Syft Configuration#

CLI Arguments#

Argument

Description

--syft-source

Syft report source. Accepts a local path, s3://bucket/prefix, gs://bucket/prefix, or azblob://account/container/prefix.

Deprecated local and S3 report-source flags remain accepted until Cartography v1.0.0 and emit warnings when used. New configurations should use --syft-source.

Examples#

Local Files#

cartography --neo4j-uri bolt://localhost:7687 \
            --syft-source /path/to/syft/results

S3 Storage#

cartography --neo4j-uri bolt://localhost:7687 \
            --syft-source s3://my-security-bucket/scans/syft/

File Format#

Syft JSON files should be in Syft’s native JSON format (not CycloneDX):

syft <image> -o syft-json=output.json

Required fields in the JSON:

  • artifacts: List of package objects with id, name, version

  • artifactRelationships: List of dependency relationships (optional but recommended)