Syft helps inventory software components. For mobile delivery, check native libraries and components introduced by protection as well as source dependencies.
Evaluation approach
An SBOM supplies input for security and license analysis. Unrecognized components or code embedded in binaries may require additional methods.
Application example
Inventory the RASP build environment and supporting tools, then compare dependency changes across releases.
Limits and considerations
Creating an SBOM does not fix vulnerabilities. Missing components can create a false impression of completeness.
Connect the inventory to the final artifact
A component list is limited by the analyzed target and supported methods. Different approaches may identify mobile dependencies at different levels of detail. Retain the artifact hash and tool version with the result.
If protection adds native libraries, a pre-protection inventory may no longer represent the shipped product. Use supplier information and further inspection to fill gaps. An SBOM is a starting point for risk analysis, not a security or compliance certificate.
Checks and decisions
- State coverage
- Compare with a manual inventory
- Associate the SBOM with its release
Add Syft to the evidence trail without assuming it verifies every mobile package component.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.