syft-generation

Overview

Per github.com/anchore/syft:

Syft generates SBOMs from "container images, filesystems, archives" with multi-container-standard support (OCI, Docker, Singularity). The generated SBOM is the input artifact for vuln scanning (grype-scanning) and compliance delivery (SPDX or CycloneDX format per consumer requirement).

Why generate SBOMs:

• US Executive Order 14028 (May 2021) requires SBOMs for software sold to US federal agencies
• EU Cyber Resilience Act (in effect 2024+) requires SBOMs for products with digital elements
• FDA medical-device cybersecurity guidance requires SBOMs
• Internal supply-chain audits need a manifest of every dependency shipped

When to use

• The team ships software to customers requiring an SBOM (federal, EU regulated, medical device, etc.).
• Internal compliance program requires SBOM as evidence artifact.
• The vuln-scanning workflow needs an SBOM input (Grype, OSV-Scanner with --sbom).
• Container-image build pipelines need accompanying SBOM for delivery alongside the image.

Step 1 - Install

Per sf-gh:

# curl install
curl -sSfL https://get.anchore.io/syft | sudo sh -s -- -b /usr/local/bin

# Homebrew
brew install syft

# Docker
docker run --rm -v "$PWD:/scan" anchore/syft scan dir:/scan -o cyclonedx-json

Other paths (consult sf-gh): Scoop, Chocolatey, Nix.

Step 2 - Basic SBOM generation

Per sf-gh:

# Container image
syft alpine:latest

# Local directory
syft ./my-project

# Specific output format to stdout
syft <image> -o cyclonedx-json

# Multiple formats to files in one pass
syft <image> -o spdx-json=./spdx.json -o cyclonedx-json=./cdx.json

The default output is the table format (human-readable); use explicit -o for machine-readable formats in CI.

Step 3 - Output format catalog

Per sf-gh format support:

For grype-scanning input, use syft-json (richest metadata) or cyclonedx-json (broader compat).

For compliance delivery, the consumer's requirement dictates - SPDX-JSON for US federal, CycloneDX-JSON for most EU contexts.

Step 4 - Source types

Per sf-gh supported sources:

Step 5 - Attestation pattern (cosign)

For supply-chain integrity, attach the SBOM to the container image via Sigstore cosign:

# Generate SBOM
syft my-image:1.0 -o cyclonedx-json=sbom.json

# Sign + attach to image (Sigstore)
cosign attest --predicate sbom.json --type cyclonedx my-image:1.0

# Verify
cosign verify-attestation --type cyclonedx my-image:1.0

The attestation lives alongside the image in the registry; downstream consumers can verify provenance + retrieve the SBOM.

Step 6 - False-positive triage analogue

Syft generates inventories, not findings - there's no FP triage per se. The analogue here is inventory accuracy: ensuring Syft correctly identifies all components.

Inventory accuracy validation:

# Compare two SBOMs (e.g., before vs after a build change)
syft image:1.0 -o syft-json=v1-sbom.json
syft image:1.1 -o syft-json=v1.1-sbom.json
diff <(jq -S . v1-sbom.json) <(jq -S . v1.1-sbom.json)

If Syft misses a component (false negative on inventory), the downstream vuln scan misses any CVEs against that component. Periodic accuracy validation against known dependencies catches this.

Step 7 - CI integration

jobs:
  sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
      - uses: anchore/sbom-action@v0
        with:
          path: ./
          format: cyclonedx-json
          output-file: sbom.cyclonedx.json
      - uses: anchore/sbom-action@v0
        with:
          path: ./
          format: spdx-json
          output-file: sbom.spdx.json
      - uses: actions/upload-artifact@v4
        with:
          name: sboms
          path: sbom.*.json

The anchore/sbom-action GHA wraps Syft + handles GitHub dependency-graph submission automatically when format: github-json.

Step 8 - Composition with sister tools

Anti-patterns

Limitations

• Syft can't scan what it can't see - encrypted archives, custom package formats may produce incomplete SBOMs.
• Some language-specific catalogers have edge cases (e.g., npm workspaces, Python wheel quirks); validate against known deps.
• SBOM generation alone doesn't prove the deps are vulnerability-free - pair with grype-scanning.
• Multi-arch container scanning is per-platform; combine SBOMs manually or via tooling for unified view.

References

• sf-gh - repository, install, scan commands, formats
• anchore.com/syft - landing
• ntia.gov/SBOM - NTIA SBOM minimum elements
• whitehouse.gov/briefing-room/presidential-actions/2021/05/12/executive-order-on-improving-the-nations-cybersecurity/ - US EO 14028
• grype-scanning, cyclonedx-format, spdx-format, trivy-image - sister tools
• vuln-prioritizer - unifier agent