$ show anchore/syft
Syft is a production-grade CLI tool and Go library for generating Software Bills of Materials (SBOMs) from container images, filesystems, directories, and OCI artifacts. It detects and catalogs packages across 40+ ecosystems (Alpine, Debian, RPM, Python, Java, Go, Ruby, Rust, JavaScript, .NET, etc.) by parsing lockfiles, package databases, binary metadata, and source manifests. The tool outputs SBOMs in multiple formats including CycloneDX (JSON/XML), SPDX (JSON/tag-value), Syft JSON, and GitHub Dependency Snapshots, with version-aware encoding and decoding. Architecturally, Syft uses a modular cataloger system where each ecosystem implements a `generic.Cataloger` with parser functions registered by file globs or MIME types. A task-based pipeline orchestrates file indexing, package cataloging, dependency resolution, and relationship linking. The system supports both library integration via `syft.CreateSBOM()` and a CLI with cobra commands (`scan`, `attest`, `convert`, `cataloger`). A bubbletea-based TUI provides real-time progress feedback during image pulls and cataloging. External dependencies include `stereoscope` for container image access, `cosign` for attestation signing, and `go-partybus` for event-driven UI. Key entry points include `cmd/syft/main.go` (CLI), `syft/create_sbom.go` (library API), `syft/get_source.go` (source resolution), and the format encoders/decoders in `syft/format/`. The codebase demonstrates strong engineering practices: extensive test coverage (unit, integration, snapshot), CI/CD with GitHub Actions, auto-generated JSON schemas, and drift-check scripts for capabilities and schema. Notable reusable components include the generic cataloger framework, the dependency resolver, and the file resolver abstraction.
The LLM identified 4 files worth highlighting for reuse:
Provides a reusable `Cataloger` struct that accepts parser functions registered by file globs, MIME types, or paths. Decouples parsing logic from cataloging orchestration, enabling easy addition of new ecosystems without modifying the core pipeline.
Implements a generic dependency resolver that matches 'provides' claims to 'requires' claims across packages, creating `DependencyOfRelationship` edges. Used by multiple catalogers (PHP, Elixir, etc.) and easily extractable for other projects needing dependency graph construction.
Wraps an `io.Reader` into an `io.ReadSeeker` by buffering the entire stream into memory. Essential for format decoders that need to seek backwards (e.g., sniffing magic bytes). Small, self-contained, and reusable in any Go project that needs seekable access to non-seekable streams.
Defines the `Resolver` interface with methods for searching files by glob, path, MIME type, and content. Implementations exist for directories, container images (squashed, all-layers, deep squash), and OCI model artifacts. This abstraction decouples catalogers from the underlying storage, enabling testability and new source types.