agentskillexchange SBOM Generator and CVE Matcher
Generates Software Bill of Materials using Syft for container images and matches components against the NVD CVE database via OSV.dev API. Outputs CycloneDX and SPDX formats for supply chain compliance.
Installation
Requirements and caveats from upstream:
- Supports dozens of packaging ecosystems (e.g. Alpine (apk), Debian (dpkg), RPM, Go, Python, Java, JavaScript, Ruby, Rust, PHP, .NET, and many more)
- Supports OCI, Docker, Singularity, and more image formats
- See Installation docs for more ways to get Syft, including Homebrew, Docker, Scoop, Chocolatey, Nix, and more!
Basic usage or getting-started notes:
New to Syft? Check out the Getting Started guide for a walkthrough!
The quickest way to get up and going:
bash
Source: https://github.com/anchore/syft
Extracted from upstream docs: https://raw.githubusercontent.com/anchore/syft/HEAD/README.md