How anchore/syft works
Syft is a CLI and Go library for building SBOMs from images, filesystems, and archives. The principal workflow accepts a scan target, resolves it as a source, catalogs packages and files, assembles an SBOM, then encodes it in a requested format. The graph also preserves documented format conversion and signed attestations. Some connections are documented only at a high level: unsampled command and orchestration code limits verification of their exact runtime calls.
Main entry points: scan.go CLI commands · get_source.go Source selection · package_tasks.go Package catalogers · builder.go SBOM assembly
Components 21
CLI and API
- CLI commands
cmd/syft/internal/commands/scan.go - Go library API
syft/lib.go
Target sources
- Source selection
syft/get_source.go - Filesystem source
syft/source/filesource/file_source.go - OCI registry source
syft/source/ocimodelsource/registry_client.go - Snap source
syft/source/snapsource/snap_source.go - File resolution
syft/file/resolver.go
Cataloging
- Package catalogers
internal/task/package_tasks.go - Ecosystem parsers
syft/pkg/cataloger - File catalogers
internal/task/file_tasks.go - Relationship tasks
internal/task/relationship_tasks.go - Unknown labeling
internal/task/unknowns_tasks.go
SBOM and output
- SBOM assembly
internal/sbomsync/builder.go - SBOM model
syft/sbom/sbom.go - Format encoders
syft/format/encoders.go - Format decoders
syft/format/decoders.go - SBOM attestation
cmd/syft/internal/commands/attest.go
Internal services
- Feature detection
internal/os/feature_detection.go - Spill buffer
internal/spillbuf/buffer.go - JSON schema
internal/jsonschema/main.go
Other components
- CLI user
Connections 21
- CLI user → CLI commands: requests scan
README.md - CLI commands → Source selection: selects target
- Go library API → Source selection: resolves source
- Source selection → Filesystem source: supports filesystem
- Source selection → OCI registry source: supports OCI
- Source selection → Snap source: supports Snap
- Filesystem source → File resolution: provides files
- OCI registry source → File resolution: provides files
- CLI commands → Package catalogers: starts cataloging
- Package catalogers → Ecosystem parsers: registers catalogers
internal/task/package_tasks.go - CLI commands → File catalogers: starts cataloging
- File catalogers → SBOM assembly: writes results
internal/task/file_tasks.go - CLI commands → Relationship tasks: runs tasks
- CLI commands → Unknown labeling: runs tasks
- Package catalogers → SBOM assembly: records packages
- SBOM assembly → SBOM model: builds SBOM
internal/sbomsync/builder.go - CLI commands → Format encoders: selects output
- Format encoders → SBOM model: encodes SBOM
- CLI commands → Format decoders: converts formats
README.md - CLI commands → SBOM attestation: creates attestations
README.md - CLI commands → Feature detection: checks features