Chapter 2. Creating a software bill of materials manifest file

Procedure

1. To create an SBOM by using a container image.

   CycloneDX format

   syft IMAGE_PATH -o cyclonedx-json@1.5

   Copy to Clipboard Toggle word wrap

   $ syft registry:example.io/hello-world:latest -o cyclonedx-json@1.5

   Copy to Clipboard Toggle word wrap

   SPDX format

   syft IMAGE_PATH -o spdx-json@2.3

   Copy to Clipboard Toggle word wrap

   $ syft registry:example.io/hello-world:latest -o spdx-json@2.3

   Copy to Clipboard Toggle word wrap

   Note

   Syft supports many types of container image sources. See the official supported source list on Syft’s GitHub site.

2. To create an SBOM by scanning the local file system.

   CycloneDX format

   syft dir: DIRECTORY_PATH -o cyclonedx-json@1.5
   syft file: FILE_PATH -o cyclonedx-json@1.5

   Copy to Clipboard Toggle word wrap

   $ syft dir:. -o cyclonedx-json@1.5
   $ syft file:/example-binary -o cyclonedx-json@1.5

   Copy to Clipboard Toggle word wrap

   SPDX format

   syft dir: DIRECTORY_PATH -o spdx-json@2.3
   syft file: FILE_PATH -o spdx-json@2.3

   Copy to Clipboard Toggle word wrap

   $ syft dir:. -o spdx-json@2.3
   $ syft file:/example-binary -o spdx-json@2.3

   Copy to Clipboard Toggle word wrap