Syft (Anchore)

What it is

A command line program and Go library that catalogs the software components in a target. An SBOM, or software bill of materials, is an inventory of the packages and versions that make up a piece of software.

What it helps with

- Cataloging packages in container images, directories, and archives
- Writing SBOMs in SPDX, CycloneDX, or its own JSON format
- Converting an existing SBOM from one format to another
- Feeding component lists into vulnerability scanners

Who it's for

DevSecOps engineers, platform teams, and AppSec staff who need an accurate inventory of what ships in their builds.

Worth knowing

It reads OCI, Docker, and Singularity images and can write several output formats in a single run. Release binaries cover Linux, macOS, and Windows on multiple architectures.

Does it find vulnerabilities itself?
No, it only builds the inventory, and Grype or Dependency-Track can then match it against known vulnerabilities.

Can it run in a CI pipeline?
Yes, it is a single binary that fits into build jobs and produces files you can store as artifacts.