Syft
Syft is Anchore's open SBOM tool identifying packages and binaries across ecosystems and emitting SPDX or CycloneDX.
Why use it
Game servers, launchers, and build images track third-party components for compliance and vulnerability scanning.
Where it fits
Use testing, performance, accessibility, and diagnostic tools to remove problems players will notice.
What to check
Detection depends on metadata and cannot prove license conclusions; unknown or vendored code still needs review.