syft can emit either SPDX or CycloneDX SBOMs, the two standards most security tools consume.
SPDX and CycloneDX are the dominant SBOM standards. Both describe the same packages; which you emit depends on what downstream tools and compliance processes expect.
What it does
syft produces SPDX (an ISO standard with strong licensing and compliance focus) and CycloneDX (an OWASP standard with strong security and dependency focus). Both are widely accepted; cosign, trivy, grype, and most registries read either. The choice is about downstream expectations, not capability.
Common usage
Terminal
syft myorg/app:ci -o spdx-json=sbom.spdx.json
syft myorg/app:ci -o cyclonedx-json=sbom.cdx.json
# scan either with grype
grype sbom:sbom.spdx.json
grype sbom:sbom.cdx.json
Options
Format
Best fit
spdx-json
License compliance, ISO/regulatory requirements
spdx-tag-value
Legacy SPDX consumers expecting tag:value
cyclonedx-json
Security tooling, VEX, dependency analysis
cyclonedx-xml
CycloneDX consumers that require XML
In CI
Pick the format your registry or attestation predicate type expects: cosign attest supports both spdxjson and cyclonedx predicate types. If you are unsure, CycloneDX JSON is the safe default for security pipelines; SPDX JSON is the safe default for compliance reporting.
Common errors in CI
A consumer rejecting an SBOM with "unsupported format" or "schema validation failed" usually got the wrong standard or an older spec version than it expects; regenerate in the format and version it wants. cosign attest failing on --type means the predicate type does not match the SBOM format (use --type cyclonedx for CycloneDX, --type spdxjson for SPDX).
Frequently asked questions
syft: SPDX vs CycloneDX SBOM Formats?
SPDX and CycloneDX are the dominant SBOM standards. Both describe the same packages; which you emit depends on what downstream tools and compliance processes expect.
What it does?
syft produces SPDX (an ISO standard with strong licensing and compliance focus) and CycloneDX (an OWASP standard with strong security and dependency focus). Both are widely accepted; cosign, trivy, grype, and most registries read either. The choice is about downstream expectations, not capability.
In CI?
Pick the format your registry or attestation predicate type expects: cosign attest supports both spdxjson and cyclonedx predicate types. If you are unsure, CycloneDX JSON is the safe default for security pipelines; SPDX JSON is the safe default for compliance reporting.
Common errors in CI?
A consumer rejecting an SBOM with "unsupported format" or "schema validation failed" usually got the wrong standard or an older spec version than it expects; regenerate in the format and version it wants.
