Generating SBOMs

Anchore Enterprise generates SBOMs in two ways:

• During asset attachment — the SBOM is generated as part of attaching an asset to an app version, and is stored against the version immediately.
• Standalone, into an analysis bundle — the SBOM is written to a local archive with no connection to Anchore Enterprise, ready to be attached later.

This page covers producing the SBOM, whilst the asset pages cover attaching the resultant SBOM to a version.

Generate an SBOM When Attaching an Asset

When an asset is attached directly, where generation happens depends on the asset. AnchoreCTL generates the SBOM locally when it can read the source itself, such as a filesystem directory or a container image analyzed on your host, while centralized image analysis generates it server-side. For anything else, generate the SBOM with your own tooling and upload it as an SBOM asset. Either way, the SBOM is stored against the version where it becomes available for vulnerability analysis, policy evaluation, search, and export.

Generate an Analysis Bundle

anchorectl generate analysis-bundle runs the same local analysis as the corresponding app version asset add command, but writes the result set to an uncompressed tar archive instead of uploading it. Generating a bundle requires no connection to Anchore Enterprise; only the later attachment step does. Use bundles when analysis has to happen where the artifact lives (a build stage without Anchore Enterprise credentials, or an isolated or air-gapped network) and the attachment happens somewhere else.

--output-file is required for both bundle types; add --overwrite to replace an existing file.

Generate a Container Image Bundle

An image bundle carries the full analysis document set: the SBOM plus the image manifest, image config, and any secret search, content search, and retrieved-file results. Attaching one is equivalent to running distributed image analysis with the analysis and upload split into two steps, so no analysis fidelity is lost by going through a bundle.

The image reference is the positional argument:

anchorectl generate analysis-bundle image docker.io/my-org/api:1.4.0 \
  --output-file api-image-1.4.0.tar

The image source options match distributed image analysis: --from accepts registry (the default), docker, podman, or docker-archive:/path/to.tar, and --platform pins the architecture for multi-platform images. With the docker and podman sources, an image not present in the daemon is pulled from the registry.

The command prints the gathered file metadata and a success or failure line; the analysis documents themselves are written only to the archive. Add -o json for machine-readable output. The SBOM inside an image bundle is always Syft-native JSON, which is the format the upload API requires.

Generate a Filesystem Bundle

A filesystem bundle carries the SBOM generated from a local directory tree. The directory to analyze is the positional argument:

anchorectl generate analysis-bundle filesystem ./dist --output-file cli-binary-1.4.0.tar

The SBOM inside a filesystem bundle defaults to Syft-native JSON. Choose a different document format with -o: cyclonedx-json, cyclonedx-xml, spdx-json, spdx-tag-value, or syft-json.

Attach the Bundle

A generated bundle is attached to an app version with anchorectl app version asset add analysis-bundle, from any host that can reach Anchore Enterprise. The upload behavior for each bundle type and the underlying API endpoints are covered in Attaching Analysis Bundle Assets.