| SPDX<\/td> | License compliance, software supply chain audits<\/td> | Linux Foundation<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Choose CycloneDX for security-focused use cases and SPDX for license compliance focus. For EU CRA compliance via BSI TR-03183-2, you need CycloneDX 1.6 or later, or SPDX 3.0.1 or later.<\/p>\n\n\n\n If in doubt, generate both at once:<\/p>\n\n\n\n syft scan dir:. -o cyclonedx-json=sbom.cdx.json -o spdx-json=sbom.spdx.json<\/strong><\/p>\n\n\n\nAdding SBOM Generation to GitHub Actions<\/strong><\/h2>\n\n\n\nAutomating SBOM generation with Syft on every release is the highest-value step in this whole workflow. Add this to .github\/workflows\/sbom.yml<\/strong>:<\/p>\n\n\n\nname: Generate SBOM\non:\n push:\n branches: [main]\njobs:\n sbom:\n runs-on: ubuntu-latest\n steps:\n - uses: actions\/checkout@v4\n - name: Generate SBOM\n uses: anchore\/sbom-action@v0\n with:\n path: .\n format: cyclonedx-json\n output-file: sbom.json\n - uses: actions\/upload-artifact@v4\n with:\n name: sbom\n path: sbom.json\n<\/code><\/pre>\n\n\n\nThis approach handles generation and uploads the SBOM as a release artifact automatically, with no manual steps required after merging.<\/p>\n\n\n\n \n \ud83d\udca1 Did You Know?<\/h3>\n \n - In March 2026, Trivy was compromised in a coordinated supply chain attack that cascaded into downstream projects. The security community responded by recommending Syft as the primary alternative for SBOM generation in CI\/CD pipelines. This is a strong reminder that the tool you use for supply chain security must itself be trusted.<\/li>\n <\/ul>\n<\/div>\n\n\n\n
Common Mistakes to Avoid<\/strong><\/h2>\n\n\n\n\n- Scanning before installing dependencies.<\/strong> Syft reads manifest files and lock files. If you scan a JavaScript project before running npm install, the node_modules folder does not exist and Syft will generate an incomplete SBOM. Always run your package manager first.<\/li>\n\n\n\n
- Generating an SBOM and then never using it.<\/strong> An SBOM sitting in a folder does nothing. Pair it with Grype by running grype sbom:sbom.json<\/strong> to scan it for known vulnerabilities immediately after generation.<\/li>\n\n\n\n
- Only scanning source directories, not container images.<\/strong> Your Docker image often contains packages from the base image that never appear in your source manifests. Always scan the final container image for a complete picture.<\/li>\n<\/ul>\n\n\n\n
Conclusion<\/strong><\/h2>\n\n\n\nSBOM generation with Syft gives you a complete, machine-readable inventory of every component in your project or container image in a single command. Use CycloneDX for security workflows, SPDX for compliance, or generate both. Automate it in GitHub Actions so every release ships with an SBOM as a built artifact. Then scan it with Grype to catch vulnerabilities before they reach production.<\/p>\n\n\n\n FAQs<\/strong><\/h2>\n\n\n\n \n \n 1. What is SBOM generation with Syft?<\/strong><\/h3>\n\n\n Using Syft’s CLI to create a machine-readable inventory of every package inside a project directory or container image in CycloneDX or SPDX format.<\/p>\n\n<\/div>\n<\/div>\n \n 2. Is Syft free?<\/strong><\/h3>\n\n\n Yes. Syft is fully open-source under Apache 2.0 with no paid tier required.<\/p>\n\n<\/div>\n<\/div>\n \n 3. What formats does Syft output?<\/strong><\/h3>\n\n\n CycloneDX JSON, CycloneDX XML, SPDX JSON, SPDX tag-value, and native Syft JSON. Generate multiple formats in one command with multiple -o<\/strong> flags.<\/p>\n\n<\/div>\n<\/div>\n\n 4. What is the difference between CycloneDX and SPDX?<\/strong><\/h3>\n\n\n CycloneDX is optimised for security and vulnerability workflows. SPDX is optimised for license compliance and supply chain audits.<\/p>\n\n<\/div>\n<\/div>\n \n 5. Can Syft scan private container images?<\/strong><\/h3>\n\n\n Yes. Syft reads credentials from your Docker config or environment variables, the same way your Docker CLI authenticates.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":" Do you know every library inside your Docker image right now? Most developers do not. That is exactly the problem a Software Bill of Materials (SBOM) solves. This SBOM generation with Syft tutorial shows you how to create a complete, machine-readable inventory of your software in minutes, scan a project directory, scan a container image, […]<\/p>\n","protected":false},"author":65,"featured_media":120934,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[621],"tags":[],"views":"50","authorinfo":{"name":"Jebasta","url":"https:\/\/www.guvi.in\/blog\/author\/jebasta\/"},"thumbnailURL":"https:\/\/www.guvi.in\/blog\/wp-content\/uploads\/2026\/07\/SBOM-Generation-with-Syft-300x116.webp","_links":{"self":[{"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/posts\/119087"}],"collection":[{"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/comments?post=119087"}],"version-history":[{"count":2,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/posts\/119087\/revisions"}],"predecessor-version":[{"id":120939,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/posts\/119087\/revisions\/120939"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/media\/120934"}],"wp:attachment":[{"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/media?parent=119087"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/categories?post=119087"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/tags?post=119087"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
|