"A CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Exceptional for vulnerability detection when used with a scanner tool like Grype." (1)

Install

As 'root'...

curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin

Usage

For example, to generate a SBOM for Oracle SQL Developer installed in /opt/sqldeveloper...

cd /opt/sqldeveloper

syft . | more

To check for specific files...

syft . | grep log4j

Bibliography & References