Syft records contents; it does not judge risk
Syft scans a container image, directory, filesystem archive, or other supported artifact and identifies operating-system packages, language packages, files, and relationships. It can emit CycloneDX, SPDX, Syft JSON, and other forms, or convert between supported SBOM formats. This inventory is useful for release evidence, license review, incident response, and later vulnerability matching. Syft itself does not make the vulnerability decision; the README points users to Grype for that job.
The project covers package managers across Linux distributions and ecosystems including Go, Python, Java, JavaScript, Ruby, Rust, PHP, and .NET. That breadth has a cost in implementation size. Our checkout contained 2,840 files, roughly 211,431 source lines, and 33.2 MB. Catalogers must understand many metadata formats and the odd files produced by real build systems, so output validation matters more than a single successful demo scan.
The 141-second source build is optional for users
The README's quickest install pipes a hosted script into a privileged shell. Syft also documents Homebrew, Docker, Scoop, Chocolatey, Nix, and other routes. Security-conscious teams should fetch a versioned artifact, verify it according to their supply-chain policy, and avoid an unreviewed curl | sudo sh in production automation. A standalone binary makes that policy practical without requiring a Go toolchain.
Our source setup resolved 784 Go packages in 77 seconds, then built successfully in 141 seconds. The repository included a Dockerfile, 4 CI workflow files, and a tests directory. A cached developer machine will behave differently from our fresh container, but the measured 218 seconds before tests is enough reason to use released binaries for routine scanning and reserve source builds for contributors or controlled packaging.
What happened when we ran it
We cloned commit bf82010 into an unprivileged Debian container with 3 CPUs, 8 GB of RAM, Go 1.24 on Bookworm, and no secrets. Dependency installation succeeded in 77 seconds, and the build passed in 141 seconds. Tests ran for 150 seconds before the command exited with code 1. The harness counted 15 passed and 5 failed out of 20.
The final log shows Test_Unknowns trying to build a Docker image through Anchore's stereoscope image fixtures. It returned exec: "docker": executable file not found in $PATH, then failed the github.com/anchore/syft/test/cli package. The log proves that this image-based test needed Docker and did not find it. It does not identify the details of the other 4 failures, so we do not assign them the same cause.
A fresh Debian container without Docker is a reasonable place to expose that contributor dependency. It is not evidence that the compiled Syft binary cannot scan directories or remotely available images. The correct handoff is narrower: the build worked, the complete measured test command did not, and anyone reproducing the CLI suite should provide the container tooling expected by its image fixtures.
SPDX and CycloneDX can disagree on relationships
SBOM value depends on what downstream policy reads. Package name, version, PURL, CPE candidates, files, scopes, and dependency edges can each affect later matching. Release v1.51.0 fixed incorrect PURLs for legacy JARs, phantom JavaScript packages, hardlink handling in SPDX verification codes, and Git for Windows CPE candidates. Those fixes show why cataloger upgrades can change security results without any application dependency changing.
Open issue 5173 reports that language-ecosystem packages in image SBOMs can lack dependency relationships and that CycloneDX and SPDX results disagree for the same image. The report is directly about relationship completeness, not package discovery in general. If policy requires dependency graphs, choose representative images and assert expected edges in the exact output format. Do not accept a valid JSON document as proof that its inventory semantics are complete.
Signed attestations need pinned inputs and provenance
Syft can create signed SBOM attestations using the in-toto specification, which makes the inventory easier to associate with a release. The surrounding pipeline still has to pin the artifact. Scanning alpine:latest, as the basic example does, is fine for learning and weak for audit evidence because that tag can later identify different content. Use immutable image digests and record the Syft version, configuration, cataloger selection, and output schema.
An attestation also needs protected signing identity, verification policy, and storage. Syft generates the inventory that enters that chain; it does not decide who may sign or which consumers must reject an unverified result. Keep the raw Syft JSON when possible, then produce the standard form required by customers or regulators. Format conversion can only map information that both models can represent.
v1.51.0 and August issue work show active maintenance
Syft v1.51.0 was published on August 10, 2026, and GitHub recorded a push on August 21. The repository had 9,460 stars and 635 open issues and pull requests when fetched. Recent work covered Elixir package names, Java archives, kernel detection, Conda-owned files, Yarn development dependencies, and relationship overlap. That combined open count is not a defect count; it includes active proposals and code reviews.
Syft is the sensible first trial for teams that need broad SBOM coverage and an Apache-2.0 Go tool. Compare its output with Trivy or cdxgen on the artifacts that matter, especially mixed-language images. Our successful build and Docker-dependent failure give a clear setup lesson, while issue 5173 gives the more important product lesson: inspect relationships and identifiers, not merely whether an SBOM file was produced.