syft.md

Syft fallback

Bomly bundles Syft as the catch-all detector. It runs when no native detector applies, which is how Bomly covers OS package databases and ecosystems without a native graph resolver.

Property	Value
Detector	syft-detector
Graph shape	Flat package list — no dependency edges
Package managers covered	23 (below)
Install-first support	No
Remediation hints	None

Package managers covered

These have no native Bomly detector — Syft is the only chain entry.

Ecosystem	Package manager	Evidence patterns
alpm	alpm	var/lib/pacman/local/*/desc
apk	apk	lib/apk/db/installed
conda	conda	conda-meta/*.json
dpkg	dpkg	lib/dpkg/status, lib/dpkg/status.d/*, lib/opkg/info/*.control, lib/opkg/status
erlang	otp	*.app
erlang	rebar	rebar.lock
haskell	cabal	cabal.project.freeze
haskell	stack	stack.yaml, stack.yaml.lock
homebrew	homebrew	Cellar/*/*/.brew/*.rb, Library/Taps/*/*/Formula/*.rb
lua	luarocks	*.rockspec
nix	nix	nix/var/nix/db/db.sqlite, nix/store/*.drv
ocaml	opam	*opam
php	pear	php/.registry/**/*.reg
portage	portage	var/db/pkg/*/*/CONTENTS
prolog	swipl-pack	pack.pl
python	pdm	pdm.lock, pyproject.toml
python	setuppy	setup.py
r	r-package	DESCRIPTION
rpm	rpm	var/lib/rpmmanifest/container-manifest-2, var/lib/rpm/Packages, var/lib/rpm/Packages.db, var/lib/rpm/rpmdb.sqlite, usr/share/rpm/Packages, usr/share/rpm/Packages.db, usr/share/rpm/rpmdb.sqlite, usr/lib/sysimage/rpm/Packages, usr/lib/sysimage/rpm/Packages.db, usr/lib/sysimage/rpm/rpmdb.sqlite
ruby	gemspec	*.gemspec
snap	snap	snap/snapcraft.yaml, snap/manifest.yaml, doc/linux-modules-*/changelog.Debian.gz, usr/share/snappy/dpkg.yaml
terraform	terraform	.terraform.lock.hcl
wordpress	wordpress	wp-content/plugins/*/*.php

Container operating systems

Syft also identifies the base OS of a container image, which is where its package database catalogers come from.

OS family	Cataloger	Version source
alpine	apk-db-cataloger	/etc/os-release
amazon linux (amzn)	rpm-db-cataloger	/etc/os-release
busybox	busybox-cataloger	busybox binary metadata
centos	rpm-db-cataloger	/etc/os-release
debian	dpkg-db-cataloger	/etc/os-release
distroless	os-release-cataloger	/etc/os-release
photon	rpm-db-cataloger	/etc/os-release
red hat (rhel, ubi)	rpm-db-cataloger	/etc/os-release
rocky linux (rocky)	rpm-db-cataloger	/etc/os-release
sles (suse, opensuse, opensuse leap)	rpm-db-cataloger	/etc/os-release
ubuntu	dpkg-db-cataloger	/etc/os-release
wolfi	apk-db-cataloger	/etc/os-release

What Syft gives you

Syft catalogs packages by pattern-matching files: OS package databases, installed-package manifests, and lockfiles it recognizes. It reports what is present, not how those packages relate to each other.

That difference matters for the rest of the pipeline:

• bomly explain needs edges to walk a path from your project to a package. Syft-catalogued packages have no edges, so there is no path to show.
• Scope filters like --direct-only rely on the direct/transitive distinction, which comes from the graph. Syft results carry no such distinction.
• Vulnerability and license enrichment work normally — matchers key off the package coordinates, which Syft does provide.

When Syft runs

Syft is the last entry in almost every detector chain. It runs when the native detector ahead of it cannot produce graph data — no lockfile present, the build tool is missing from PATH, or the ecosystem has no native detector at all.

For container images it does most of the work: Bomly scans the layers, and native detectors only apply where a recognizable lockfile made it into the image.

Turning it off

Syft is a normal detector, so the standard selector grammar applies:

# Drop the Syft fallback — native detectors only
bomly scan --detectors -syft-detector

# Use only Syft
bomly scan --detectors syft-detector

Dropping Syft means a project it was covering resolves nothing, and the scan exits 3 with "no detector chain produced a graph". That is usually what you want in CI when a flat package list would pass a gate that a real graph would fail.

See also

• Support matrix — every ecosystem and package manager, native and Syft-backed
• Scan targets — container images and the other input shapes Syft handles
• Detectors — chains, selection, and the native-vs-Syft comparison