Create an SBOM in 10 minutes.

You don't need an expensive scanner. Free open-source tools generate a Software Bill of Materials in CycloneDX format from your repository, build or container image, exactly what the Cyber Resilience Act requires. Feel free to forward this page straight to your engineers.

Option 1: Syft, the all-rounder

Syft (by Anchore, open source) scans directories, repositories and container images.

curl -sSfL https://get.anchore.io/syft | sudo sh -s -- -b /usr/local/bin

syft dir:. -o cyclonedx-json > sbom.json

syft your-image:tag -o cyclonedx-json > sbom.json

Option 2: Trivy, if you already use it

Trivy (Aqua Security, open source) is already in place as a vulnerability scanner in many teams and generates SBOMs as well.

trivy fs --format cyclonedx --output sbom.json .

Option 3: Yocto / Buildroot, embedded Linux

If your firmware is built with Yocto, the build itself can produce the inventory, the most reliable source, because it reflects exactly what goes into the image. SPDX generation is built in from Yocto 4.x:

INHERIT += "create-spdx"

Buildroot: make legal-info produces the package list as a starting point; KONFORMA also accepts SPDX files directly.

Option 4: Automatic on every release, GitHub Action

name: SBOM
on:
  release:
    types: [published]
jobs:
  sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: anchore/sbom-action@v0
        with:
          format: cyclonedx-json
          output-file: sbom.json
      - uses: actions/upload-artifact@v4
        with:
          name: sbom
          path: sbom.json

Tip: if your code lives on GitHub it's even simpler. KONFORMA imports the inventory directly through the GitHub API, no workflow needed.

An honest note on firmware scans

For compiled embedded products no scanner is guaranteed to find everything: statically linked libraries, internally renamed or supplier-precompiled components can be missing. That's why KONFORMA shows a reliability score after upload. You see how complete your inventory is and which details to fill in, instead of trusting a seemingly complete list. Missing supplier parts can be requested directly through KONFORMA Exchange.

Syft and Trivy are open-source projects by Anchore and Aqua Security. Commands as of July 2026, for installation questions, consult the respective project documentation.