登录

syft

anchoreApache-2.0活跃维护

从容器镜像和文件系统生成软件物料清单（SBOM）的 CLI 工具与 Go 库，支持 CycloneDX 和 SPDX 格式，用于摸清镜像里到底装了哪些依赖。

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

v1.57.1发布于 2026-11-09 14:39 UTC9,869star +19 / 7 天1,045fork同步于 2026-11-10 11:30 UTC
软件物料清单容器镜像依赖分析静态分析供应链安全
对比 GitHubcontainerscyclonedxdockergogolang

怎么上手

由 README 提炼，执行前请确认
原文 
curl -sSfL https://get.anchore.io/syft | sudo sh -s -- -b /usr/local/bin
syft alpine:latest -o cyclonedx-json
硬件要求按 README 说明

README 未说明硬件要求，未提及显存或 GPU；提供 Linux 发布二进制，也可通过 Homebrew、Docker、Scoop、Chocolatey、Nix 等方式安装

下载：源码 zip·GitHub Releases（安装包）本站不镜像安装包

项目说明

由 README 自动翻译提炼
没人工点评？写下你的经验

从容器镜像和文件系统生成 SBOM 的 CLI 工具与 Go 库，配合 Grype 做漏洞检测

从容器镜像和文件系统生成软件物料清单（SBOM）的 CLI 工具与 Go 库，支持 CycloneDX 和 SPDX 格式，用于摸清镜像里到底装了哪些依赖。

核心能力

  • 扫描容器镜像、文件系统与归档包生成 SBOM
  • 覆盖 apk、dpkg、RPM、Go、Python、Java 等数十种包生态
  • 支持 OCI、Docker、Singularity 等多种镜像格式
  • 输出 CycloneDX、SPDX、Syft JSON 并可互相转换
  • 按 in-toto 规范生成带签名的 SBOM 证明

容易踩的坑

扫描本地 containers-storage 镜像必须显式加 --from containers-storage，普通镜像引用不会去那里找；rootless 存储需在构建器用户命名空间内执行，如 podman unshare syft --from containers-storage；从源码构建需加 -tags containers_image_openpgp,exclude_graphdriver_btrfs

内容由模型根据 README 生成，可能不完整或不准确，以官方文档为准。看原文 README

最近发版

5 个版本v1.57.1
全部 release
  1. v1.57.1最新正式版2026-11-09 · 2026-11-09 14:39 UTC

    Dependencies

    7 dependency changes (7 updated). 3 vulnerabilities remediated.

    🟢 Remediated (3)

    • github.com/andybalholm/brotli v1.2.0 → v1.2.8 (🟢 remediated GO-2026-6888)
    • github.com/bmatcuk/doublestar/v4 v4.10.3 → v4.10.4
    • github.com/gkampitakis/go-snaps v0.5.24 → v0.5.25
    • github.com/gpustack/gguf-parser-go v0.27.0 → v0.28.1
    • github.com/moby/sys/mountinfo v0.7.2 → v0.7.3
    • go.yaml.in/yaml/v3 v3.0.5 → v3.0.6
    • golang.org/x/net v0.61.0 → v0.62.0 (🟢 remediated GO-2026-6860, GO-2026-6866)

    (Full Changelog)

  2. v1.57.02026-11-05 · 2026-11-05 20:46 UTC
    查看更新说明

    Added Features

    • capture GNU ELF build IDs [PR #5426 @adityasaky]
    • build lower layer squashes only when a scan reads them [PR #5492 @wagoodman]

    Bug Fixes

    • do not generate CPEs for msrc-kb packages [PR #5510 @juanjsebgarcia]
    • Fix truncated pre-release versions in Go binaries' ldflags [PR #5422 @LemonCondor]
    • generate NVD-style terraform_provider CPEs for terraform lock packages [PR #5261 @timols]
    • OpenSSL-only SHA-256 fallback aborts installation [Issue #5520] [PR #5521 @pujitha24]

    Dependencies

    1 dependency change (1 updated).

    • github.com/anchore/stereoscope v0.4.0 → v0.4.1

    (Full Changelog)

  3. v1.56.02026-11-02 · 2026-11-02 16:53 UTC
    查看更新说明

    Added Features

    • tighten source-distribution external refs [PR #5493 @wagoodman]
    • output source PURL as external reference [PR #5246 @swadaptive]
    • Full cataloging of archive contents [Issue #246] [PR #5260 @kzantow]

    Bug Fixes

    • hash each file once in the file digest cataloger [PR #5491 @wagoodman]
    • Support envoy binary various versions [Issue #5470] [PR #5476 @pujitha24]
    • Support istio binary various versions [Issue #5060] [PR #5121 @hsdfat]
    • CPE identifiers contain a wildcard in the CPE part field for packages discovered by the Bitnami cataloger [Issue #5123] [PR #5127 @vigneshakaviki]

    Additional Changes

    • Gradle lockfile comment line is catalogued as a package [Issue #5371] [PR #5372 @pujitha24]
    • use correct error variable in package load [PR #4983 @idhyt]
    • let go-make own the go version [PR #5464 @wagoodman]
    • preserve semver build metadata in ffmpeg version [PR #5452 @akshaver]

    Dependencies

    40 dependency changes (38 updated, 1 added, 1 removed). 1 vulnerability remediated.

    🟢 Remediated (1)

    • github.com/Microsoft/go-winio v0.6.3-0.ad3df93 → v0.6.3-0.f19d971
    • github.com/ProtonMail/go-crypto v1.4.1 → v1.5.2
    • github.com/anchore/clio v0.1.1 → v0.1.2
    • github.com/anchore/stereoscope v0.3.4 → v0.4.0
    • github.com/bmatcuk/doublestar/v4 v4.10.2 → v4.10.3
    • github.com/containerd/containerd/v2 v2.4.1 → v2.4.2
    • github.com/containerd/stargz-snapshotter/estargz v0.18.2 → v0.19.0
    • github.com/deitch/magic v0.0.0-1ff89d7 → v1.0.0
    • github.com/docker/cli v29.8.2+incompatible → v29.9.2+incompatible
    • github.com/docker/docker-credential-helpers v0.9.8 → v0.9.10
    • github.com/docker/go-connections v0.8.1 → v0.8.2
    • github.com/gabriel-vasile/mimetype v1.4.15 → v1.4.16
    • github.com/github/go-spdx/v2 v2.7.1 → v2.8.0
    • github.com/gkampitakis/go-snaps v0.5.23 → v0.5.24
    • github.com/go-jose/go-jose/v4 v4.1.5 → v4.1.6 (🟢 remediated GHSA-mgcc-cww5-fp2q)
    • github.com/go-test/deep v1.1.1 → v1.1.2
    • github.com/google/pprof v0.0.0-ef3492d → v0.0.0-1facf8f
    • github.com/gookit/color v1.6.2 → v1.6.3
    • github.com/gpustack/gguf-parser-go v0.26.4 → v0.27.0
    • github.com/klauspost/compress v1.20.1 → v1.20.3
    • github.com/klauspost/pgzip v1.2.6 → v1.2.7
    • github.com/mattn/go-runewidth v0.0.27 → v0.0.31
    • github.com/mattn/go-sqlite3 v1.14.48 → v1.14.52
    • github.com/moby/moby/api v1.56.0 → v1.56.1
    • github.com/moby/moby/client v0.6.0 → v0.6.2
    • github.com/ncruces/go-strftime v1.0.0 → v1.1.0
    • github.com/sigstore/fulcio v1.8.7 → v1.8.8
    • github.com/vbauerster/cupwriter v0.0.4 → v0.0.5
    • github.com/vbauerster/mpb/v8 v8.14.0 → v8.16.2
    • go.podman.io/image/v5 v5.41.2 → v5.42.0
    • go.podman.io/storage v1.64.1 → v1.65.0
    • golang.org/x/mod v0.41.0 → v0.42.0
    • golang.org/x/tools v0.51.0 → v0.52.0
    • modernc.org/cc/v4 v4.29.7 → v4.30.3
    • modernc.org/ccgo/v4 v4.36.1 → v4.37.0
    • modernc.org/gc/v3 v3.1.5 → v3.2.0
    • modernc.org/libc v1.77.1 → v1.79.0
    • modernc.or
  4. v1.55.02026-10-19 · 2026-10-19 19:01 UTC
    查看更新说明

    Added Features

    • Add support for scanning IPK packages using the deb-archive-cataloger [PR #5111 @skyhisi]

    Bug Fixes

    • Pin Gguff lib to prevent dropping packages [PR #5447 @spiffcs]
    • Licensing: copyright holder missing, needed for Debian packaging [Issue #5394] [PR #5414 @wagoodman]
    • Syft cli.Command() panics when invoked multiple times [Issue #2285] [PR #5386 @JasonMetal]

    Additional Changes

    • bump go-make module and action together [PR #5415 @wagoodman]

    Dependencies

    49 dependency changes (46 updated, 1 added, 2 removed). 5 vulnerabilities remediated.

    🟢 Remediated (5)

    • cloud.google.com/go/auth v0.23.2 → v0.23.3
    • cloud.google.com/go/compute/metadata v0.9.0 → v0.9.1
    • cloud.google.com/go/storage v1.65.1 → v1.68.0
    • github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 → v1.34.0
    • github.com/aws/aws-sdk-go-v2 v1.44.0 → v1.47.1
    • github.com/aws/aws-sdk-go-v2/config v1.32.40 → v1.33.6
    • github.com/aws/aws-sdk-go-v2/credentials v1.19.39 → v1.20.6
    • github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.40 → v1.20.1
    • github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.40 → v1.5.4
    • github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.40 → v2.8.4
    • github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.41 → v1.5.4
    • github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.10.0 → v1.11.5
    • github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.40 → v1.14.4
    • github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.41 → v1.20.4
    • github.com/aws/aws-sdk-go-v2/service/s3 v1.108.0 → v1.114.0
    • github.com/aws/aws-sdk-go-v2/service/signin v1.6.0 → v1.10.1
    • github.com/aws/aws-sdk-go-v2/service/sso v1.34.0 → v1.38.1
    • github.com/aws/aws-sdk-go-v2/service/ssooidc v1.39.0 → v1.43.1
    • github.com/aws/aws-sdk-go-v2/service/sts v1.46.0 → v1.51.1
    • github.com/github/go-spdx/v2 v2.7.0 → v2.7.1
    • github.com/go-git/go-billy/v5 v5.9.1 → v5.9.2
    • github.com/go-git/go-git/v5 v5.19.2 → v5.19.3
    • github.com/google/s2a-go v0.1.9 → v0.1.10
    • github.com/googleapis/enterprise-certificate-proxy v0.3.20 → v0.3.22
    • github.com/googleapis/gax-go/v2 v2.24.0 → v2.24.1
    • github.com/gookit/color v1.6.1 → v1.6.2
    • github.com/gpustack/gguf-parser-go v0.26.3 → v0.26.4
    • github.com/hashicorp/go-getter v1.8.9 → v1.8.10
    • github.com/pb33f/ordered-map/v2 v2.3.1 → v2.3.2
    • github.com/pjbgf/sha1cd v0.6.0 → v0.7.0
    • github.com/spiffe/go-spiffe/v2 v2.7.0 → v2.8.1
    • golang.org/x/crypto v0.57.0 → v0.58.0
    • golang.org/x/net v0.59.0 → v0.61.0 (🟢 remediated GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612, GO-2026-6617)
    • golang.org/x/oauth2 v0.36.0 → v0.37.0
    • golang.org/x/sync v0.23.0 → v0.24.0
    • golang.org/x/sys v0.48.0 → v0.49.0
    • golang.org/x/term v0.46.0 → v0.47.0
    • golang.org/x/text v0.42.0 → v0.43.0
    • golang.org/x/tools v0.50.0 → v0.51.0
    • google.golang.org/api v0.294.0 → v0.299.0
    • google.golang.org/genproto/googleapis/rpc v0.0.0-da73d73 → v0.0.0-b142276
    • google.golang.org/grpc `v1.83.
  5. v1.54.12026-10-06 · 2026-10-06 15:35 UTC
    查看更新说明

    Bug Fixes

    • resolve packages.lock dependencies deterministically [PR #5210 @spiffcs]
    • Cannot produce attestation file from local podman image [Issue #1664] [PR #5368 @Bru456]

    Dependencies

    9 dependency changes (9 updated).

    • github.com/anchore/go-rpmdb v0.2.0 → v0.2.2
    • github.com/anchore/stereoscope v0.3.3 → v0.3.4
    • github.com/docker/cli v29.8.1+incompatible → v29.8.2+incompatible
    • github.com/glebarez/go-sqlite v1.20.3 → v1.23.0
    • github.com/klauspost/compress v1.20.0 → v1.20.1
    • github.com/secure-systems-lab/go-securesystemslib v0.11.0 → v0.11.1
    • github.com/sigstore/protobuf-specs v0.5.1 → v0.5.2
    • github.com/sigstore/sigstore v1.10.8 → v1.10.11
    • github.com/sylabs/sif/v2 v2.24.1 → v2.24.2

    (Full Changelog)

用户点评

登录用户的真实使用记录，可按版本和硬件筛选
共 0 条

    还没有人点评。第一个说出真实体验的人最有价值。

    README 原文

    未翻译
    在 GitHub 打开

    Syft

    A CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Exceptional for vulnerability detection when used with a scanner like Grype.

    syft-demo

    Features

    [!TIP] New to Syft? Check out the Getting Started guide for a walkthrough!

    Installation

    The quickest way to get up and going:

    curl -sSfL https://get.anchore.io/syft | sudo sh -s -- -b /usr/local/bin

    [!TIP] See Installation docs for more ways to get Syft, including Homebrew, Docker, Scoop, Chocolatey, Nix, and more!

    The basics

    See the packages within a container image or directory:

    # container image
syft alpine:latest

# directory
syft ./my-project

    To get an SBOM, specify one or more output formats:

    # SBOM to stdout
syft <image> -o cyclonedx-json

# Multiple SBOMs to files
syft <image> -o spdx-json=./spdx.json -o cyclonedx-json=./cdx.json

    Local containers-storage images

    On Linux, syft can scan images from a local containers-storage store (e.g. built with Buildah or Podman) when asked explicitly; plain image references never look there:

    syft --from containers-storage localhost/myimage:latest

# rootless stores must be read from inside the builder's user namespace
podman unshare syft --from containers-storage localhost/myimage:latest

    This is included in the Linux release binaries. When building from source, add -tags containers_image_openpgp,exclude_graphdriver_btrfs.

    [!TIP] Check out the Getting Started guide to explore all of the capabilities and features.

    Want to know all of the ins-and-outs of Syft? Check out the CLI docs, configuration docs, and JSON schema.

    Contributing

    We encourage users to help make these tools better by submitting issues when you find a bug or want a new feature. Check out our contributing overview and developer-specific documentation if you are interested in providing code contributions.

    For commercial support options with Syft or Grype, please contact Anchore.

    Come talk to us!

    The Syft Team holds regular community meetings online. All are welcome to join to bring topics for discussion.

    相关项目

    同分类里 star 最高的项目
    对比全部 →
    PHP-Parser
    nikic·PHP

    用 PHP 写的 PHP 解析器，能把源码转成 AST，方便做静态分析、代码改写和工具链开发。

    PHP解析器+3代码审计 / SAST
    17474+41.1kv5.9.02026-11-05 11:53 UTC
    phpstan
    phpstan·PHP

    PHP 静态分析工具，不用运行代码就能扫出类型错误和潜在 bug，适合在 CI 里给 PHP 项目做质量把关。

    静态分析+4代码审计 / SAST
    14153+19712.3.52026-11-10 15:52 UTC
    PHP-CS-Fixer
    PHP-CS-Fixer·PHP

    自动检测并修复 PHP 代码风格问题的命令行工具，让团队无需手动调整格式就能统一编码规范。

    代码风格+4代码审计 / SAST
    135741.7kv3.95.302026-11-10 00:13 UTC
    grype
    anchore·Go

    扫描容器镜像和文件系统中的软件包，找出已知漏洞并输出 SBOM 与漏洞报告，适合接入 CI 做供应链安全把关。

    漏洞扫描+4代码审计 / SAST
    13231+23939v0.121.32026-11-09 15:11 UTC