Welcome to Anchore Open Source

Anchore Open Source Software (OSS) is a suite of tools for Software Bill of Materials (SBOM) Generation, Vulnerability Scanning, License Scanning, and Vulnerability Database management.

Start by going to the project overview of Anchore OSS to learn more about the basic concepts and functions.

For information about generating SBOMs:

• Generating an SBOM
• SBOM File Formats
• Conversion of SBOM Formats

Get started with vulnerability scanning

• Scanning for Vulnerabilities
• Vulnerability Data Sources

Scan SBOMs or containers for licenses used:

• Scanning for Licenses Used

Reference information

• Syft command-line options
• Grype command-line options
• Organizations/Projects using Anchore OSS

OSS release notes:

• Syft Releases
• Grype Releases
• Grype Releases

Note: Many topics have nested sub-topics in the navigation pane to the left that become visible when you click a topic.

Installing the Tools

The tools are available in many common distribution channels. The full list of official and community maintained packages can be found on the installation page.

Using the Tools

We have “Getting Started” user guides for SBOM Generation with Syft, Vulnerability Scanning with Grype, and License Scanning.

Developing

Developers also have Contribution Guides for all of our open source tools and libraries.