🧰 Syft

The items that name it 7

• https://github.com/dmdhrumilmistry/security-harness
  repo2026-09-29

  SBOM generation tool, auto-installed by Stage 0 when missing

• vet (SafeDep)
  repo2026-09-07

  SBOM generation tool referenced as underlying foundation

• Best SBOM Tools in 2026, Compared | Blog | Endor Labs
  article2026-07-29It is written here as Syft (Anchore).

  Open source SBOM generator; CLI-first, supports 30+ package ecosystems, exports SPDX and CycloneDX, pairs with Grype for vulnerability scanning; handles container images alongside source. No reachability analysis; manifest parsing can miss shadow dependencies.

• glsec
  repo2026-07-29

  regenerate a trustworthy SBOM from a verified archive

• Orca: 8 Container Security Best Practices for 2026
  article2026-06-11It is written here as Syft (SBOM generation in SPDX and CycloneDX formats).

  SBOM generation in SPDX and CycloneDX formats

• SBOMs in 2026: Everyone's generating them, no one's using them
  article2026-06-10

  Used by Aikido to generate accurate SBOMs

• n8n Cybersecurity Workflows
  repo2026-05-06

  SBOM generation