Chapter 1. Creating a software bill of materials manifest file

Procedure

1. To create an SBOM by using a container image.

   CycloneDX format:

   Syntax

   syft IMAGE_PATH -o cyclonedx-json@1.5

   Example

   $ syft registry:example.io/hello-world:latest -o cyclonedx-json@1.5

   SPDX format:

   Syntax

   syft IMAGE_PATH -o spdx-json@2.3

   Example

   $ syft registry:example.io/hello-world:latest -o spdx-json@2.3

   Note

   Syft supports many types of container image sources. See the official supported source list on Syft’s GitHub site.

2. To create an SBOM by scanning the local file system.

   CycloneDX format:

   Syntax

   syft dir: DIRECTORY_PATH -o cyclonedx-json@1.5
   syft file: FILE_PATH -o cyclonedx-json@1.5

   Example

   $ syft dir:. -o cyclonedx-json@1.5
   $ syft file:/example-binary -o cyclonedx-json@1.5

   SPDX format:

   Syntax

   syft dir: DIRECTORY_PATH -o spdx-json@2.3
   syft file: FILE_PATH -o spdx-json@2.3

   Example

   $ syft dir:. -o spdx-json@2.3
   $ syft file:/example-binary -o spdx-json@2.3