Supply Chain
SBOM tools that name what you installed (2026)
A 2026 shortlist of inventories for the artifact. Public docs, not a lab bake-off.
Expertise: Supply Chain · Level: Intermediate · 12 min read
A lockfile you never opened is still in the image.
The CVE was in a transitive you did not list. SBOM is the inventory. SCA is the match. SAST is the sink in your code. This page is the file you can attach to a release.
Six inventories. Three open generators. One matcher. One spec toolkit. One commercial shelf. Public docs. Not a bake-off.
Technical check: we cross-check first-party product pages, public licenses, and live documentation. Rank is a technical recommendation, not a recap of other lists, and not a lab bake-off.
| Tool | Best for | License |
|---|---|---|
| Syft | Generate SBOM from an image or dir | Apache-2.0 |
| Trivy | Scan and SBOM in one CLI | Apache-2.0 |
| cdxgen | CycloneDX from many ecosystems | Apache-2.0 |
| Grype | Match an SBOM to vulns | Apache-2.0 |
| SPDX tools | Validate and convert SPDX | Apache-2.0 |
| FOSSA | Commercial license and SBOM shelf | Commercial |
Syft
Best for generate SBOM from an image or dir
Syft reads an image or directory and writes CycloneDX or SPDX. Anchore publishes it as Apache-2.0.
Key features
- Image and filesystem
- CycloneDX and SPDX
- CLI
- Apache-2.0
Why we like it
This is the hidden gem. A file you can attach is the job.
Limits
A generator is not a ticket. Grype matches. You still own the pipeline.
Trivy
Best for scan and SBOM in one CLI
Trivy scans images, filesystems, and IaC. It can emit SBOM. Aqua maintains it.
Key features
- Vuln scan
- SBOM output
- IaC misconfig
- Apache-2.0
Why we like it
If CI can only hold one binary, Trivy is the honest Swiss army. Link Platform for the K8s operator.
Limits
A scan is a point in time. IaC is a different cluster on the platform pillar.
cdxgen
Best for cycloneDX from many ecosystems
cdxgen is the CycloneDX project’s generator. Many languages. The spec people write the tool.
Key features
- Many ecosystems
- CycloneDX out
- CI friendly
- Apache-2.0
Why we like it
When Syft misses an ecosystem you ship, cdxgen is the next generator.
Limits
You still pick a matcher. Output quality follows the ecosystem plugin.
Grype
Best for match an SBOM to vulns
Grype consumes Syft output or an image and prints vulns. Same house as Syft.
Key features
- SBOM in, findings out
- CLI
- Apache-2.0
- Works with Syft
Why we like it
Inventory then match. Two commands. That is the prove-it.
Limits
A CVE match is not reachability. The SCA reachability row is a later list.
SPDX tools
Best for validate and convert SPDX
SPDX tools validate and convert the other format. If the customer asked for SPDX, this is the checker.
Key features
- Validate
- Convert
- Python tools
- Apache-2.0
Why we like it
A generator that cannot validate is a hope. Spec tools close that loop.
Limits
Not a scanner. Not a license legal opinion.
FOSSA
Best for commercial license and SBOM shelf
FOSSA sells license compliance and SBOM workflows. Known commercial shelf.
Key features
- License policy
- SBOM export they document
- PR comments
- Commercial
Why we like it
When legal owns the RFP, this is the name they already wrote.
Limits
Commercial. We did not run a tenant. Syft still generates the file you can grep.
What the internet thinks about SBOM tools
SBOM threads treat the file as a partial inventory. Say when it is partial. A dashboard that cannot export is the wrong door.
jruohonen on Hacker News, Jan 2024: “Trivy, Syft, Snyk, even GitHub can list dependencies installed by various package managers, none currently report the runtime/s when directed towards a code repository or container.”
Prove Syft still has a tree
On a host you own, generate an SBOM of an empty dir or a local image you built. Do not scan a stranger’s registry.
curl -fsSIL https://github.com/anchore/syft | head -n 5FAQs
Is SBOM SCA?
No. SBOM is the inventory. SCA matches CVEs. Grype sits on the line. SAST is your code.
Does Trivy replace Syft?
You can emit SBOM from Trivy. Syft is still the specialist generator.
Should I invent CPE strings?
No. Use the tool output and say when it is partial.
Is this a scored bake-off?
No. Order is editorial.
