https://github.com/anchore/syft https://github.com/anchore/syft is an easier to use alternative. Just point it at a container image, path or archive and it will

https://github.com/anchore/syft https://github.com/anchore/syft is an easier to use alternative. Just point it at a container image, path or archive and it will generate the SBOM for you. Salus seems to be more flexible - you can also feed the sources and the package manager files into it. I guess the results could be more accurate.