syft
Syft is a command line tool and Go library designed to create a Software Material List (SBOM) from container images and file systems. It supports numerous packaging ecosystems, container image format, and output format. You can convert between formats such as CycloneDX, SPDX and Syft JSON and create signed SBOM validations using the in-toto specification.
SY
syft
75anchore · Code Quality & Review
STARS9.8K
FORKS1.0K
COMMITS0
CONTRIBUTORS0
VERSIONv1.52.0
UPDATEDtoday
GoSBOMContainerCLIApache-2.0
Common commercial products in this category: SonarCloud, Codacy, DeepSource
What can it do?
- You can produce SBOM for Konteyner images, archives and file systems.
- You can convert between CycloneDX, SPDX and Syft JSON formats.
- You can use it in conjunction with the Grype browser to detect vulnerabilities.
Heads up
- • High number of open issues (700)