anchore/syft
View on GitHub ↗ ★ 9,814 Go
CLI tool and library for generating a Software Bill of Materials from container images and filesystems
14 mentions on Hacker News by 11 people: 1 story, 13 comments · first 2021-09-04 · latest 2025-02-17
20082026
-
Syft ( https://github.com/anchore/syft ) and ScanCode ( https://github.com/aboutcode-org/scancode-toolkit ) are good open-source tools to generate SBOMs and search repos for licensing information — I'm curious to hear if there are reasons…
comment by jcalx · 2025-02-17 · in Open source projects could sell SBOM fragments -
…syft and grype [3] [4] [1] https://github.com/CycloneDX [2] https://github.com/DependencyTrack [3] https://github.com/anchore/syft [4] https://github.com/anchore/grype
comment by h4ck_th3_pl4n3t · 2024-08-18 · in Ask HN: Pragmatic way to avoid supply chain attacks as a developer -
…data collection from vulnerability tracking (with your tool of choice) is a nice capability. 0: https://github.com/anchore/syft
comment by bostik · 2024-07-05 · in Ask HN: Is there any software you only made for your own use but nobody else? -
Inside of the SBOMs, we can detect a lot: https://github.com/anchore/syft#supported-ecosystems You're right that the active/dormant detection needs to be customized per type of runtime. It ends up being a mix of both access and execution,…
comment by robszumski · 2023-03-02 · in Launch HN: EdgeBit (YC W23) – live software vulnerability analysis -
…using for generating software bill of materials (SBOMs) today? We're huge fans of the Syft project: https://github.com/anchore/syft You can read more about our "realtime SBOM" concept as well: https://edgebit.io/blog/realtime-sbom/
comment by robszumski · 2023-03-02 · in Launch HN: EdgeBit (YC W23) – live software vulnerability analysis -
Currently the best one I know of is https://github.com/anchore/syft . It finds most dependencies even within built artifacts. You can also check out the comments in https://news.ycombinator.com/item?id=32104805 - the release announcement…
comment by derkoe · 2022-07-25 · in Ask HN: Open-source SBOM generation tools? -
https://github.com/anchore/syft is an easier to use alternative. Just point it at a container image, path or archive and it will generate the SBOM for you. Salus seems to be more flexible - you can also feed the sources and the package…
comment by derkoe · 2022-07-17 · in Microsoft open sources Salus software bill of materials (SBOM) generation tool -
The one I have used is https://github.com/anchore/syft
comment by astockwell · 2022-07-16 · in Microsoft open sources Salus software bill of materials (SBOM) generation tool -
…stack ranging from OS level (Alpine, Debian), through Go, Ruby, Python, Java, JavaScript, etc. [1] https://github.com/anchore/syft
comment by hrpnk · 2022-05-25 · in Python utility for tracking third party dependencies within a library -
…self-promotion from Anchore - but the two tools grype and syft https://github.com/anchore/grype https://github.com/anchore/syft Turned out to be very helpful in easily looking through folders, installed services (in particular an installed…
comment by e12e · 2021-12-13 · in Log4Shell Log4j vulnerability (CVE-2021-44228) – cheat-sheet reference guide -
…self-promotion from Anchore - but the two tools grype and syft https://github.com/anchore/grype https://github.com/anchore/syft Turned out to be very helpful in easily looking through folders, installed services (in particular an installed…
comment by e12e · 2021-12-13 · in How to detect the Log4j vulnerability in your applications -
…for free! We use this approach with our core tools, Syft and Grype (some changlog examples: https://github.com/anchore/syft/releases/tag/v0.31.0 and https://github.com/anchore/grype/releases/tag/v0.26.1 ). Always happy to hear new feature…
comment by wagoodman · 2021-12-04 · in Keep a Changelog -
For materials you can use syft https://github.com/anchore/syft
comment by eris_agx · 2021-09-04 · in Kubescape – tool for testing if Kubernetes is deployed securely