sbom-syft

Syft SBOM Generator

Overview

Syft is a CLI tool and Go library for generating comprehensive Software Bills of Materials (SBOMs) from container images and filesystems. It provides visibility into packages and dependencies across 28+ ecosystems, supporting multiple SBOM formats (CycloneDX, SPDX) for vulnerability management, license compliance, and supply chain security.

Supported Ecosystems

Languages & Package Managers: Alpine (apk), C/C++ (conan), Dart (pub), Debian/Ubuntu (dpkg), Dotnet (deps.json), Go (go.mod), Java (JAR/WAR/EAR/Maven/Gradle), JavaScript (npm/yarn), PHP (composer), Python (pip/poetry/setup.py), Red Hat (RPM), Ruby (gem), Rust (cargo), Swift (cocoapods)

Container & System: OCI images, Docker images, Singularity, container layers, Linux distributions

Quick Start

Generate SBOM for container image:

# Using Docker
docker run --rm -v $(pwd):/out anchore/syft:latest <image> -o cyclonedx-json=/out/sbom.json

# Local installation
syft <image> -o cyclonedx-json=sbom.json

# Examples
syft alpine:latest -o cyclonedx-json
syft docker.io/nginx:latest -o spdx-json
syft dir:/path/to/project -o cyclonedx-json

Core Workflows

Workflow 1: Container Image SBOM Generation

For creating SBOMs of container images:

1. Identify target container image (local or registry)
2. Run Syft to generate SBOM:

``bash syft <image-name:tag> -o cyclonedx-json=sbom-cyclonedx.json ``

1. Optionally generate multiple formats:

``bash syft <image-name:tag> \ -o cyclonedx-json=sbom-cyclonedx.json \ -o spdx-json=sbom-spdx.json \ -o syft-json=sbom-syft.json ``

1. Store SBOM artifacts with image for traceability
2. Use SBOM for vulnerability scanning with Grype or other tools
3. Track SBOM versions alongside image releases

Workflow 2: CI/CD Pipeline Integration

Progress: [ ] 1. Add Syft to build pipeline after image creation [ ] 2. Generate SBOM in standard format (CycloneDX or SPDX) [ ] 3. Store SBOM as build artifact [ ] 4. Scan SBOM for vulnerabilities (using Grype or similar) [ ] 5. Fail build on critical vulnerabilities or license violations [ ] 6. Publish SBOM alongside container image [ ] 7. Integrate with vulnerability management platform

Work through each step systematically. Check off completed items.

Workflow 3: Filesystem and Application Scanning

For generating SBOMs from source code or filesystems:

1. Navigate to project root or specify path
2. Scan directory structure:

``bash syft dir:/path/to/project -o cyclonedx-json=app-sbom.json ``

1. Review detected packages and dependencies
2. Validate package detection accuracy (check for false positives/negatives)
3. Configure exclusions if needed (using .syft.yaml)
4. Generate SBOM for each release version
5. Track dependency changes between versions

Workflow 4: SBOM Analysis and Vulnerability Scanning

Combining SBOM generation with vulnerability assessment:

1. Generate SBOM with Syft:

``bash syft <target> -o cyclonedx-json=sbom.json ``

1. Scan SBOM for vulnerabilities using Grype:

``bash grype sbom:sbom.json -o json --file vulnerabilities.json ``

1. Review vulnerability findings by severity
2. Filter by exploitability and fix availability
3. Prioritize remediation based on:
4. CVSS score
5. Active exploitation status
6. Fix availability
7. Dependency depth
8. Update dependencies and regenerate SBOM
9. Re-scan to verify vulnerability remediation

Workflow 5: Signed SBOM Attestation

For creating cryptographically signed SBOM attestations:

1. Install cosign (for signing):

```bash # macOS brew install cosign

# Linux wget https://github.com/sigstore/cosign/releases/latest/download/cosign-linux-amd64 chmod +x cosign-linux-amd64 mv cosign-linux-amd64 /usr/local/bin/cosign ```

1. Generate SBOM:

``bash syft <image> -o cyclonedx-json=sbom.json ``

1. Create attestation and sign:

``bash cosign attest --predicate sbom.json --type cyclonedx <image> ``

1. Verify attestation:

``bash cosign verify-attestation --type cyclonedx <image> ``

1. Store signature alongside SBOM for provenance verification

Output Formats

Syft supports multiple SBOM formats for different use cases:

| Format | Use Case | Specification | |--------|----------|---------------| | cyclonedx-json | Modern SBOM standard, wide tool support | CycloneDX 1.4+ | | cyclonedx-xml | CycloneDX XML variant | CycloneDX 1.4+ | | spdx-json | Linux Foundation standard | SPDX 2.3 | | spdx-tag-value | SPDX text format | SPDX 2.3 | | syft-json | Syft native format (most detail) | Syft-specific | | syft-text | Human-readable console output | Syft-specific | | github-json | GitHub dependency submission | GitHub-specific | | template | Custom Go template output | User-defined |

Specify with -o flag:

syft <target> -o cyclonedx-json=output.json

Configuration

Create .syft.yaml in project root or home directory:

# Cataloger configuration
package:
  cataloger:
    enabled: true
    scope: all-layers  # Options: all-layers, squashed

  search:
    unindexed-archives: false
    indexed-archives: true

# Exclusions
exclude:
  - "**/test/**"
  - "**/node_modules/**"
  - "**/.git/**"

# Registry authentication
registry:
  insecure-skip-tls-verify: false
  auth:
    - authority: registry.example.com
      username: user
      password: pass

# Output format defaults
output: cyclonedx-json

# Log level
log:
  level: warn  # Options: error, warn, info, debug, trace

Common Patterns

Pattern 1: Multi-Architecture Image Scanning

Scan all architectures of multi-platform images:

# Scan specific architecture
syft --platform linux/amd64 <image> -o cyclonedx-json=sbom-amd64.json
syft --platform linux/arm64 <image> -o cyclonedx-json=sbom-arm64.json

# Or scan manifest list (all architectures)
syft <image> --platform all -o cyclonedx-json

Pattern 2: Private Registry Authentication

Access images from private registries:

# Using Docker credentials
docker login registry.example.com
syft registry.example.com/private/image:tag -o cyclonedx-json

# Using environment variables
export SYFT_REGISTRY_AUTH_AUTHORITY=registry.example.com
export SYFT_REGISTRY_AUTH_USERNAME=user
export SYFT_REGISTRY_AUTH_PASSWORD=pass
syft registry.example.com/private/image:tag -o cyclonedx-json

# Using config file (recommended)
# Add credentials to .syft.yaml

Pattern 3: OCI Archive Scanning

Scan saved container images (OCI or Docker format):

# Save image to archive
docker save nginx:latest -o nginx.tar

# Scan archive
syft oci-archive:nginx.tar -o cyclonedx-json=sbom.json

# Or scan Docker archive
syft docker-archive:nginx.tar -o cyclonedx-json=sbom.json

Pattern 4: Comparing SBOMs Between Versions

Track dependency changes across releases:

# Generate SBOMs for two versions
syft myapp:v1.0 -o syft-json=sbom-v1.0.json
syft myapp:v2.0 -o syft-json=sbom-v2.0.json

# Compare with jq
jq -s '{"added": (.[1].artifacts - .[0].artifacts), "removed": (.[0].artifacts - .[1].artifacts)}' \
  sbom-v1.0.json sbom-v2.0.json

Pattern 5: Filtering SBOM Output

Extract specific package information:

# Generate detailed SBOM
syft <target> -o syft-json=full-sbom.json

# Extract only Python packages
cat full-sbom.json | jq '.artifacts[] | select(.type == "python")'

# Extract packages with specific licenses
cat full-sbom.json | jq '.artifacts[] | select(.licenses[].value == "MIT")'

# Count packages by ecosystem
cat full-sbom.json | jq '.artifacts | group_by(.type) | map({type: .[0].type, count: length})'

Security Considerations

• Sensitive Data Handling: SBOMs may contain internal package names and versions. Store SBOMs securely and restrict access to authorized personnel
• Access Control: Limit SBOM generation and access to build systems. Use read-only credentials for registry access
• **Audi