Anchore

An SBOM-first software composition platform that catalogs container and filesystem contents, matches them against vulnerability feeds, and enforces policy in the pipeline.

An open source scanner that matches the contents of container images, filesystems and SBOMs against operating system and language ecosystem vulnerability feeds.

Command line SBOM generator that catalogs packages in container images, filesystems and archives, emitting SPDX, CycloneDX or its own JSON format.