# anchore/syft architecture

> Architecture diagram of the GitHub repository anchore/syft, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-10-15). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/anchore/syft
- Repository: https://github.com/anchore/syft

## Overview

Syft is a CLI and Go library for building SBOMs from images, filesystems, and archives. The principal workflow accepts a scan target, resolves it as a source, catalogs packages and files, assembles an SBOM, then encodes it in a requested format. The graph also preserves documented format conversion and signed attestations. Some connections are documented only at a high level: unsampled command and orchestration code limits verification of their exact runtime calls.

Main entry points: [`cmd/syft/internal/commands/scan.go`](https://github.com/anchore/syft/blob/main/cmd/syft/internal/commands/scan.go) (CLI commands), [`syft/get_source.go`](https://github.com/anchore/syft/blob/main/syft/get_source.go) (Source selection), [`internal/task/package_tasks.go`](https://github.com/anchore/syft/blob/main/internal/task/package_tasks.go) (Package catalogers), [`internal/sbomsync/builder.go`](https://github.com/anchore/syft/blob/main/internal/sbomsync/builder.go) (SBOM assembly)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_entry["CLI and API"]
  node_cli["CLI commands<br/>[scan.go]"]
  node_library["Go library API<br/>[lib.go]"]
end

subgraph group_sources["Target sources"]
  node_source["Source selection<br/>[get_source.go]"]
  node_file_source["Filesystem source<br/>[file_source.go]"]
  node_oci_source["OCI registry source<br/>[registry_client.go]"]
  node_snap_source["Snap source<br/>[snap_source.go]"]
  node_resolver["File resolution<br/>[resolver.go]"]
end

subgraph group_catalog["Cataloging"]
  node_pkg_catalogers["Package catalogers<br/>[package_tasks.go]"]
  node_ecosystem_catalogers["Ecosystem parsers"]
  node_file_catalogers["File catalogers<br/>[file_tasks.go]"]
  node_relationship_tasks["Relationship tasks"]
  node_unknown_tasks["Unknown labeling<br/>[unknowns_tasks.go]"]
end

subgraph group_sbom["SBOM and output"]
  node_sbom_builder["SBOM assembly<br/>[builder.go]"]
  node_sbom_model["SBOM model<br/>[sbom.go]"]
  node_format_encoders["Format encoders<br/>[encoders.go]"]
  node_format_decoders["Format decoders<br/>[decoders.go]"]
  node_attestation["SBOM attestation<br/>[attest.go]"]
end

subgraph group_internals["Internal services"]
  node_feature_detection["Feature detection"]
  node_spill_buffer["Spill buffer<br/>[buffer.go]"]
  node_json_schema["JSON schema<br/>[main.go]"]
end

node_user(("CLI user"))

node_user -->|"requests scan"| node_cli
node_cli -.->|"selects target"| node_source
node_library -.->|"resolves source"| node_source
node_source -.->|"supports filesystem"| node_file_source
node_source -.->|"supports OCI"| node_oci_source
node_source -.->|"supports Snap"| node_snap_source
node_file_source -.->|"provides files"| node_resolver
node_oci_source -.->|"provides files"| node_resolver
node_cli -.->|"starts cataloging"| node_pkg_catalogers
node_pkg_catalogers -->|"registers catalogers"| node_ecosystem_catalogers
node_cli -.->|"starts cataloging"| node_file_catalogers
node_file_catalogers -->|"writes results"| node_sbom_builder
node_cli -.->|"runs tasks"| node_relationship_tasks
node_cli -.->|"runs tasks"| node_unknown_tasks
node_pkg_catalogers -.->|"records packages"| node_sbom_builder
node_sbom_builder -->|"builds SBOM"| node_sbom_model
node_cli -.->|"selects output"| node_format_encoders
node_format_encoders -.->|"encodes SBOM"| node_sbom_model
node_cli -->|"converts formats"| node_format_decoders
node_cli -->|"creates attestations"| node_attestation
node_cli -.->|"checks features"| node_feature_detection

click node_cli "https://github.com/anchore/syft/blob/main/cmd/syft/internal/commands/scan.go"
click node_library "https://github.com/anchore/syft/blob/main/syft/lib.go"
click node_source "https://github.com/anchore/syft/blob/main/syft/get_source.go"
click node_file_source "https://github.com/anchore/syft/blob/main/syft/source/filesource/file_source.go"
click node_oci_source "https://github.com/anchore/syft/blob/main/syft/source/ocimodelsource/registry_client.go"
click node_snap_source "https://github.com/anchore/syft/blob/main/syft/source/snapsource/snap_source.go"
click node_resolver "https://github.com/anchore/syft/blob/main/syft/file/resolver.go"
click node_pkg_catalogers "https://github.com/anchore/syft/blob/main/internal/task/package_tasks.go"
click node_ecosystem_catalogers "https://github.com/anchore/syft/tree/main/syft/pkg/cataloger"
click node_file_catalogers "https://github.com/anchore/syft/blob/main/internal/task/file_tasks.go"
click node_relationship_tasks "https://github.com/anchore/syft/blob/main/internal/task/relationship_tasks.go"
click node_unknown_tasks "https://github.com/anchore/syft/blob/main/internal/task/unknowns_tasks.go"
click node_sbom_builder "https://github.com/anchore/syft/blob/main/internal/sbomsync/builder.go"
click node_sbom_model "https://github.com/anchore/syft/blob/main/syft/sbom/sbom.go"
click node_format_encoders "https://github.com/anchore/syft/blob/main/syft/format/encoders.go"
click node_format_decoders "https://github.com/anchore/syft/blob/main/syft/format/decoders.go"
click node_attestation "https://github.com/anchore/syft/blob/main/cmd/syft/internal/commands/attest.go"
click node_feature_detection "https://github.com/anchore/syft/blob/main/internal/os/feature_detection.go"
click node_spill_buffer "https://github.com/anchore/syft/blob/main/internal/spillbuf/buffer.go"
click node_json_schema "https://github.com/anchore/syft/blob/main/internal/jsonschema/main.go"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_cli,node_library,node_user toneBlue
class node_source,node_file_source,node_oci_source,node_snap_source,node_resolver toneAmber
class node_pkg_catalogers,node_ecosystem_catalogers,node_file_catalogers,node_relationship_tasks,node_unknown_tasks toneMint
class node_sbom_builder,node_sbom_model,node_format_encoders,node_format_decoders,node_attestation toneRose
class node_feature_detection,node_spill_buffer,node_json_schema toneIndigo
```

## Components

### CLI and API

- [CLI commands](https://github.com/anchore/syft/blob/main/cmd/syft/internal/commands/scan.go): `cmd/syft/internal/commands/scan.go`
- [Go library API](https://github.com/anchore/syft/blob/main/syft/lib.go): `syft/lib.go`

### Target sources

- [Source selection](https://github.com/anchore/syft/blob/main/syft/get_source.go): `syft/get_source.go`
- [Filesystem source](https://github.com/anchore/syft/blob/main/syft/source/filesource/file_source.go): `syft/source/filesource/file_source.go`
- [OCI registry source](https://github.com/anchore/syft/blob/main/syft/source/ocimodelsource/registry_client.go): `syft/source/ocimodelsource/registry_client.go`
- [Snap source](https://github.com/anchore/syft/blob/main/syft/source/snapsource/snap_source.go): `syft/source/snapsource/snap_source.go`
- [File resolution](https://github.com/anchore/syft/blob/main/syft/file/resolver.go): `syft/file/resolver.go`

### Cataloging

- [Package catalogers](https://github.com/anchore/syft/blob/main/internal/task/package_tasks.go): `internal/task/package_tasks.go`
- [Ecosystem parsers](https://github.com/anchore/syft/tree/main/syft/pkg/cataloger): `syft/pkg/cataloger`
- [File catalogers](https://github.com/anchore/syft/blob/main/internal/task/file_tasks.go): `internal/task/file_tasks.go`
- [Relationship tasks](https://github.com/anchore/syft/blob/main/internal/task/relationship_tasks.go): `internal/task/relationship_tasks.go`
- [Unknown labeling](https://github.com/anchore/syft/blob/main/internal/task/unknowns_tasks.go): `internal/task/unknowns_tasks.go`

### SBOM and output

- [SBOM assembly](https://github.com/anchore/syft/blob/main/internal/sbomsync/builder.go): `internal/sbomsync/builder.go`
- [SBOM model](https://github.com/anchore/syft/blob/main/syft/sbom/sbom.go): `syft/sbom/sbom.go`
- [Format encoders](https://github.com/anchore/syft/blob/main/syft/format/encoders.go): `syft/format/encoders.go`
- [Format decoders](https://github.com/anchore/syft/blob/main/syft/format/decoders.go): `syft/format/decoders.go`
- [SBOM attestation](https://github.com/anchore/syft/blob/main/cmd/syft/internal/commands/attest.go): `cmd/syft/internal/commands/attest.go`

### Internal services

- [Feature detection](https://github.com/anchore/syft/blob/main/internal/os/feature_detection.go): `internal/os/feature_detection.go`
- [Spill buffer](https://github.com/anchore/syft/blob/main/internal/spillbuf/buffer.go): `internal/spillbuf/buffer.go`
- [JSON schema](https://github.com/anchore/syft/blob/main/internal/jsonschema/main.go): `internal/jsonschema/main.go`

### Other components

- **CLI user**

## Connections

- CLI user → CLI commands: requests scan (evidence: `README.md`)
- CLI commands → Source selection: selects target
- Go library API → Source selection: resolves source
- Source selection → Filesystem source: supports filesystem
- Source selection → OCI registry source: supports OCI
- Source selection → Snap source: supports Snap
- Filesystem source → File resolution: provides files
- OCI registry source → File resolution: provides files
- CLI commands → Package catalogers: starts cataloging
- Package catalogers → Ecosystem parsers: registers catalogers (evidence: `internal/task/package_tasks.go`)
- CLI commands → File catalogers: starts cataloging
- File catalogers → SBOM assembly: writes results (evidence: `internal/task/file_tasks.go`)
- CLI commands → Relationship tasks: runs tasks
- CLI commands → Unknown labeling: runs tasks
- Package catalogers → SBOM assembly: records packages
- SBOM assembly → SBOM model: builds SBOM (evidence: `internal/sbomsync/builder.go`)
- CLI commands → Format encoders: selects output
- Format encoders → SBOM model: encodes SBOM
- CLI commands → Format decoders: converts formats (evidence: `README.md`)
- CLI commands → SBOM attestation: creates attestations (evidence: `README.md`)
- CLI commands → Feature detection: checks features