GitHub - anchore/syft: CLI tool and library for generating a Software Bill of Ma...
source link: https://github.com/anchore/syft
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
A CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Exceptional for vulnerability detection when used with a scanner tool like Grype.
Join our community meetings!
Features
- Catalog container images and filesystems to discover packages and libraries.
- Supports packages and libraries from various ecosystems (APK, DEB, RPM, Ruby Bundles, Python Wheel/Egg/requirements.txt, JavaScript NPM/Yarn, Java JAR/EAR/WAR, Jenkins plugins JPI/HPI, Go modules)
- Linux distribution identification (supports Alpine, BusyBox, CentOS/RedHat, Debian/Ubuntu flavored distributions)
- Supports Docker and OCI image formats
- Direct support for Grype, a fast and powerful vulnerability matcher.
If you encounter an issue, please let us know using the issue tracker.
Installation
Recommended
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b /usr/local/bin
...or, you can specify a release version and destination directory for the installation:
curl -sSfL https://raw.githubusercontent.com/anchore/syft/main/install.sh | sh -s -- -b <DESTINATION_DIR> <RELEASE_VERSION>
Homebrew
brew tap anchore/syft brew install syft
Note: Currently, Syft is built only for macOS and Linux.
Getting started
To generate an SBOM for a Docker or OCI image:
syft <image>
Note: This is equivalent to specifying the packages
subcommand:
syft packages <image>
The above output includes only software that is visible in the container (i.e., the squashed representation of the image).
To include software from all image layers in the SBOM, regardless of its presence in the final image, provide --scope all-layers
:
syft packages <image> --scope all-layers
Supported sources
Syft can generate a SBOM from a variety of sources:
# catalog a container image archive (from the result of `docker image save ...`, `podman save ...`, or `skopeo copy` commands)
syft packages path/to/image.tar
# catalog a directory
syft packages path/to/dir
Sources can be explicitly provided with a scheme:
docker:yourrepo/yourimage:tag use images from the Docker daemon
docker-archive:path/to/yourimage.tar use a tarball from disk for archives created from "docker save"
oci-archive:path/to/yourimage.tar use a tarball from disk for OCI archives (from Skopeo or otherwise)
oci-dir:path/to/yourimage read directly from a path on disk for OCI layout directories (from Skopeo or otherwise)
dir:path/to/yourproject read directly from a path on disk (any directory)
file:path/to/yourproject/file read directly from a path on disk (any single file)
registry:yourrepo/yourimage:tag pull image directly from a registry (no container runtime required)
Output formats
The output format for Syft is configurable as well:
syft packages <image> -o <format>
Where the formats
available are:
json
: Use this to get as much information out of Syft as possible!text
: A row-oriented, human-and-machine-friendly output.cyclonedx
: A XML report conforming to the CycloneDX 1.2 specification.spdx
: A tag-value formatted report conforming to the SPDX 2.2 specification.spdx-json
: A JSON report conforming to the SPDX 2.2 JSON Schema.table
: A columnar summary (default).
Private Registry Authentication
Local Docker Credentials
When a container runtime is not present, Syft can still utilize credentials configured in common credential sources (such as ~/.docker/config.json
).
It will pull images from private registries using these credentials. The config file is where your credentials are stored when authenticating with private registries via some command like docker login
.
For more information see the go-containerregistry
documentation.
An example config.json
looks something like this:
// config.json
{
"auths": {
"registry.example.com": {
"username": "AzureDiamond",
"password": "hunter2"
}
}
}
You can run the following command as an example. It details the mount/environment configuration a container needs to access a private registry:
docker run -v ./config.json:/config/config.json -e "DOCKER_CONFIG=/config" anchore/syft:latest <private_image>
Docker Credentials in Kubernetes
The below section shows a simple workflow on how to mount this config file as a secret into a container on kubernetes.
-
Create a secret. The value of
config.json
is important. It refers to the specification detailed here. Below this section is thesecret.yaml
file that the pod configuration will consume as a volume. The keyconfig.json
is important. It will end up being the name of the file when mounted into the pod.# secret.yaml apiVersion: v1 kind: Secret metadata: name: registry-config namespace: syft data: config.json: <base64 encoded config.json>
kubectl apply -f secret.yaml
-
Create your pod running syft. The env
DOCKER_CONFIG
is important because it advertises where to look for the credential file. In the below example, settingDOCKER_CONFIG=/config
informs syft that credentials can be found at/config/config.json
. This is why we usedconfig.json
as the key for our secret. When mounted into containers the secrets' key is used as the filename. ThevolumeMounts
section mounts our secret to/config
. Thevolumes
section names our volume and leverages the secret we created in step one.# pod.yaml apiVersion: v1 kind: Pod spec: containers: - image: anchore/syft:latest name: syft-private-registry-demo env: - name: DOCKER_CONFIG value: /config volumeMounts: - mountPath: /config name: registry-config readOnly: true args: - <private_image> volumes: - name: registry-config secret: secretName: registry-config
kubectl apply -f pod.yaml
-
The user can now run
kubectl logs syft-private-registry-demo
. The logs should show the syft analysis for the<private_image>
provided in the pod configuration.
Using the above information, users should be able to configure private registry access without having to do so in the grype
or syft
configuration files.
They will also not be dependent on a docker daemon, (or some other runtime software) for registry configuration and access.
Configuration
Configuration search paths:
.syft.yaml
.syft/config.yaml
~/.syft.yaml
<XDG_CONFIG_HOME>/syft/config.yaml
Configuration options (example values are the default):
# the output format of the SBOM report (options: table, text, json) # same as -o ; SYFT_OUTPUT env var output: "table" # suppress all output (except for the SBOM report) # same as -q ; SYFT_QUIET env var quiet: false # same as --file; write output report to a file (default is to write to stdout) file: "" # enable/disable checking for application updates on startup # same as SYFT_CHECK_FOR_APP_UPDATE env var check-for-app-update: true # cataloging packages is exposed through the packages and power-user subcommands package: cataloger: # enable/disable cataloging of packages # SYFT_PACKAGE_CATALOGER_ENABLED env var enabled: true # the search space to look for packages (options: all-layers, squashed) # same as -s ; SYFT_PACKAGE_CATALOGER_SCOPE env var scope: "squashed" # cataloging file classifications is exposed through the power-user subcommand file-classification: cataloger: # enable/disable cataloging of file classifications # SYFT_FILE_CLASSIFICATION_CATALOGER_ENABLED env var enabled: true # the search space to look for file classifications (options: all-layers, squashed) # SYFT_FILE_CLASSIFICATION_CATALOGER_SCOPE env var scope: "squashed" # cataloging file contents is exposed through the power-user subcommand file-contents: cataloger: # enable/disable cataloging of secrets # SYFT_FILE_CONTENTS_CATALOGER_ENABLED env var enabled: true # the search space to look for secrets (options: all-layers, squashed) # SYFT_FILE_CONTENTS_CATALOGER_SCOPE env var scope: "squashed" # skip searching a file entirely if it is above the given size (default = 1MB; unit = bytes) # SYFT_FILE_CONTENTS_SKIP_FILES_ABOVE_SIZE env var skip-files-above-size: 1048576 # file globs for the cataloger to match on # SYFT_FILE_CONTENTS_GLOBS env var globs: [] # cataloging file metadata is exposed through the power-user subcommand file-metadata: cataloger: # enable/disable cataloging of file metadata # SYFT_FILE_METADATA_CATALOGER_ENABLED env var enabled: true # the search space to look for file metadata (options: all-layers, squashed) # SYFT_FILE_METADATA_CATALOGER_SCOPE env var scope: "squashed" # the file digest algorithms to use when cataloging files (options: "sha256", "md5", "sha1") # SYFT_FILE_METADATA_DIGESTS env var digests: ["sha256"] # cataloging secrets is exposed through the power-user subcommand secrets: cataloger: # enable/disable cataloging of secrets # SYFT_SECRETS_CATALOGER_ENABLED env var enabled: true # the search space to look for secrets (options: all-layers, squashed) # SYFT_SECRETS_CATALOGER_SCOPE env var scope: "all-layers" # show extracted secret values in the final JSON report # SYFT_SECRETS_REVEAL_VALUES env var reveal-values: false # skip searching a file entirely if it is above the given size (default = 1MB; unit = bytes) # SYFT_SECRETS_SKIP_FILES_ABOVE_SIZE env var skip-files-above-size: 1048576 # name-regex pairs to consider when searching files for secrets. Note: the regex must match single line patterns # but may also have OPTIONAL multiline capture groups. Regexes with a named capture group of "value" will # use the entire regex to match, but the secret value will be assumed to be entirely contained within the # "value" named capture group. additional-patterns: {} # names to exclude from the secrets search, valid values are: "aws-access-key", "aws-secret-key", "pem-private-key", # "docker-config-auth", and "generic-api-key". Note: this does not consider any names introduced in the # "secrets.additional-patterns" config option. # SYFT_SECRETS_EXCLUDE_PATTERN_NAMES env var exclude-pattern-names: [] # options when pulling directly from a registry via the "registry:" scheme registry: # skip TLS verification when communicating with the registry # SYFT_REGISTRY_INSECURE_SKIP_TLS_VERIFY env var insecure-skip-tls-verify: false # use http instead of https when connecting to the registry # SYFT_REGISTRY_INSECURE_USE_HTTP env var insecure-use-http: false # credentials for specific registries auth: - # the URL to the registry (e.g. "docker.io", "localhost:5000", etc.) # SYFT_REGISTRY_AUTH_AUTHORITY env var authority: "" # SYFT_REGISTRY_AUTH_USERNAME env var username: "" # SYFT_REGISTRY_AUTH_PASSWORD env var password: "" # note: token and username/password are mutually exclusive # SYFT_REGISTRY_AUTH_TOKEN env var token: "" - ... # note, more credentials can be provided via config file only log: # use structured logging # same as SYFT_LOG_STRUCTURED env var structured: false # the log level; note: detailed logging suppress the ETUI # same as SYFT_LOG_LEVEL env var level: "error" # location to write the log file (default is not to have a log file) # same as SYFT_LOG_FILE env var file: "" # uploading package SBOM is exposed through the packages subcommand anchore: # (feature-preview) the Anchore Enterprise Host or URL to upload results to (supported on Enterprise 3.0+) # same as -H ; SYFT_ANCHORE_HOST env var host: "" # (feature-preview) the path after the host to the Anchore External API (supported on Enterprise 3.0+) # same as SYFT_ANCHORE_PATH env var path: "" # (feature-preview) the username to authenticate against Anchore Enterprise (supported on Enterprise 3.0+) # same as -u ; SYFT_ANCHORE_USERNAME env var username: "" # (feature-preview) the password to authenticate against Anchore Enterprise (supported on Enterprise 3.0+) # same as -p ; SYFT_ANCHORE_PASSWORD env var password: "" # (feature-preview) path to dockerfile to be uploaded with the syft results to Anchore Enterprise (supported on Enterprise 3.0+) # same as -d ; SYFT_ANCHORE_DOCKERFILE env var dockerfile: ""
Recommend
-
104
Anchore.io provides a toolset that allows developers, operations, and security teams to maintain full visibility of the 'chain of custody' as containers move through the development lifecycle, while providing the visibility, predictability, and...
-
77
mPDF is a PHP library which generates PDF files from UTF-8 encoded HTML. It is based on FPDF and HTML2FPDF (see
-
40
When using Docker containers in production, we need to ensure that we are following best practices. In this post, we will focus on Ensure images are scanned and rebuilt to include security patches from the CI...
-
4
Travis CI Pipelines: Anchore Policy Enforcement using Travis CI Dec 14, 2020 | Montana Mendy | news
-
8
In a previous post, we talked about how we can check our Docker images for any known vulnerabilities by means of Anchore Engin...
-
6
LimeLighter A tool which creates a spoof code signing certificates and sign binaries and DLL files to help evade EDR products and avoid MSS and sock scruitney. LimeLighter can also use valid code signing certificates to sign files. L...
-
68
grype A vulnerability scanner for container images and filesystems. Easily install the binary to try it out. Features Scan the contents o...
-
8
News Anchore Enterprise software SCM platform adds SBOM capabilities The new release of Anchore's software S...
-
7
Quill Simple mac binary signing and notarization from any platform (replacing the codesign utility for simple use cases).
-
3
counterfeiter When writing unit-tests for an object, it is often useful to have fake implementations of the object's collaborators. In go, such fake implementations cannot be generated automatically at runtime, and writing...
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK