Syft

Supports dozens of packaging ecosystems including Alpine, Debian, Go, Python, and Java, as listed in the README, ensuring comprehensive dependency detection for most modern software.

Generates SBOMs in multiple standards like CycloneDX, SPDX, and Syft JSON, with conversion capabilities between them, enhancing interoperability for compliance and tooling.

Pairs directly with Grype for vulnerability detection, as highlighted in the description, making it easy to extend SBOMs into security workflows without custom integration.

Creates signed attestations using the in-toto specification, adding provenance and security for supply chain audits, a feature emphasized in the key features.