: github.com/anchore/syft
Support:
Developer: Anchore
License: Apache License 2.0
Syft is written in Go. Learn Go with our recommended free books and free tutorials.
Related Software
| Software Bills of Materials | |
|---|---|
| Syft | Catalog packages and dependencies in images and filesystems |
| ScanCode Toolkit | Detect licences, copyrights and package metadata in source code |
| ORT | Automate dependency analysis, licence compliance and policy checks |
| SBOM Tool | Create SPDX-compatible component inventories at scale |
| Trivy | Scan containers and filesystems for vulnerabilities and licence issues |
| bom | Create, inspect, transform and validate SPDX manifests |
| CycloneDX CLI | Analyse, merge, convert, sign and validate CycloneDX documents |
| sbomnix | Analyse Nix packages for dependencies, licences and vulnerabilities |
Read our verdict in the software roundup.
 LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software.We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README. |
Please read our Comment Policy before commenting.