Tutorials · DevSecOps & Cloud
How to Generate an SBOM for Your Software and Scan It With Grype
A Software Bill of Materials lists every component in your software. Customers and regulations (such as the EU Cyber Resilience Act) increasingly ask for it. Generate SBOMs with Syft and check them for vulnerabilities with Grype.
Before you start
- Syft and Grype (free, from Anchore; brew or install script)
- A container image or project folder
Step by step
Install the tools
Both tools are single binaries.
brew install syft grypeCreate an SBOM for an image
Use a standard format such as CycloneDX or SPDX so other tools can read it.
syft myapp:1.4.2 -o cyclonedx-json > myapp-1.4.2.cdx.jsonCreate an SBOM for source code
Point Syft at the project folder to list dependencies from lock files.
syft dir:. -o spdx-json > myapp-src.spdx.jsonScan the SBOM for vulnerabilities
Grype reads the SBOM and matches components against vulnerability databases.
grype sbom:./myapp-1.4.2.cdx.json --fail-on highStore SBOMs with each release
Keep the SBOM next to the release artefact. When a new CVE is published, re-scan old SBOMs to see which releases are affected, without rebuilding.
Share with customers
Provide the SBOM on request or in your customer portal, together with your vulnerability handling policy.
Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.
Pro tips
- Generate the SBOM in the same CI job that builds the release, so it matches exactly.
- Sign SBOMs and images (for example with Sigstore cosign) to prove they are authentic.
FAQ
Frequently asked questions
CycloneDX or SPDX?
Both are accepted standards. CycloneDX is popular for security use; SPDX is common for licence compliance. Many teams produce both.
Keep learning
Related guides
Scan images with Trivy
Read more →Add security checks to CI
Read more →Safe change pipeline for networks
Read more →How to Scan Container Images, Code and IaC for Vulnerabilities With Trivy
Trivy is a free scanner for container images, file systems, Git repositories and infrastructure-as-code. Find vulnerable packages and misconfigurations before they reach production.
Read more →How to Add Security Checks to a CI/CD Pipeline (Secrets, SAST, Dependencies, Images)
Shift security left: catch leaked secrets, insecure code, vulnerable dependencies and risky infrastructure settings automatically on every commit, before anything is deployed.
Read more →How to Keep Passwords and API Keys Out of Code With Vault or OpenBao
Hard-coded passwords end up in Git, chat and backups. Store secrets centrally in HashiCorp Vault or its open-source fork OpenBao, control who can read them and let applications fetch them at runtime.
Read more →Stuck on a step?
Ask Navijin technical support or an authorised partner for help with your configuration.