SBOM with Syft: inventory what you ship (CycloneDX and SPDX)

Objective

Produce and use a software bill of materials (SBOM): the precise list of all the components of a piece of software, with their versions and licenses. You will be able to generate it with Syft (or npm sbom) from a folder or an image, choose between CycloneDX and SPDX, attach it to what you publish, and use it to answer the question "are we affected?" in a few minutes.