SupportConsoleDevelopersStart a trialContact

Chapter 4. Generate an SBOM

Generate a Software Bill of Materials (SBOM) in CycloneDX or SPDX JSON format to provide Red Hat Trusted Profile Analyzer (RHTPA) with the package data needed for vulnerability and security analysis.

Many open source tools are available for creating SBOM manifest files from container images or for your application. This procedure uses the Syft tool.

Important

Currently, Trusted Profile Analyzer only supports CycloneDX version 1.3, 1.4, 1.5, and 1.6, along with SPDX version 2.2, and 2.3.

Important

The Syft binary is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs), might not be functionally complete, and Red Hat does not recommend to use them for production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process. See the support scope for Red Hat Technology Preview features for more details.

Prerequisites

Procedure

  1. To create an SBOM by using a container image.

    CycloneDX format
    syft IMAGE_PATH -o cyclonedx-json@1.5
     
    $ syft registry:example.io/hello-world:latest -o cyclonedx-json@1.5
    SPDX format
    syft IMAGE_PATH -o spdx-json@2.3
     
    $ syft registry:example.io/hello-world:latest -o spdx-json@2.3
    Note

    Syft supports many types of container image sources. For the official supported source list, see Syft GitHub site for more details.

  2. To create an SBOM by scanning the local file system.

    CycloneDX format
    syft dir: DIRECTORY_PATH -o cyclonedx-json@1.5
syft file: FILE_PATH -o cyclonedx-json@1.5
     
    $ syft dir:. -o cyclonedx-json@1.5
$ syft file:/example-binary -o cyclonedx-json@1.5
    SPDX format
    syft dir: DIRECTORY_PATH -o spdx-json@2.3
syft file: FILE_PATH -o spdx-json@2.3
     
    $ syft dir:. -o spdx-json@2.3
$ syft file:/example-binary -o spdx-json@2.3
Red Hat logoGithubRedditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top