Tamp.Syft 0.1.2

Tamp.Syft

Wrapper for anchore/syft — the leading OSS SBOM generator. Auto-detects 20+ package ecosystems (Rust, npm, .NET, Go, Java, Python, PHP, …) and emits CycloneDX (JSON/XML) or SPDX (JSON/tag-value) for directories, files, and container images.

Why this exists

Microsoft Store cert pressure, federal supply-chain hygiene requirements (SLSA, CycloneDX), and increasingly common "ship me an SBOM with your release" asks from enterprise buyers all converge on the same need: every release artifact should ship with a Software Bill of Materials.

The OSS ecosystem has converged on syft as the canonical generator — Apache 2.0, single Go binary, no online dependencies, handles polyglot repos (Rust + Node + .NET + container images all in one scan). It's the recommended tool from Anchore, Microsoft's Secure Supply Chain Consumption Framework (S2C2F) reference, and is what GitHub's own anchore/sbom-action uses under the hood.

Tamp.Syft makes SBOM generation a typed step in the Tamp build graph:

• Syft.Scan(...) for directories, files, or container images — multi-output supported (CycloneDX + SPDX from one invocation)
• Syft.Convert(...) for format conversion (Syft↔SPDX↔CycloneDX)
• Syft.Attest(...) for in-toto SBOM attestations uploaded to container registries (pairs with cosign for signing)
• Syft.CatalogerList(...) for inspecting which package ecosystems syft will detect

Install

dotnet add package Tamp.Syft

Multi-targets net8 / net9 / net10. Requires Tamp.Core ≥ 1.6.0.

Tool installation

syft is a single Go binary:

• macOS / Linux: brew install syft (or anchore's install script)
• Windows: download release .zip from github.com/anchore/syft/releases, put on PATH
• GitHub Actions: anchore/sbom-action installs + invokes syft in one step (this wrapper covers the same flag surface for cases where you want the SBOM step to live in your Tamp Build.cs rather than YAML)

Pin a specific version in CI — syft's verb shape has been stable, but pinning is the canonical move.

Quick start — scan a polyglot repo for CycloneDX + SPDX SBOMs

using Tamp;
using Tamp.Syft;

class Build : TampBuild
{
    public static int Main(string[] args) => Execute<Build>(args);

    [Parameter] readonly string Version = "1.0.6";

    [FromPath("syft")] readonly Tool SyftTool = null!;

    AbsolutePath Artifacts => RootDirectory / "artifacts";

    Target Sbom => _ => _
        .Description("[Compliance] Generate CycloneDX + SPDX SBOM for the repo")
        .Executes(() =>
        {
            Artifacts.CreateDirectory();
            return Syft.Scan(SyftTool, s => s
                .SetDirectorySource(RootDirectory)
                .SetSourceName("DasBook")
                .SetSourceVersion(Version)
                .SetSourceSupplier("Brewing Coder Software LLC")
                .AddOutputCycloneDxJson(Artifacts / $"DasBook-{Version}.cdx.json")
                .AddOutputSpdxJson(Artifacts / $"DasBook-{Version}.spdx.json")
                .AddExcludes("**/node_modules/**", "**/target/**", "**/bin/**", "**/obj/**", "**/.git/**")
                .SetQuiet());
        });
}

Run dotnet tamp Sbom --version 1.0.6 and you get DasBook-1.0.6.cdx.json + DasBook-1.0.6.spdx.json in artifacts/. Attach to the GitHub release, ship to Partner Center compliance, or upload alongside the MSIX.

What syft finds

Tested on the tamp-build/tamp repo (this project's own dogfood scan):

BOM format: CycloneDX v1.6 | components: 108 | tools: syft
ecosystems detected: 18 nuget, 8 github, 8 maven (+ test-tooling)

For a Tauri-based desktop project like DasBook, expect a similar mix — Rust crates (Cargo.lock), npm packages (package-lock.json), .NET dependencies (packages.lock.json), and embedded transitive build tooling.

Verb surface

syft scan

syft convert

syft attest

Other

• Syft.Version(tool) — diagnostic
• Syft.CatalogerList(tool) — print available catalogers + config
• Syft.Raw(tool, ...) — escape hatch

Secrets handling

SyftAttestSettings.SetKeyPassword(Secret) accepts a Tamp.Core.Secret and routes it via the COSIGN_PASSWORD environment variable — cosign's canonical password channel — not via command-line flag. Even with the env-var route the Secret is registered in CommandPlan.Secrets so Tamp's process trace masks it in printed output.

Built against Tamp.Core 1.6.0 — TAMP004 analyzer recognizes SyftAttestSettings as an approved Reveal context via the standard *Settings heuristic. No per-satellite InternalsVisibleTo entry required.

Pairs with

• Tamp.Cargo + Tamp.Tauri.V2 — Rust + Tauri toolchain whose dependency tree gets cataloged
• Tamp.Msix — point syft scan file:DasBook.msix at a built MSIX to enumerate what's inside the package
• Tamp.MicrosoftStoreCli — generate the SBOM at pack time, attach to the Partner Center submission
• Tamp.GitHubAttest (forthcoming, TAM-195) — the SLSA build-provenance side; SBOM (this package) is "what's inside", provenance is "how/where it was built"

Releasing

Releases follow the Tamp dogfood pattern.

Settings authoring style

Examples above use the fluent Set*-chain shape. Every wrapper verb also accepts a new XxxSettings { ... } object-init form — both produce identical CommandPlans. The fluent shape stays canonical in docs and the tamp init template; opt into object-init scaffolding via tamp init --settings-style=init.

See Build Script Authoring → Two authoring styles on the wiki for the side-by-side comparison.

License

MIT. See LICENSE.