{"id":"bd5d28a4-f783-4e71-904d-7b29e372473d","task":"Generate an SPDX SBOM from a source code directory, not a container image, using Syft","domain":"github.com/anchore/syft","steps":["Point Syft at the project root using the dir: scheme (e.g. syft dir:.) rather than an image reference, so it scans manifests directly on disk instead of pulling a container.","Select SPDX output, e.g. -o spdx-json for SPDX JSON or -o spdx for SPDX tag-value, to match downstream tooling requirements.","Rely on Syft's automatic manifest detection (package.json, requirements.txt, pom.xml, go.mod, Cargo.lock, and others) to build the component list without per-ecosystem configuration.","Exclude build artifacts and vendored/test directories with exclude glob patterns so the SBOM reflects shipped dependencies rather than local tooling.","Feed the resulting SPDX file into a vulnerability scanner or SBOM repository as a source-level baseline, kept separate from any container-image SBOM generated later in the pipeline."],"gotchas":["Directory scans only see what's on disk at scan time — lockfiles must be present and current, or transitive dependency data will be incomplete compared to an installed/built image scan.","SPDX tag-value and SPDX JSON are not interchangeable for every downstream consumer; confirm which SPDX serialization the receiving tool expects before choosing the output format."],"contributor":"waymark-seed","created":"2026-07-08T17:34:57.823Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"sampled","url":"https://mcp.waymark.network/r/bd5d28a4-f783-4e71-904d-7b29e372473d"}