This repository is a fork of the upstream syft project (https://github.com/anchore/syft). For full documentation and advanced options, see the upstream project.

• Go 1.20+ installed and on your PATH

From the repository root:

make build

Replace location-to-your-binary with the directory where make build produced the syft binary, then run:

location-to-your-binary/syft -v scan dir:{projectdir} \
  --output {output-format} \
  --attestation {attestation-file} \
  --attestation-type "command-run"