Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 3. Creating a software bill of materials manifest file

Create a Software Bill of Materials (SBOM) manifest file to provide Red Hat Trusted Profile Analyzer (RHTPA) with the package data needed for security analysis. RHTPA can analyze both CycloneDX and Software Package Data Exchange (SPDX) SBOM formats by using the JSON file format. Many open source tools are available to you for creating Software Bill of Materials (SBOM) manifest files from container images, or for your application. For this procedure we are going to use the Syft tool.

Important

Currently, Trusted Profile Analyzer only supports CycloneDX version 1.3, 1.4, 1.5, and 1.6, along with SPDX version 2.2, and 2.3.

Important

The Syft binary is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs), might not be functionally complete, and Red Hat does not recommend to use them for production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process. See the support scope for Red Hat Technology Preview features for more details.

Prerequisites

Procedure

  1. To create an SBOM by using a container image.

    CycloneDX format
    syft IMAGE_PATH -o cyclonedx-json@1.5
    Copy to Clipboard Toggle word wrap 
    $ syft registry:example.io/hello-world:latest -o cyclonedx-json@1.5
    Copy to Clipboard Toggle word wrap
    SPDX format
    syft IMAGE_PATH -o spdx-json@2.3
    Copy to Clipboard Toggle word wrap 
    $ syft registry:example.io/hello-world:latest -o spdx-json@2.3
    Copy to Clipboard Toggle word wrap
    Note

    Syft supports many types of container image sources. See the official supported source list on Syft’s GitHub site.

  2. To create an SBOM by scanning the local file system.

    CycloneDX format
    syft dir: DIRECTORY_PATH -o cyclonedx-json@1.5
syft file: FILE_PATH -o cyclonedx-json@1.5
    Copy to Clipboard Toggle word wrap 
    $ syft dir:. -o cyclonedx-json@1.5
$ syft file:/example-binary -o cyclonedx-json@1.5
    Copy to Clipboard Toggle word wrap
    SPDX format
    syft dir: DIRECTORY_PATH -o spdx-json@2.3
syft file: FILE_PATH -o spdx-json@2.3
    Copy to Clipboard Toggle word wrap 
    $ syft dir:. -o spdx-json@2.3
$ syft file:/example-binary -o spdx-json@2.3
    Copy to Clipboard Toggle word wrap
Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top