What is Syft?
Syft is an open-source CLI tool and Go library developed by Anchore to generate a Software Bill of Materials (SBOM) for container images, filesystems, and code projects.
An SBOM is a comprehensive list of components, libraries, dependencies, and their metadata used in a software system. Syft helps in identifying and cataloging these components, thereby increasing transparency, security, and compliance in software supply chains.
Syft is trusted by developers, DevSecOps engineers, security analysts, and enterprises to ensure that their software artifacts are secure and well-documented before shipping.
Key Highlights:
- Supports a wide range of ecosystems: Docker, OCI images, filesystems, directories, and repositories.
- Integrates easily with security and compliance tools.
- Outputs in multiple formats: JSON, SPDX, CycloneDX, and more.
Major Use Cases of Syft
Syft can be used in a variety of critical areas across modern software development:
- Software Supply Chain Security
Identify all dependencies, components, and potential vulnerabilities before deployment. - Vulnerability Management
Combine Syft’s output with scanners like Grype to detect known vulnerabilities in software components. - Regulatory Compliance (e.g., SBOM Mandates)
Organizations can fulfill regulatory requirements (like those under the U.S. Executive Order on cybersecurity) by providing SBOMs for their software. - License Auditing
Understand open-source licenses attached to third-party components to avoid legal risks. - Internal Documentation
Automatically document all software components used internally for better team transparency. - DevSecOps Pipelines
Integrate Syft into CI/CD pipelines for continuous SBOM generation during builds. - Incident Response
Quickly analyze affected components during a breach by using previously generated SBOMs.
How Syft Works Along with Architecture
At a high level, Syft’s architecture is simple yet powerful:
1. Source Discovery
- Syft accepts various input sources like:
- Docker/OCI images
- File systems
- Git repositories
- Directories
- It uses source detection modules to identify and analyze the input.
2. Package Cataloging
- Once the source is identified, Syft catalogs software packages using “catalogers” for various ecosystems:
- OS packages (Debian, Alpine, RedHat, etc.)
- Language packages (JavaScript/npm, Python/pip, Java/Maven, Go modules, etc.)
- Application-level dependencies
3. SBOM Generation
- Syft organizes detected packages into a structured SBOM.
- Multiple output formats like JSON, Table, SPDX, CycloneDX, and Syft-native schemas are supported.
4. Output Delivery
- The SBOM file can be saved, pushed to APIs, or handed off to vulnerability scanners or compliance tools.
Diagram Representation
Source (Image/Filesystem/Repo)
↓
Source Discovery
↓
Package Cataloging
↓
SBOM Assembly (SPDX, CycloneDX, JSON)
↓
Output (Save/Upload/Scan)
Basic Workflow of Syft
The general flow when using Syft looks like this:
- Select the Source
Choose a container image, a directory, or a code repository. - Analyze the Source
Syft inspects the given source for software packages, libraries, and dependencies. - Generate SBOM
Syft produces a detailed list of detected components. - Export SBOM
Output the list in your desired format for use in scanning, compliance, or documentation. - Integration
Use the SBOM for vulnerability scanning (e.g., with Grype), internal audits, or external compliance reporting.
Step-by-Step Getting Started Guide for Syft
Getting started with Syft is straightforward:
Step 1: Install Syft
You can install Syft using various methods. Here’s the easiest way via a simple script:
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
Or using Homebrew (macOS/Linux):
brew install anchore/syft/syft
Or download from GitHub Releases.
Step 2: Verify Installation
syft version
You should see the installed version details.
Step 3: Generate Your First SBOM
For a Docker image, run:
syft docker:alpine
Output Example:
NAME VERSION TYPE
musl 1.1.24-r2 apk
busybox 1.31.1-r9 apk
...
For a directory:
syft dir:/path/to/project
Step 4: Customize Output Format
Output in JSON format:
syft docker:alpine -o json
Or SPDX format:
syft docker:alpine -o spdx-json
Or CycloneDX format:
syft docker:alpine -o cyclonedx-json
Step 5: Advanced Options
- Filter results by package type
Only scan Python packages:syft docker:myimage --scope all-layers --package python - Use in CI/CD pipelines
Addsyftas a build step to generate SBOMs automatically during your app builds.
