What does HackerNews think of syft?

I'm curious to hear what tools folks are using for generating software bill of materials (SBOMs) today? We're huge fans of the Syft project: https://github.com/anchore/syft

You can read more about our "realtime SBOM" concept as well: https://edgebit.io/blog/realtime-sbom/

Currently the best one I know of is https://github.com/anchore/syft. It finds most dependencies even within built artifacts.

You can also check out the comments in https://news.ycombinator.com/item?id=32104805 - the release announcement of Salus (Microsoft)

https://github.com/anchore/syft is an easier to use alternative. Just point it at a container image, path or archive and it will generate the SBOM for you.

Salus seems to be more flexible - you can also feed the sources and the package manager files into it. I guess the results could be more accurate.

You can use Syft [1] which generates the full software bill of materials, which includes package names, licenses for a broad set of tech stack ranging from OS level (Alpine, Debian), through Go, Ruby, Python, Java, JavaScript, etc.

[1] https://github.com/anchore/syft

This article probably seems like a bit of convenient self-promotion from Anchore - but the two tools grype and syft

https://github.com/anchore/grype

https://github.com/anchore/syft

Turned out to be very helpful in easily looking through folders, installed services (in particular an installed mobile device manager running on windows) and container images.