anchore/syft
Syft
Syft is a software bill of materials generator, container image scanner, and software dependency catalog. It analyzes container images and filesystems to produce comprehensive inventories of installed packages and dependencies in standard formats. Additionally, it serves as a software attestation tool and an SBOM format converter.
The project distinguishes itself through the ability to create cryptographically signed attestations for software inventories to ensure provenance and integrity. It also provides the capability to transform software bills of materials between different industry schemas without requiring a new scan of the source.
Syft covers a broad range of analysis capabilities, including package and version identification across various operating system managers and language ecosystems. It performs binary security analysis to capture hardening mechanisms and identifies software licenses. The tool supports scanning from remote registries, local daemons, directory trees, and compressed archives, with the ability to enrich discovered data via external metadata sources.
Analysis results can be exported into multiple industry-standard schemas or custom layouts using a template engine.
Features
- SBOM Generators - Generates dependency-focused software bills of materials by analyzing container images and filesystems.
- Software Bill of Materials Generators - Generates comprehensive inventories of all packages and dependencies found within container images and filesystems.
- Signed Provenance Attestations - Generates cryptographically signed attestations for software inventories to ensure provenance and integrity.
- Package and Version Identification - Detects software packages and versions across various operating system managers, language ecosystems, and binary formats.
- Package Dependency Managers - Catalogs runtime and build-time dependencies across various language ecosystems and operating system package managers.
- Modular Package Catalogers - Implements a modular system of ecosystem-specific catalogers to identify software packages across various operating systems and language managers.
- Container Image Scanning - Analyzes container images from local daemons, OCI layouts, or remote registries to catalog installed software.
- Software Dependency Catalogs - Provides a comprehensive inventory system that identifies language-specific packages and build-time dependencies across various ecosystem lockfiles.
- Container Image Registries - Scans container images from registries or local daemons to identify installed software and binary metadata.
- Image Layer Analyzers - Deconstructs container images into individual filesystem layers to isolate and scan for installed software.
- Artifact Attestation Tools - Creates and cryptographically signs software inventory attestations to ensure provenance and integrity.
- Container Security Scanners - Acts as a scanner that extracts packages, OS distributions, and binary metadata from OCI and Docker images.
- Package Signing - Provides mechanisms for signing software inventories to confirm provenance and prevent unauthorized modification.
- SBOM Attestation Generation - Generates a package-based software bill of materials and packages it as an attestation for registry upload.
- Software Supply Chain Security - Secures the software supply chain by creating signed attestations and verifying the integrity of software components.
- Data Format Translators - Transforms internal software inventory data between different industry-standard SBOM serialization formats.
- SBOM Schema Converters - Transforms software bills of materials between different industry schemas without requiring a new scan of the source.
- Recursive Archive Traversers - Recursively scans directory trees and unpacks compressed archives to catalog internal software dependencies.
- Archive Scanning - Detects and unpacks common compressed archive formats to catalog the software contained within the files.
- Filesystem Scanning - Scans a directory tree recursively to identify and catalog installed software packages.
- Format Conversion - Transforms software inventory data between different industry standard schemas to meet various tooling requirements.
- Metadata Enrichment - Downloads supplemental information from online sources to provide detailed metadata about discovered packages.
- Multi-Format Exports - Generates software bills of materials in various standard industry formats to meet different tool requirements.
- OS Distribution Identification - Identifies the Linux distribution and version by extracting data from system files.
- File Integrity Verifiers - Computes and records cryptographic hashes of file contents to ensure software authenticity.
- Software License Identification - Discovers license information and expressions within files and package metadata.
- Automated Binary Analysis - Captures binary hardening mechanisms such as stack canaries, NX protection, and control flow integrity.
- Binary Metadata - Extracts version, architecture, and provider information from compiled executable formats like ELF, Mach-O, and PE.
- Binary Header Parsers - Includes parsers for interpreting executable file headers to retrieve versioning and security hardening properties.
- Dependency Management - Generates SBOMs from container images and filesystems.
- Image Scanning and SBOM - Generates Software Bill of Materials from images.
- Security and Compliance - SBOM generator for container images.
- Supply Chain Security - Generates a Software Bill of Materials for container images and filesystems.
