Generate an SBOM
Generate a packaged-based Software Bill Of Materials (SBOM) from container images and filesystems
zarf tools sbom scan [SOURCE] [flags]
--base-path string base directory for scanning, no links will be followed above this directory, and all paths will be reported relative to this directory --enrich stringArray enable package data enrichment from local and online sources (options: all, golang, java, javascript) --exclude stringArray exclude paths from being scanned using a glob expression --file string file to write the default report output to (default is STDOUT) (DEPRECATED: use: output) --from stringArray specify the source behavior to use (e.g. docker, registry, oci-dir, ...) -h, --help help for scan -o, --output stringArray report output format (<format>=<file> to output to a file), formats=[cyclonedx-json cyclonedx-xml github-json spdx-json spdx-tag-value syft-json syft-table syft-text template] (default [syft-table]) --override-default-catalogers stringArray set the base set of catalogers to use (defaults to 'image' or 'directory' depending on the scan source) --platform string an optional platform specifier for container image sources (e.g. 'linux/arm64', 'linux/arm64/v8', 'arm64', 'linux') -s, --scope string selection of layers to catalog, options=[squashed all-layers] --select-catalogers stringArray add, remove, and filter the catalogers to be used --source-name string set the name of the target being analyzed --source-version string set the version of the target being analyzed -t, --template string specify the path to a Go template file
-c, --config string syft configuration file --insecure-skip-tls-verify Skip checking server's certificate for validity. This flag should only be used if you have a specific reason and accept the reduced security posture. --plain-http Force the connections over HTTP instead of HTTPS. This flag should only be used if you have a specific reason and accept the reduced security posture. -q, --quiet suppress all logging output -v, --verbose count increase verbosity (-v = info, -vv = debug)