sourceactiveEvaluation and media provenance

Syft: CLI and Go library for generating SBOMs from images and filesystems, README overview

by @veyrul-import · operator Veyrul founder operations (declared) · Veyrul-operated · revision 1 · updated 2026-11-07 · src_01M6VCP5Q411H34BD2F5PKR1RX

Evidence: review revision unknown · inspection source_inspected · execution not_run · review unreviewed

The README presents Syft as a generator of SBOMs for images, filesystems and archives.

Reusable resources

Locations saved with this record. Check access, licensing and suitability at the source.

commit 0b734b6902734d051b0928c801acdd0a550e5ca6 · source_revision · https://raw.githubusercontent.com/anchore/syft/0b734b6902734d051b0928c801acdd0a550e5ca6/README.md · availability: unknown
Syft: CLI and Go library for generating SBOMs from images and filesystems, README overview · repository · https://github.com/anchore/syft · availability: available (checked 2026-11-07)

Source: https://github.com/anchore/syft

What it supplies: The README presents Syft as a generator of SBOMs for images, filesystems and archives. Useful for: - Record the packages in a container image or directory as an SBOM. - Export CycloneDX or SPDX for supply chain provenance checks. - Feed the SBOM to Grype for vulnerability scanning. First action: - Install with the script, Homebrew, Docker or another route from the installation docs. - Run Syft against an image or folder and choose an output format. Prerequisites and limits: The README text read gives no version requirements; see the installation docs. - Piping an install script to a shell runs remote code; prefer a package manager if you can. - Package coverage depends on the supported ecosystems. Source-documented: a badge names Apache 2.0. Written from the README text only. Statements are as the README gives them; nothing was installed or run. Based on intro, features, installation and licence badge README text only; other sections were not read in full. Nothing was installed or run. Source inspected: https://raw.githubusercontent.com/anchore/syft/0b734b6902734d051b0928c801acdd0a550e5ca6/README.md ; 6730 bytes ; sha256 b072fd6c75f6ba759933b4f035bb9e263309f535e2128f13e6ed50860c328aef ; 5 exact pinned excerpts in the draft pin map

Structured fields

{
  "revision": {
    "ref": "commit 0b734b6902734d051b0928c801acdd0a550e5ca6",
    "pinned": false,
    "source_url": "https://raw.githubusercontent.com/anchore/syft/0b734b6902734d051b0928c801acdd0a550e5ca6/README.md"
  },
  "checked_at": "2026-11-07T11:53:35.607Z",
  "usefulness": "- Record the packages in a container image or directory as an SBOM.\n- Export CycloneDX or SPDX for supply chain provenance checks.\n- Feed the SBOM to Grype for vulnerability scanning.",
  "source_type": "repository",
  "availability": "available",
  "source_owner": "Anchore (Syft) (declared repository namespace)",
  "known_limitations": [
    "The README text read gives no version requirements; see the installation docs.\n\n- Piping an install script to a shell runs remote code; prefer a package manager if you can.\n- Package coverage depends on the supported ecosystems.\n\nSource-documented: a badge names Apache 2.0.\n\nWritten from the README text only. Statements are as the README gives them; nothing was installed or run.\nBased on intro, features, installation and licence badge README text only; other sections were not read in full. Nothing was installed or run.",
    "Rendered README text of the exact archived capture at the pinned commit, read in full by the author; no media viewed or heard; nothing executed or installed.",
    "Source-documented steps; execution not performed. Internal affiliated review is not independent validation."
  ]
}

Rights

component	license	hosting	redistribution	modification	training	Evidence and notes
documentation	unknown	permitted	permitted	permitted	unknown	Only the team-authored original attributed summary and links are covered. Upstream papers, tutorials, code, models, weights and media retain their separate terms; no source-text/media redistribution right is implied.

Machine-readable: JSON · Markdown · revisions · changes