# Creating SBOMs from Manifests -- syft, grype

**URL:** https://discourse.julialang.org/t/creating-sboms-from-manifests-syft-grype/131078
**Category:** Package Management
**Tags:** sbom
**Created:** [July 26, 2025, 2:37pm UTC](https://discourse.julialang.org/t/creating-sboms-from-manifests-syft-grype/131078 "2025-07-26T14:37:19Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Allan\_Baker](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/allan_baker/32/42645_2.png) [@Allan\_Baker](https://discourse.julialang.org/u/Allan_Baker)
#### Post date: [July 26, 2025, 2:37pm UTC](https://discourse.julialang.org/t/creating-sboms-from-manifests-syft-grype/131078/1 "2025-07-26T14:37:19Z")

</div>

Has anyone used something like

> **[GitHub - anchore/syft: CLI tool and library for generating a Software...](https://github.com/anchore/syft)**
>
> CLI tool and library for generating a Software Bill of Materials from container images and filesystems

or [GitHub - anchore/grype: A vulnerability scanner for container images and filesystems](https://github.com/anchore/grype)

with Julia Packages?

I need to create SBOMs to get Julia and its packages approved. I think these are the tools they recommend using. I think ultimately I need a CycloneDX SBOM file.

Any work being done on this? Anyone else have this problem?

---

<div class="post-metadata">

### Author: ![avik](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/avik/32/17_2.png) [@avik](https://discourse.julialang.org/u/avik)
#### Post date: [July 26, 2025, 2:54pm UTC](https://discourse.julialang.org/t/creating-sboms-from-manifests-syft-grype/131078/2 "2025-07-26T14:54:54Z")

</div>

I believe Trivy can generate SBOMs from Pkg project and manifest files. [Julia - Trivy](https://trivy.dev/v0.64/docs/coverage/language/julia/)

---

<div class="post-metadata">

### Author: ![GunnarFarneback](https://sea2.discourse-cdn.com/julialang/user_avatar/discourse.julialang.org/gunnarfarneback/32/1827_2.png) [@GunnarFarneback](https://discourse.julialang.org/u/GunnarFarneback)
#### Post date: [July 26, 2025, 3:46pm UTC](https://discourse.julialang.org/t/creating-sboms-from-manifests-syft-grype/131078/3 "2025-07-26T15:46:22Z")

</div>

I have never needed or used it, but [[ANN] PkgToSoftwareBOM v0.1.12: Options to include the package server and artifact build scripts in the SBOM](https://discourse.julialang.org/t/ann-pkgtosoftwarebom-v0-1-12-options-to-include-the-package-server-and-artifact-build-scripts-in-the-sbom/119390) should be of some relevance.