syft

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

ماذا يفعل

An SBOM is the ingredient list of software. When a new CVE appears (like Log4Shell), you search your SBOMs instead of scanning everything again. Syft (Anchore) reads container images, folders, archives and OCI registries and writes SBOMs in CycloneDX or SPDX (and its own JSON). Grype scans the SBOM for vulnerabilities; cosign can attach and sign it.

US and EU rules (the EU Cyber Resilience Act) push vendors to deliver SBOMs.

طريقة الكتابة

syft [scan] SOURCE [-o FORMAT[=FILE]]

الأجزاء الرئيسية

Sources

IMAGE (docker.io/…, ghcr.io/…): Pull and read an image.
dir:PATH: A folder.
file:PATH: One file or archive.
docker:IMAGE / podman:IMAGE: An image from the local daemon.
oci-archive:FILE / docker-archive:FILE: Saved image archives.
registry:IMAGE: Read straight from the registry.

الخيارات 7

الأكثر استخدامًا

Flags

-o table|json|cyclonedx-json|spdx-json|syft-json: Output format (repeat for more).
-o FORMAT=FILE: Write a format into a file.
--scope squashed|all-layers: Final image only / all layers.
--exclude PATH: Skip paths.
-q: Quiet.
syft convert FILE -o FORMAT: Convert between SBOM formats.
syft attest --key cosign.key IMAGE: Make a signed SBOM attestation.

أمثلة 10

$ مستخدم عادي# بصلاحية root (أو مع sudo)

1List the packages of an image

$syft nginx:1.27
$syft ghcr.io/s0sta/shop:1.4.0 -o table | head -20

2Write CycloneDX and SPDX files at once

$syft ghcr.io/s0sta/shop:1.4.0 -o cyclonedx-json=shop.cdx.json -o spdx-json=shop.spdx.json

3SBOM of a source folder

$syft dir:. -o cyclonedx-json=sbom.cdx.json

4Find a library in the SBOM

$jq -r '.components[] | select(.name|test("log4j")) | "\(.name) \(.version)"' shop.cdx.json

5Scan the SBOM for CVEs
```
$grype sbom:shop.cdx.json
```

6Count packages per type

$syft ghcr.io/s0sta/shop:1.4.0 -o syft-json | jq -r '.artifacts[].type' | sort | uniq -c

7Convert formats

$syft convert shop.cdx.json -o spdx-json=shop.spdx.json

8Attach a signed SBOM to the image

$syft attest --key cosign.key ghcr.io/s0sta/shop:1.4.0 -o cyclonedx-json

9Make SBOMs in GitHub Actions

$cat .github/workflows/sbom.yml
      - uses: anchore/sbom-action@v0
        with: { image: "ghcr.io/s0sta/shop:1.4.0", format: cyclonedx-json }

10SBOM of all layers

$syft --scope all-layers ghcr.io/s0sta/shop:1.4.0 -o table

انتبه

An SBOM is only as good as what Syft can detect; static binaries without metadata may be missing.
Keep SBOMs with the release (as artifacts or attestations), or they are useless later.

الملفات

.syft.yaml: Project defaults.

نصائح للحفظ

Store one SBOM per released image digest, not per tag.

رموز الخروج

`0`	Success.
`1`	Error.

`syft`

ماذا يفعل

طريقة الكتابة

الأجزاء الرئيسية

Sources

الخيارات 7

Flags

أمثلة 10

1List the packages of an image

2Write CycloneDX and SPDX files at once

3SBOM of a source folder

4Find a library in the SBOM

5Scan the SBOM for CVEs

6Count packages per type

7Convert formats

8Attach a signed SBOM to the image

9Make SBOMs in GitHub Actions

10SBOM of all layers

انتبه

الملفات

نصائح للحفظ

رموز الخروج

الدليل الكامل

ماذا يفعل

طريقة الكتابة

الأجزاء الرئيسية

Sources

الخيارات 7

Flags

أمثلة 10

1List the packages of an image

2Write CycloneDX and SPDX files at once

3SBOM of a source folder

4Find a library in the SBOM

5Scan the SBOM for CVEs

6Count packages per type

7Convert formats

8Attach a signed SBOM to the image

9Make SBOMs in GitHub Actions

10SBOM of all layers

انتبه

الملفات

نصائح للحفظ

رموز الخروج

أوامر مرتبطة

مُستخدم في هذه الدروس

الدليل الكامل

`syft`