Repolode
Submit
anchore

anchore/syft

CLI tool and Go library that generates a Software Bill of Materials (SBOM) from container images and filesystems.

View on GitHub
Stars
9,850
Forks
1,042
Open issues
698
Last commit
20 hours ago

What is it?

Syft inspects container images, directories and archives to list the software packages they contain, then writes that inventory as an SBOM. It covers many packaging ecosystems, including Alpine apk, Debian dpkg, RPM, and language packages for Go, Python, Java, JavaScript, Ruby, Rust, PHP and .NET.

Output can be emitted in CycloneDX, SPDX and Syft's own JSON format, and SBOMs can be converted between these formats. Syft can also create signed SBOM attestations following the in-toto specification. It pairs with Grype, Anchore's vulnerability scanner, which reads Syft's SBOMs to find known vulnerabilities.

Beyond the CLI, Syft is available as a Go library so other tools can embed SBOM generation. It can also read local containers-storage images on Linux when requested explicitly.

Key features

  • 01Generates SBOMs for container images, filesystems and archives
  • 02Detects packages across many ecosystems such as apk, dpkg, RPM, Go, Python and Java
  • 03Outputs CycloneDX, SPDX and Syft JSON formats
  • 04Converts between SBOM formats
  • 05Creates signed in-toto SBOM attestations
  • 06Integrates with Grype for vulnerability scanning

Use cases

  • Producing an SBOM for a container image before shipping it to production
  • Auditing the open-source components inside a project directory
  • Feeding SBOMs into Grype to check dependencies for known vulnerabilities
  • Embedding SBOM generation in a Go tool through the library

Quick start

  1. 1

    Run the official install script from the README

  2. 2

    Scan a container image for its packages

    syft alpine:latest
  3. 3

    Scan a local directory

    syft ./my-project

Things to know

  • Scanning local containers-storage images is available on Linux only.
  • Vulnerability detection requires a separate scanner such as Grype.

Topics

#sbom#containers#supply-chain-security#vulnerability-scanning#docker#cyclonedx#spdx#golang#go#hacktoberfest

FAQ

What is syft?
CLI tool and Go library that generates a Software Bill of Materials (SBOM) from container images and filesystems. Syft inspects container images, directories and archives to list the software packages they contain, then writes that inventory as an SBOM. It covers many packaging ecosystems, including Alpine apk, Debian dpkg, RPM, and language packages for Go, Python, Java, JavaScript, Ruby, Rust, PHP and .NET.
Is syft free to use? What license does it have?
syft is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.
Is syft still maintained?
Actively maintained. The last commit to syft was on Nov 7, 2026.
What can I use syft for?
Producing an SBOM for a container image before shipping it to production Auditing the open-source components inside a project directory Feeding SBOMs into Grype to check dependencies for known vulnerabilities Embedding SBOM generation in a Go tool through the library
How do I install syft?
Run the official install script from the README Scan a container image for its packages: syft alpine:latest Scan a local directory: syft ./my-project
Where can I get syft?
The source code and installation instructions are on GitHub: https://github.com/anchore/syft

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects