4.1 KiB
syft
A CLI tool and go library for generating a Software Bill of Materials (SBOM) from container images and filesystems.
Features
- Catalog container images and filesystems to discover packages and libraries.
- Supports packages and libraries from various ecosystems (APK, DEB, RPM, Ruby Bundles, Python Wheel/Egg/requirements.txt, JavaScript NPM/Yarn, Java JAR/EAR/WAR, Jenkins plugins JPI/HPI, Go modules)
- Linux distribution identification (supports Alpine, BusyBox, CentOS/RedHat, Debian/Ubuntu flavored distributions)
- Supports Docker and OCI image formats
If you encounter an issue, please let us know using the issue tracker.
Getting started
To generate an SBOM for a Docker or OCI image:
syft <image>
The above output includes only software that is visible in the container (i.e., the squashed representation of the image).
To include software from all image layers in the SBOM, regardless of its presence in the final image, provide --scope all-layers:
syft <image> --scope all-layers
Syft can generate a SBOM from a variety of sources:
# catalog a container image archive (from the result of `docker image save ...`, `podman save ...`, or `skopeo copy` commands)
syft path/to/image.tar
# catalog a directory
syft path/to/dir
The output format for Syft is configurable as well:
syft <image> -o <format>
Where the formats available are:
json: Use this to get as much information out of Syft as possible!text: A row-oriented, human-and-machine-friendly output.cyclonedx: A XML report conforming to the CycloneDX 1.2 specification.table: A columnar summary (default).
Installation
Recommended
# install the latest version to /usr/local/bin
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
# install a specific version into a specific dir
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b <SOME_BIN_PATH> <RELEASE_VERSION>
macOS
brew tap anchore/syft
brew install syft
You may experience a "macOS cannot verify app is free from malware" error upon running Syft because it is not yet signed and notarized. You can override this using xattr.
xattr -rd com.apple.quarantine syft
Configuration
Configuration search paths:
.syft.yaml.syft/config.yaml~/.syft.yaml<XDG_CONFIG_HOME>/syft/config.yaml
Configuration options (example values are the default):
# same as -o ; the output format of the SBOM report (options: table, text, json)
output: "table"
# same as -s ; the search space to look for packages (options: all-layers, squashed)
scope: "squashed"
# same as -q ; suppress all output (except for the SBOM report)
quiet: false
log:
# use structured logging
structured: false
# the log level; note: detailed logging suppress the ETUI
level: "error"
# location to write the log file (default is not to have a log file)
file: ""
# enable/disable checking for application updates on startup
check-for-app-update: true
Future plans
The following areas of potential development are currently being investigated:
- Establish a stable interchange format w/Grype