Analyzer tools
Presence and version of each external SBOM tool, probed live.
| Tool | Role | Binary | Present | Version | Notes |
|---|---|---|---|---|---|
syft |
generator | syft |
Not found | — | Normaliser, not a scanner: `syft convert` produces the `CycloneDX` 1.6 input bomber requires. |
grype |
scanner | grype |
Not found | — | Exits non-zero when it finds vulnerabilities (a successful run). Reports GHSA ids (CVE aliases elsewhere). |
trivy |
scanner | trivy |
Not found | — | Scans the SBOM against the Trivy DB; exits 0 by default even with findings. Run offline (pre-populated DB). |
osv-scanner |
scanner | osv-scanner |
Not found | — | Queries the OSV database (deps.dev, network); exits non-zero on findings. Reports GHSA ids. |
bomber |
scanner | bomber |
Not found | — | Consumes only `CycloneDX` <= 1.6 — silently reports 0 packages on 1.7, so the auditor normalises via syft convert first. |
bomdrift |
supply-chain drift | bomdrift |
Not found | — | Diff tool: run against an empty baseline so a single SBOM's components read as added + enriched. |
inspektr_cli |
scanner | inspektr_cli |
Not found | — | Scans an existing SBOM for CVEs (`vuln --sbom`); may need --db for its vulnerability database. |
shieldbom |
scanner | shieldbom |
Not found | — | Offline-first CVE + licence-conflict scan of an existing SBOM; emits SARIF 2.1.0. |
provenant |
licence/provenance | provenant |
Not found | — | Licence/copyright/provenance scan (ScanCode port); emits licence findings, not CVEs. |