Analyzer tools
Presence and version of each external SBOM tool, probed live.
| Tool | Role | Binary | Present | Version | Notes |
|---|---|---|---|---|---|
syft |
generator | /usr/local/bin/syft |
Yes | 1.54.1 |
Normaliser, not a scanner: `syft convert` produces the `CycloneDX` 1.6 input bomber requires. |
grype |
scanner | /usr/local/bin/grype |
Yes | 0.120.1 |
Exits non-zero when it finds vulnerabilities (a successful run). Reports GHSA ids (CVE aliases elsewhere). |
trivy |
scanner | /usr/local/bin/trivy |
Yes | 0.75.0 |
Scans the SBOM against the Trivy DB; exits 0 by default even with findings. Run offline (pre-populated DB). |
osv-scanner |
scanner | /usr/local/bin/osv-scanner |
Yes | 2.7.0 |
Queries the OSV database (deps.dev, network); exits non-zero on findings. Reports GHSA ids. |
bomber |
scanner | /usr/local/bin/bomber |
Yes | 0.5.1 |
Consumes only `CycloneDX` <= 1.6 — silently reports 0 packages on 1.7, so the auditor normalises via syft convert first. |
bomdrift |
supply-chain drift | bomdrift |
Yes | bomdrift 0.9.9 |
Diff tool: run against an empty baseline so a single SBOM's components read as added + enriched. |
inspektr_cli |
scanner | inspektr_cli |
Yes | inspektr 0.1.9 |
Scans an existing SBOM for CVEs (`vuln --sbom`); may need --db for its vulnerability database. |
shieldbom |
scanner | shieldbom |
Yes | shieldbom 0.3.0 |
Offline-first CVE + licence-conflict scan of an existing SBOM; emits SARIF 2.1.0. |
provenant |
licence/provenance | provenant |
Yes | provenant-cli 1.0.11 |
Licence/copyright/provenance scan (ScanCode port); emits licence findings, not CVEs. |
Language and package-manager support
Loading the support matrix…