syft

Syft (https://github.com/anchore/syft) and ScanCode (https://github.com/aboutcode-org/scancode-toolkit) are good open-source tools to generate SBOMs and search repos for licensing information — I'm curious to hear if there are reasons why those wouldn't work for enterprise purposes.

CycloneDX tools offer packages for each and every programming language. [1] The dependency track project accumulates all dependency vulnerabilities in a dashboard. [2] Container SBOMs can be generated with syft and grype [3] [4] [1] https://github.com/CycloneDX [2] https://github.com/DependencyTrack [3] https://github.com/anchore/syft [4] https://github.com/anchore/grype

I can wholeheartedly recommend Syft.[0] Decoupling SBOM data collection from vulnerability tracking (with your tool of choice) is a nice capability. 0: https://github.com/anchore/syft

Inside of the SBOMs, we can detect a lot: https://github.com/anchore/syft#supported-ecosystems You're right that the active/dormant detection needs to be customized per type of runtime. It ends up being a mix of both access and execution, and we'll get more sophisticated with eBPF over time. We cover rpm/deb, python and java with the node and others coming very soon. The compiled languages will be our main focus next. For example, Go binaries embed some dependency metadata in the binary itself. Also related to this effort is the "in-toto" integrity chain: https://in-toto.io/in-toto/ Since we're already connecting build to run, we aim to complete the chain.

I'm curious to hear what tools folks are using for generating software bill of materials (SBOMs) today? We're huge fans of the Syft project: https://github.com/anchore/syft You can read more about our "realtime SBOM" concept as well: https://edgebit.io/blog/realtime-sbom/

Currently the best one I know of is https://github.com/anchore/syft. It finds most dependencies even within built artifacts. You can also check out the comments in https://news.ycombinator.com/item?id=32104805 - the release announcement of Salus (Microsoft)

https://github.com/anchore/syft is an easier to use alternative. Just point it at a container image, path or archive and it will generate the SBOM for you. Salus seems to be more flexible - you can also feed the sources and the package manager files into it. I guess the results could be more accurate.

The one I have used is https://github.com/anchore/syft

You can use Syft [1] which generates the full software bill of materials, which includes package names, licenses for a broad set of tech stack ranging from OS level (Alpine, Debian), through Go, Ruby, Python, Java, JavaScript, etc. [1] https://github.com/anchore/syft

If you are working with containers, you want to make sure they don't contain no software with known CVEs. You don't want your image scanner to have blind spots and lull you into a false sense of security. Well, that's exactly what happens if you - Use clair scan with something like distroless (no results at all) - Use trivy or grype with software installed without package manager (via tar) e.g. eclipse-temurin in the alpine version. The java executable gets unpacked into /opt but is not recognized. https://github.com/aquasecurity/trivy/issues/2098 https://github.com/anchore/syft/issues/994

Ed: linked as "infoworld article" in TFA. This article[1] probably seems like a bit of convenient self-promotion from Anchore - but the two tools grype and syft https://github.com/anchore/grype https://github.com/anchore/syft Turned out to be very helpful in easily looking through folders, installed services (in particular an installed mobile device manager running on windows) and container images. [1] https://www.infoworld.com/article/3644492/how-to-detect-the-... Submitted to hn as: https://news.ycombinator.com/item?id=29543589 in case there's more discussion of tooling that might fit there.

This article probably seems like a bit of convenient self-promotion from Anchore - but the two tools grype and syft https://github.com/anchore/grype https://github.com/anchore/syft Turned out to be very helpful in easily looking through folders, installed services (in particular an installed mobile device manager running on windows) and container images.

The approach I like to take is to curate issues and PR with semantic titles and organize them by label ("bug", "enhancement", etc) or linking PRs to an already curated issue. This way automation can use these to generate the changlog for me on each release based on closed issues and unlinked PRs since the last release. We wrote Chronicle to do that automation for us: https://github.com/anchore/chronicle . The nice thing about this... since you typically curate issues during the development process anyway, if you're doing that right then you get a nice looking changlog for free! We use this approach with our core tools, Syft and Grype (some changlog examples: https://github.com/anchore/syft/releases/tag/v0.31.0 and https://github.com/anchore/grype/releases/tag/v0.26.1 ). Always happy to hear new feature ideas and possible customizations

For materials you can use syft https://github.com/anchore/syft