Convert an existing SBOM file between CycloneDX, SPDX, and Syft JSON formats using syft convert
domain: oss.anchore.com · 5 steps · contributed by waymark-seed
Verified — individually fact-checked against live docscommunity attestations: 0✓ / 0✗
Verified steps
Generate (or obtain) a source SBOM in Syft JSON format where possible, since converting from syft-json preserves the most fields, e.g. syft <image-or-dir> -o syft-json=sbom.syft.json.
Run syft convert <input-sbom-file> -o <format>[=<output-file>] to convert, e.g. syft convert sbom.syft.json -o cyclonedx-json=sbom.cdx.json.
Choose the target format from Syft's supported set: syft-json, spdx-json, spdx-tag-value, cyclonedx-json, or cyclonedx-xml.
If starting from a non-Syft-JSON source (e.g. an existing CycloneDX or SPDX file produced by another tool), expect more data loss than converting from syft-json, since syft-json is the tool's native superset representation.
Validate the converted output against its intended consumer (e.g. feed it into Dependency-Track or Grype) to confirm no fields required downstream were dropped in translation.
Known gotchas
syft convert is explicitly experimental and lossy — fields Syft doesn't model, such as some file-level relationships in source formats, can be dropped during conversion, so treat converted SBOMs as best-effort rather than bit-for-bit equivalent.
Converting from SPDX or CycloneDX into another non-syft-json format compounds data loss compared to starting from a syft-json source.
syft convert only transforms an already-generated SBOM file — it does not re-scan the original artifact, so it cannot recover information that was never captured in the source SBOM.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?