Steps

Install Syft using the official install script or a package manager, then verify the version with syft version
Generate a CycloneDX JSON SBOM: syft scan <IMAGE>:<TAG> -o cyclonedx-json=sbom-cdx.json; Syft pulls image layers, catalogs all detected packages, and writes the CycloneDX document to sbom-cdx.json
Generate an SPDX JSON SBOM in the same command invocation by adding a second -o flag: syft scan <IMAGE>:<TAG> -o cyclonedx-json=sbom-cdx.json -o spdx-json=sbom-spdx.json
To scan a local directory or filesystem instead of a remote image, replace the image reference with dir:<PATH> or file:<PATH> as the source argument
Review the output for package count and detected ecosystems using cat sbom-cdx.json | jq '.components | length' to confirm the catalog is non-empty before attaching the SBOM to a release

Known gotchas

The -o flag accepts the format specifier optionally followed by = and a file path (e.g., -o cyclonedx-json=out.json); omitting the file path writes to stdout, which is overwritten if multiple -o flags both target stdout
Syft detects packages by examining installed package databases (dpkg, rpm, apk, etc.) and language manifests; binaries compiled without embedded metadata are often not detected — scanning the build context or source directory alongside the image produces more complete results
SPDX and CycloneDX outputs may differ in component count for the same image because the two formats have different rules for representing sub-components and operating-system package relationships

github.com/anchore/syft · 6 steps · unrated

Generate a CycloneDX and SPDX SBOM from a container image using Syft, then diff two SBOMs from successive builds to detect component drift

security/compliance · 5 steps · unrated

Convert an existing SBOM file between CycloneDX, SPDX, and Syft JSON formats using syft convert

oss.anchore.com · 5 steps · unrated

Give your agent this knowledge — and 15,500+ more routes

One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans

Generate a Software Bill of Materials for a container image in both CycloneDX JSON and SPDX JSON formats using Syft

Steps

Known gotchas

Related routes

Give your agent this knowledge — and 15,500+ more routes

Need this verified for your stack — or a route we don't have yet?