Syft 1.54.1 - SBOM Generator

Syft is a powerful, open-source command-line tool and library developed by Anchore Inc for generating Software Bill of Materials (SBOMs). It is designed for developers, security teams, and DevOps engineers who need detailed visibility into the packages and dependencies within their software. By scanning container images and filesystems, Syft helps users manage vulnerabilities, ensure license compliance, and enhance software supply chain security. This tool provides a clear overview of what is included in your software artifacts, making it easier to audit and maintain secure environments.

Key features:

• Generates SBOMs for container images and filesystems
• Provides detailed visibility into packages and dependencies
• Supports multiple SBOM formats including CycloneDX and SPDX
• Open-source tool with a permissive Apache-2.0 license
• Helps manage software vulnerabilities and license compliance
• Enhances software supply chain security through detailed auditing
• Available as both a CLI tool and a library for integration

What's new in version 1.54.1:

• Resolved an issue to ensure packages.lock dependencies are resolved deterministically
• Fixed a bug preventing the production of attestation files from local Podman images
• Updated nine dependencies, including go-rpmdb, stereoscope, and docker/cli