syft

Syft is a powerful CLI tool and Go library designed for generating Software Bills of Materials (SBOM) from container images, filesystems, and archives. It supports a wide range of packaging ecosystems including Alpine (apk), Debian (dpkg), RPM, Go, Python, Java, JavaScript, Ruby, Rust, PHP, .NET, and many more. Syft can scan OCI, Docker, Singularity, and other image formats, and integrates seamlessly with Grype for vulnerability scanning. It offers multiple output formats such as CycloneDX, SPDX, and Syft JSON, and supports converting between SBOM formats. Additionally, Syft can create signed SBOM attestations using the in-toto specification. Installation is straightforward via a curl script, and it can be used to quickly list packages in an image or directory, or generate SBOMs in various formats. The project is actively developed by Anchore and released under the Apache-2.0 License.