anchore/syft
CLI tool and library for generating a Software Bill of Materials from container images and filesystems
Build with Backblaze B2
SDKs, agent skills, IDE extensions, and reference pipelines from Backblaze Labs. All open source.
Loading star history...
Where it stands
Rank, growth pace and release cadence relative to everything GStars tracks.
5 releases in the last 90 days, the latest 2 days ago, with 276 contributors on GitHub.
Peaked at #39 in the weekly ranking the week of Mar 29, its best in the past year.
Use Cases & Benefits
- Generates Software Bill of Materials (SBOM) from container images and filesystems using a CLI tool and Go library.
- Provides detailed package and dependency visibility with broad format support and seamless integration with vulnerability scanners like Grype.
- Use for auditing container images to identify all included software packages and dependencies for security and compliance.
- Use for converting and exporting SBOMs in multiple industry-standard formats such as CycloneDX and SPDX for supply chain transparency.
- Use for creating signed SBOM attestations to verify software provenance and integrity in DevSecOps pipelines.
Should you depend on it?
License terms, project hygiene and risks, from GitHub metadata and GStars' snapshots.
License
Apache 2.0
Permissive: commercial use, modification and redistribution are allowed with attribution; includes an explicit patent grant from contributors.
Community files
- README: present
- Contributing guide: present
- Code of conduct: present
Watch-outs
No watch-outs from GStars' checks.
General guidance from repository metadata, not legal advice. How we score
From the README
A CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Exceptional for vulnerability detection when used with a scanner like Grype.
Syft is a powerful and easy-to-use open-source tool for generating Software Bill of Materials (SBOMs) for container images and filesystems. It provides detailed visibility into the packages and dependencies in your software, helping you manage vulnerabilities, license compliance, and software supply chain security.
Syft development is sponsored by Anchore, and is released under the Apache-2.0 License. For commercial support options with Syft or Grype, please contact Anchore.
Daily snapshots
Stars gained per day, and how forks and open issues moved, from GStars' daily snapshots
+473 stars over 89 days across 15 snapshot days; best day +12 on Aug 19.
Forks
1.0K+120
Open issues
718+98
Compared with peers in DevOps
Fastest-growing repositories GStars tracks in this cohort for the week of Nov 8, by 7-day star growth
| Repository | Stars | +7d | Health | Last release |
|---|---|---|---|---|
| milind-soni/OpenMausBot | 20.6K | +8.4K | 75 | today |
| DuarteSantos8/openGym | 20.8K | +1.7K | 75 | 7 days ago |
| superplanehq/superplane | 9.8K | +1.0K | 75 | 13 days ago |
| elie222/rakazo | 7.8K | +958 | 75 | today |
| AstrBotDevs/AstrBot | 46.6K | +774 | 75 | 10 days ago |
| anchore/syft | 9.8K | — | 65 | 2 days ago |
| Category median | 20.6K | +1.0K | 75 | — |
Also by anchore
Other repositories from this maintainer that GStars tracks
Discover Repositories
Search across tracked repositories by name or description