syft
Builds a software bill of materials from a local directory, archive, or container image. Hunters use that SBOM to see which packages an artifact ships and to feed a local vulnerability matcher.
Tags: sbom, inventory, anchore
- Category
- utils
- Maintenance signal
- active
Use this when: Intake. These tools shape lists you already collected. They do not decide a finding.
Install
script
curl -sSfL https://get.anchore.io/syft | sudo sh -s -- -b /usr/local/binbrew
brew install syftwinget
winget install Anchore.SyftCommand templates
SBOM from a local path
syft {file} -o json