SBOM Generator and CVE Matcher

Generates Software Bill of Materials using Syft for container images and matches components against the NVD CVE database via OSV.dev API. Outputs CycloneDX and SPDX formats for supply chain compliance.

Installation

Requirements and caveats from upstream:

• Supports dozens of packaging ecosystems (e.g. Alpine (apk), Debian (dpkg), RPM, Go, Python, Java, JavaScript, Ruby, Rust, PHP, .NET, and many more)
• Supports OCI, Docker, Singularity, and more image formats
• See Installation docs for more ways to get Syft, including Homebrew, Docker, Scoop, Chocolatey, Nix, and more!

Basic usage or getting-started notes:

• New to Syft? Check out the Getting Started guide for a walkthrough!

• The quickest way to get up and going:

• bash

• Source: https://github.com/anchore/syft

• Extracted from upstream docs: https://raw.githubusercontent.com/anchore/syft/HEAD/README.md

Source

• Agent Skill Exchange