I enjoyed the #OpenSourceSecurityPodcast this week with

https://infosec.exchange/@joshbressers and
@popey
of
@anchore

I used #Syft/ #Grype on a few OCI containers recently and was horrified to discover one had some nasty issues lurking within.

Great tools which I intend to use any time I handle OCI containers. Looking forward to trying Grant soon.

Thank you

https://opensourcesecurity.io/2025/2025-04-syft-grype-grant-alan-pope/
https://anchore.com/opensource/

#OpenSourceSecurity
#CyberSecurity
#SBOM
#Vulnerabilities

Syft users! We want to hear from YOU! Take our quick 5-question survey to help shape the future of Syft. Your feedback is invaluable! https://forms.gle/VJZ7idKZgchminYD7
#Syft #SBOM #OpenSource

Do you need SBOMs for your JS projects? Learn to scan containers, source code, and build with the open-source tool Syft!
Our developer's guide provides step-by-step instructions. Get started: https://anchore.com/blog/javascript-sbom-generation/
#JavaScript #SBOM #DevTools #Security #Syft #OpenSource

Boost JS security & visibility! Our guide explains how to create SBOMs using the free tool Syft.
Identify vulnerabilities, manage licenses & understand your full dependency picture.
https://anchore.com/blog/javascript-sbom-generation/
#JavaScript #SBOM #SupplyChainSecurity #DevSecOps #OpenSource #Syft

Taming the tangled web of JS dependencies? Our guide shows developers how to easily generate SBOMs for JavaScript projects using the free, open-source tool Syft.
Read now: https://anchore.com/blog/javascript-sbom-generation/
#JavaScript #SBOM #DevSecOps #SupplyChainSecurity #OpenSource #Syft

VM scanning headaches? @popey built sbom-vm to easily generate SBOMs from VM disk images using Syft. Check it out! https://anchore.com/blog/making-virtual-machine-security-analysis-easier-with-sbom-vm/
#Syft #opensource #VM

Syft users! We want to hear from YOU! Take our quick 5-question survey to help shape the future of Syft. Your feedback is invaluable! https://forms.gle/VJZ7idKZgchminYD7
#Syft #SBOM #OpenSource

Want a deeper look into your #Python dependencies? Compare pipdeptree + cyclonedx-py with Syft and find the ideal SBOM generation method for your software stack.

Check it out: https://anchore.com/sbom/python-sbom-generation/

Looking to generate an SBOM for your #Python projects? We compare two powerful tools—pipdeptree + cyclonedx-py and Syft—to help you pick the right fit for security & compliance.

Learn more: https://anchore.com/sbom/python-sbom-generation/

Are you curious about how Syft detects binaries? Check out our guide and see how you can make a difference! https://anchore.com/blog/improve-open-source-sbom-tool-syft-with-binary-detection/ #softwaresupplychainsecurity #syft #sbom #scm

Enhance your software analysis with Syft Learn the simple steps to improve Syft's binary detection. https://anchore.com/blog/improve-open-source-sbom-tool-syft-with-binary-detection/ #softwaresupplychainsecurity #syft #sbom #scm

Als nächstes folgen ab 17 Uhr die Live-Vorträge "#Grype und #Syft im Unternehmenseinsatz" und "#ReverseEngineering für Forward Engineers".

Although it's the right thing to do, given the current state of things, this feels like putting the cart before the horse:
https://pkg.go.dev/github.com/anchore/syft

Building an #SBOM based on heuristics is prone to fail and will never give a deterministic result.

Build input and SBOM shouldn't be two distinct entities - they should be derived from the same single source.

This is were fully reproducible and deterministic systems like #NixOS / #nixpkgs or #guix can shine.

Well this happened. #JReleaser is now capable of producing #SBOMs thanks to an integration with #Syft. You don't need Syft pre-installed on your environment, JReleaser takes care of that

https://jreleaser.org/guide/early-access/reference/catalog/sbom/syft.html

SBOM support coming up next #JReleaser thanks to #Syft's Java cataloger #SneakPeek

TIL that #Syft takes advantage of #Maven metadata embedded in a JAR (/META-INF/maven/*) to generate SBOMs. These files are automatically added by Maven during a build.

Glad I built a plugin for #Gradle years ago to do the same

https://kordamp.org/kordamp-gradle-plugins/#_org_kordamp_gradle_minpom