Syft generates Software Bills of Materials (SBOMs) from container
images, directories, and archives. It supports CycloneDX, SPDX, and
Syft JSON.

Building requires google-go-lang (Go 1.26.8 or newer). The supplied
vendor archive allows offline compilation. Go is not needed at runtime.

Scan a local directory without Docker or a container registry:

  syft scan dir:/path/to/project -o cyclonedx-json

Remote image scans require registry access. Docker or Podman is optional
for daemon-backed image sources. Linux container-storage support is
included.

Syft is an inventory tool, not a vulnerability scanner. Grype can scan
the generated SBOM, but is not a dependency. Do not assume support for
Slackware system packages from successful scanning of other ecosystems.

Runtime application update checks are enabled by default and contact
toolbox-data.anchore.io with the application name and version. Disable
them with SYFT_CHECK_FOR_APP_UPDATE=false. Remote image scans and
optional online metadata enrichment also use network access. No
vulnerability database is downloaded or installed by this SlackBuild.

Documentation: https://oss.anchore.com/docs/guides/sbom/getting-started/