Syft

A CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Exceptional for vulnerability detection when used with a scanner like Grype.

Features

• Generates SBOMs for container images, filesystems, archives, and more to discover packages and libraries
• Supports OCI, Docker and Singularity image formats
• Linux distribution identification
• Works seamlessly with Grype (a fast, modern vulnerability scanner)
• Able to create signed SBOM attestations using the in-toto specification
• Convert between SBOM formats, such as CycloneDX, SPDX, and Syft’s own format.

Getting started

SBOM

To generate an SBOM for a container image:

syft <image>

The above output includes only software that is visible in the container (i.e., the squashed representation of the image). To include software from all image layers in the SBOM, regardless of its presence in the final image, provide --scope all-layers:

syft <image> --scope all-layers

Output formats

The output format for Syft is configurable as well using the -o (or --output) option:

syft <image> -o <format>

Where the formats available are:

• syft-json: Use this to get as much information out of Syft as possible!
• syft-text: A row-oriented, human-and-machine-friendly output.
• cyclonedx-xml: A XML report conforming to the CycloneDX 1.6 specification.
• cyclonedx-xml@1.5: A XML report conforming to the CycloneDX 1.5 specification.
• cyclonedx-json: A JSON report conforming to the CycloneDX 1.6 specification.
• cyclonedx-json@1.5: A JSON report conforming to the CycloneDX 1.5 specification.
• spdx-tag-value: A tag-value formatted report conforming to the SPDX 2.3 specification.
• spdx-tag-value@2.2: A tag-value formatted report conforming to the SPDX 2.2 specification.
• spdx-json: A JSON report conforming to the SPDX 2.3 JSON Schema.
• spdx-json@2.2: A JSON report conforming to the SPDX 2.2 JSON Schema.
• github-json: A JSON report conforming to GitHub’s dependency snapshot format.
• syft-table: A columnar summary (default).
• template: Lets the user specify the output format. See “Using templates” below.

Note that flags using the @<version> can be used for earlier versions of each specification as well.

Supported Ecosystems

• Alpine (apk)
• Bitnami packages
• C (conan)
• C++ (conan)
• Dart (pubs)
• Debian (dpkg)
• Dotnet (deps.json)
• Objective-C (cocoapods)
• Elixir (mix)
• Erlang (rebar3)
• Go (go.mod, Go binaries)
• Haskell (cabal, stack)
• Java (jar, ear, war, par, sar, nar, native-image)
• JavaScript (npm, yarn)
• Jenkins Plugins (jpi, hpi)
• Linux kernel archives (vmlinz)
• Linux kernel modules (ko)
• Nix (outputs in /nix/store)
• PHP (composer, PECL, Pear)
• Python (wheel, egg, poetry, requirements.txt, uv)
• Red Hat (rpm)
• Ruby (gem)
• Rust (cargo.lock, auditable binary)
• Swift (cocoapods, swift-package-manager)
• Wordpress plugins
• Terraform providers (.terraform.lock.hcl)