s0sta
EN NL عربي
Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

syft

Make a Software Bill of Materials (SBOM): the list of every package and library inside an image, folder or archive.

Level
DevSecOps service
Group
Security scanning and hardening
Needs root
No
Package
syft

What it does

An SBOM is the ingredient list of software. When a new CVE appears (like Log4Shell), you search your SBOMs instead of scanning everything again. Syft (Anchore) reads container images, folders, archives and OCI registries and writes SBOMs in CycloneDX or SPDX (and its own JSON). Grype scans the SBOM for vulnerabilities; cosign can attach and sign it.

US and EU rules (the EU Cyber Resilience Act) push vendors to deliver SBOMs.

How to write it

syft [scan] SOURCE [-o FORMAT[=FILE]]

Main parts

Sources

IMAGE (docker.io/…, ghcr.io/…)
Pull and read an image.
dir:PATH
A folder.
file:PATH
One file or archive.
docker:IMAGE / podman:IMAGE
An image from the local daemon.
oci-archive:FILE / docker-archive:FILE
Saved image archives.
registry:IMAGE
Read straight from the registry.

Options 7

Most used

Flags

-o table|json|cyclonedx-json|spdx-json|syft-json
Output format (repeat for more).
-o FORMAT=FILE
Write a format into a file.
--scope squashed|all-layers
Final image only / all layers.
--exclude PATH
Skip paths.
-q
Quiet.
syft convert FILE -o FORMAT
Convert between SBOM formats.
syft attest --key cosign.key IMAGE
Make a signed SBOM attestation.

Examples 10

$ run as a normal user# run as root (or with sudo)

  1. 1List the packages of an image

    syft nginx:1.27
syft ghcr.io/s0sta/shop:1.4.0 -o table | head -20

  2. 2Write CycloneDX and SPDX files at once

    syft ghcr.io/s0sta/shop:1.4.0 -o cyclonedx-json=shop.cdx.json -o spdx-json=shop.spdx.json

  3. 3SBOM of a source folder

    syft dir:. -o cyclonedx-json=sbom.cdx.json

  4. 4Find a library in the SBOM

    jq -r '.components[] | select(.name|test("log4j")) | "\(.name) \(.version)"' shop.cdx.json

  5. 5Scan the SBOM for CVEs

    grype sbom:shop.cdx.json

  6. 6Count packages per type

    syft ghcr.io/s0sta/shop:1.4.0 -o syft-json | jq -r '.artifacts[].type' | sort | uniq -c

  7. 7Convert formats

    syft convert shop.cdx.json -o spdx-json=shop.spdx.json

  8. 8Attach a signed SBOM to the image

    syft attest --key cosign.key ghcr.io/s0sta/shop:1.4.0 -o cyclonedx-json

  9. 9Make SBOMs in GitHub Actions

    cat .github/workflows/sbom.yml
      - uses: anchore/sbom-action@v0
        with: { image: "ghcr.io/s0sta/shop:1.4.0", format: cyclonedx-json }

  10. 10SBOM of all layers

    syft --scope all-layers ghcr.io/s0sta/shop:1.4.0 -o table

Watch out

  • An SBOM is only as good as what Syft can detect; static binaries without metadata may be missing.
  • Keep SBOMs with the release (as artifacts or attestations), or they are useless later.

Files

.syft.yaml
Project defaults.

Tips to remember

  • Store one SBOM per released image digest, not per tag.

Exit codes

0Success.
1Error.

Full manual

This page explains the command in simple words. The original manual has every detail.

In your terminal: man syft

Open the man page (linux.die.net)