anchore/syft

View on GitHub

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

Stars: 9.6k
Forks: 954
Open beginner issues: 0
Indexed issues: 506
Avg merge: 23h 27m
Merged PRs (30d): 48

Dominant language: Go
License: Apache-2.0
Last GitHub push: Sep 11, 2026
Latest indexed: Sep 14, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: good first issue help wanted

Open All

504 open issues indexed

Support identification of additional linux distributions Open

anchore/syft#2 · 1 comment · 3 reactions · 0 assignees · Indexed Sep 14, 2026
Enhance scoping selections Open

enhancement

anchore/syft#15 · 11 comments · 0 reactions · 1 assignee · Indexed Sep 14, 2026
Idea: add additional catalogers via plugin Open

anchore/syft#17 · 1 comment · 6 reactions · 0 assignees · Indexed Sep 14, 2026
Add gpg key verification Open

anchore/syft#23 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Add support for user provided content "hints" file Open

enhancement I/O

anchore/syft#31 · 12 comments · 1 reaction · 0 assignees · Indexed Sep 14, 2026
Add line numbers when reporting artifact locations Open

enhancement

anchore/syft#1208 · 2 comments · 1 reaction · 0 assignees · Indexed Sep 14, 2026
improve capture regex in setup.py cataloger Open

ecosystem:python

anchore/syft#151 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
CycloneDX always reports components as libraries Open

bug I/O

anchore/syft#193 · 0 comments · 2 reactions · 0 assignees · Indexed Sep 14, 2026
Add alpine to the compare testing / reconcile APK version & release fields Open

ecosystem:os enhancement

anchore/syft#195 · 0 comments · 1 reaction · 0 assignees · Indexed Sep 14, 2026
Add documentation for adding new catalogers Open

documentation enhancement

anchore/syft#243 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Full cataloging of archive contents Open

enhancement

anchore/syft#246 · 7 comments · 5 reactions · 1 assignee · Indexed Sep 14, 2026
Compare two SBOMs Open

enhancement

anchore/syft#292 · 2 comments · 1 reaction · 0 assignees · Indexed Sep 14, 2026
Add magic number classification in the FileMetadata cataloger/indexer Open

enhancement

anchore/syft#336 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Add ability to append labels to SBOM Open

enhancement good-first-issue

anchore/syft#347 · 3 comments · 5 reactions · 0 assignees · Indexed Sep 14, 2026
Add nightly comparison testing with key images Open

enhancement testing

anchore/syft#358 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Ensure cataloging execution path does not hide potential results Open

bug

anchore/syft#359 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Surface warnings in the syft JSON document Open

enhancement I/O

anchore/syft#360 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 14, 2026
DPKG source name based on source version value Open

bug

anchore/syft#377 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Missing ETUI interaction for pull from registry (registry source only) Open

enhancement

anchore/syft#383 · 0 comments · 1 reaction · 0 assignees · Indexed Sep 14, 2026
Allow for SBOM as input Open

enhancement I/O

anchore/syft#400 · 0 comments · 3 reactions · 0 assignees · Indexed Sep 14, 2026
Catalog java artifacts by file name without requiring content Open

ecosystem:java enhancement

anchore/syft#409 · 0 comments · 1 reaction · 0 assignees · Indexed Sep 14, 2026
Set correct TargetSW for Node.js Redis CPE Open

ecosystem:javascript

anchore/syft#412 · 4 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Update "artifact" to "package" in output Open

enhancement I/O

anchore/syft#417 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Add opt-in cache support Open

enhancement I/O

anchore/syft#434 · 0 comments · 3 reactions · 0 assignees · Indexed Sep 14, 2026
Add package description/summary to json output Open

ecosystem:javascript ecosystem:os ecosystem:ruby enhancement good-first-issue I/O

anchore/syft#436 · 2 comments · 2 reactions · 0 assignees · Indexed Sep 14, 2026
Improve scheme parsing to cover relative directory paths Open

bug

anchore/syft#441 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Enhance SPDX Support Open

enhancement

anchore/syft#444 · 1 comment · 1 reaction · 0 assignees · Indexed Sep 14, 2026
hash integrity of the scanned image Open

enhancement format:cyclonedx

anchore/syft#451 · 5 comments · 1 reaction · 0 assignees · Indexed Sep 14, 2026
Adapt new and existing package metadata as SPDX relationships Open

blocked enhancement format:spdx

anchore/syft#476 · 7 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Expose file metadata for image contents Open

enhancement format:spdx I/O

anchore/syft#477 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Loosen docker daemon requirement for running tests Open

enhancement

anchore/syft#479 · 0 comments · 1 reaction · 0 assignees · Indexed Sep 14, 2026
Investigate Yarn 2 Plug'n'Play Open

ecosystem:javascript enhancement

anchore/syft#486 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Include source file location information: line & character numbers Open

enhancement

anchore/syft#488 · 1 comment · 1 reaction · 0 assignees · Indexed Sep 14, 2026
Get purl url from maven dependency Open

ecosystem:java enhancement

anchore/syft#498 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Provide a way to verify release integrity Open

enhancement release

anchore/syft#505 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Allow cataloging from a remote resources Open

enhancement

anchore/syft#542 · 0 comments · 6 reactions · 0 assignees · Indexed Sep 14, 2026
Exclude options Open

enhancement

anchore/syft#547 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Encapsulate all artifacts in syft JSON output Open

enhancement

anchore/syft#555 · 3 comments · 2 reactions · 0 assignees · Indexed Sep 14, 2026
Migrate scheme parsing and source resolution to a separate lib Open

enhancement

anchore/syft#557 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Overuse of "metadata" as a phrase Open

breaking-change

anchore/syft#559 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026
Describe multiple SBOM scan targets Open

enhancement multiple-sources

anchore/syft#562 · 5 comments · 5 reactions · 0 assignees · Indexed Sep 14, 2026
Support SBOM query and exploration Open

enhancement

anchore/syft#564 · 4 comments · 5 reactions · 0 assignees · Indexed Sep 14, 2026
Identify SPDX license identifiers Open

enhancement format:spdx license

anchore/syft#565 · 0 comments · 6 reactions · 0 assignees · Indexed Sep 14, 2026
Support for reading archives from stdin without --quiet ? Open

enhancement good-first-issue

anchore/syft#569 · 5 comments · 3 reactions · 1 assignee · Indexed Sep 14, 2026
Add support for package dependency relationships Open

ecosystem:go ecosystem:java ecosystem:javascript ecosystem:os ecosystem:python ecosystem:ruby ecosystem:rust enhancement planning

anchore/syft#572 · 15 comments · 36 reactions · 1 assignee · Indexed Sep 14, 2026
Verify brew installations on/before release Open

enhancement release

anchore/syft#576 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 14, 2026
sign Syft binary/container image via cosign Open

enhancement

anchore/syft#585 · 7 comments · 2 reactions · 0 assignees · Indexed Sep 14, 2026
Upload SBOM directly to OCI registry Open

enhancement needs-investigation

anchore/syft#592 · 20 comments · 4 reactions · 1 assignee · Indexed Sep 14, 2026
ossf/scorecard vulnerabilities fix tracking issue Open

enhancement

anchore/syft#593 · 3 comments · 1 reaction · 0 assignees · Indexed Sep 14, 2026
Provide feedback to user when an exact manifest digest was not provided Open

enhancement I/O

anchore/syft#602 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 14, 2026

anchore/syft

Get new issues in your inbox