SBOM Generation with Syft

When to use

Prerequisites

• Syft installed (

  curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin

  )
• Verify:

  syft version

Instructions

1. Identify the target — Determine the directory or container image.
2. Generate the SBOM:
   Filesystem:
   bash

   syft dir:<target-path> -o cyclonedx-json > sbom-cyclonedx.json

   Container image:
   bash

   syft <image>:<tag> -o spdx-json > sbom-spdx.json

   • CycloneDX format:

     -o cyclonedx-json

   • SPDX format:

     -o spdx-json

   • Table format (human-readable):

     -o table

   • Multiple outputs:

     -o cyclonedx-json=sbom.cdx.json -o spdx-json=sbom.spdx.json

3. Analyze the SBOM — Present a summary:

| # | Package | Version | Type | License | Ecosystem |
|---|---------|---------|------|---------|-----------|

1. Summarize — Provide:
   • Total packages by ecosystem (npm, pip, go, etc.)
   • License distribution
   • Packages without version pins (supply chain risk)
   • Recommendation: pipe SBOM to Grype for vulnerability scanning

SBOM Formats

cyclonedx-json

spdx-json

table

json