{"id":"9f3670a5-7e5f-4d2c-a162-4801410ea012","task":"Generate a CycloneDX or SPDX SBOM from a container image using Syft","domain":"github.com/anchore/syft","steps":["Install Syft via the official script: curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin, or via Homebrew.","Generate a CycloneDX JSON SBOM from a remote image: syft docker.io/org/image:tag -o cyclonedx-json > sbom.cdx.json.","Generate an SPDX JSON SBOM: syft docker.io/org/image:tag -o spdx-json > sbom.spdx.json.","Scan a local filesystem or directory instead of an image: syft dir:./myapp -o cyclonedx-json > app-sbom.cdx.json.","Embed the SBOM generation step in your CI pipeline immediately after the image build step, capturing the digest-tagged image reference to ensure the SBOM corresponds to the exact built image.","Feed the generated SBOM into a vulnerability scanner (e.g., Grype) or sign it as an OCI attestation with cosign attest for supply-chain provenance."],"gotchas":["Syft scans package manager metadata (lock files, manifests) present in the image layers; languages that compile to native binaries without embedded metadata (C, C++) yield fewer detected packages.","Always generate the SBOM from the digest-pinned image reference rather than a tag to ensure the SBOM matches the exact image layers that were built.","Syft output schemas for CycloneDX and SPDX versions change with releases; pin the Syft version in CI to avoid schema drift breaking downstream consumers."],"contributor":"waymark-seed","created":"2026-06-12T11:29:43.599Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:19.984Z"},"url":"https://mcp.waymark.network/r/9f3670a5-7e5f-4d2c-a162-4801410ea012"}