Hacker GitHub

← All repos

anchore/syft

View on GitHub ↗ ★ 9,814 Go

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

14 mentions on Hacker News by 11 people: 1 story, 13 comments · first 2021-09-04 · latest 2025-02-17

Mentions per year 14 mentions · busiest year 2022 (5)
20082026
AllStoriesComments NewestTopOldest
  1. Syft ( https://github.com/anchore/syft ) and ScanCode ( https://github.com/aboutcode-org/scancode-toolkit ) are good open-source tools to generate SBOMs and search repos for licensing information — I'm curious to hear if there are reasons…
    comment by jcalx · 2025-02-17 · in Open source projects could sell SBOM fragments
  2. …syft and grype [3] [4] [1] https://github.com/CycloneDX [2] https://github.com/DependencyTrack [3] https://github.com/anchore/syft [4] https://github.com/anchore/grype
    comment by h4ck_th3_pl4n3t · 2024-08-18 · in Ask HN: Pragmatic way to avoid supply chain attacks as a developer
  3. …data collection from vulnerability tracking (with your tool of choice) is a nice capability. 0: https://github.com/anchore/syft
    comment by bostik · 2024-07-05 · in Ask HN: Is there any software you only made for your own use but nobody else?
  4. Inside of the SBOMs, we can detect a lot: https://github.com/anchore/syft#supported-ecosystems You're right that the active/dormant detection needs to be customized per type of runtime. It ends up being a mix of both access and execution,…
    comment by robszumski · 2023-03-02 · in Launch HN: EdgeBit (YC W23) – live software vulnerability analysis
  5. …using for generating software bill of materials (SBOMs) today? We're huge fans of the Syft project: https://github.com/anchore/syft You can read more about our "realtime SBOM" concept as well: https://edgebit.io/blog/realtime-sbom/
    comment by robszumski · 2023-03-02 · in Launch HN: EdgeBit (YC W23) – live software vulnerability analysis
  6. Currently the best one I know of is https://github.com/anchore/syft . It finds most dependencies even within built artifacts. You can also check out the comments in https://news.ycombinator.com/item?id=32104805 - the release announcement…
    comment by derkoe · 2022-07-25 · in Ask HN: Open-source SBOM generation tools?
  7. https://github.com/anchore/syft is an easier to use alternative. Just point it at a container image, path or archive and it will generate the SBOM for you. Salus seems to be more flexible - you can also feed the sources and the package…
    comment by derkoe · 2022-07-17 · in Microsoft open sources Salus software bill of materials (SBOM) generation tool
  8. The one I have used is https://github.com/anchore/syft
    comment by astockwell · 2022-07-16 · in Microsoft open sources Salus software bill of materials (SBOM) generation tool
  9. …stack ranging from OS level (Alpine, Debian), through Go, Ruby, Python, Java, JavaScript, etc. [1] https://github.com/anchore/syft
    comment by hrpnk · 2022-05-25 · in Python utility for tracking third party dependencies within a library
  10. ▲ 2
    Container scanners don't scan software not added by package manager
    story by mkesper · 2022-05-11 · 1 comment
  11. …self-promotion from Anchore - but the two tools grype and syft https://github.com/anchore/grype https://github.com/anchore/syft Turned out to be very helpful in easily looking through folders, installed services (in particular an installed…
    comment by e12e · 2021-12-13 · in Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide
  12. …self-promotion from Anchore - but the two tools grype and syft https://github.com/anchore/grype https://github.com/anchore/syft Turned out to be very helpful in easily looking through folders, installed services (in particular an installed…
    comment by e12e · 2021-12-13 · in How to detect the Log4j vulnerability in your applications
  13. …for free! We use this approach with our core tools, Syft and Grype (some changlog examples: https://github.com/anchore/syft/releases/tag/v0.31.0 and https://github.com/anchore/grype/releases/tag/v0.26.1 ). Always happy to hear new feature…
    comment by wagoodman · 2021-12-04 · in Keep a Changelog
  14. For materials you can use syft https://github.com/anchore/syft
    comment by eris_agx · 2021-09-04 · in Kubescape – tool for testing if Kubernetes is deployed securely