# syft: SPDX vs CycloneDX SBOM Formats

> syft emits both SPDX and CycloneDX SBOMs. Reference for when each format fits, how to produce them, and the consumer compatibility errors in CI.

Source: https://latchkey.dev/learn/command-reference/syft-spdx-cyclonedx  
Updated: 2026-06-30

syft can emit either SPDX or CycloneDX SBOMs, the two standards most security tools consume.

SPDX and CycloneDX are the dominant SBOM standards. Both describe the same packages; which you emit depends on what downstream tools and compliance processes expect.

## What it does

syft produces SPDX (an ISO standard with strong licensing and compliance focus) and CycloneDX (an OWASP standard with strong security and dependency focus). Both are widely accepted; cosign, trivy, grype, and most registries read either. The choice is about downstream expectations, not capability.

## Common usage

```Terminal
syft myorg/app:ci -o spdx-json=sbom.spdx.json
syft myorg/app:ci -o cyclonedx-json=sbom.cdx.json
# scan either with grype
grype sbom:sbom.spdx.json
grype sbom:sbom.cdx.json
```

## Options

| Format | Best fit |
| --- | --- |
| spdx-json | License compliance, ISO/regulatory requirements |
| spdx-tag-value | Legacy SPDX consumers expecting tag:value |
| cyclonedx-json | Security tooling, VEX, dependency analysis |
| cyclonedx-xml | CycloneDX consumers that require XML |

## In CI

Pick the format your registry or attestation predicate type expects: cosign attest supports both spdxjson and cyclonedx predicate types. If you are unsure, CycloneDX JSON is the safe default for security pipelines; SPDX JSON is the safe default for compliance reporting.

## Common errors in CI

A consumer rejecting an SBOM with "unsupported format" or "schema validation failed" usually got the wrong standard or an older spec version than it expects; regenerate in the format and version it wants. cosign attest failing on --type means the predicate type does not match the SBOM format (use --type cyclonedx for CycloneDX, --type spdxjson for SPDX).

## FAQ

### syft: SPDX vs CycloneDX SBOM Formats?

SPDX and CycloneDX are the dominant SBOM standards. Both describe the same packages; which you emit depends on what downstream tools and compliance processes expect.

### What it does?

syft produces SPDX (an ISO standard with strong licensing and compliance focus) and CycloneDX (an OWASP standard with strong security and dependency focus). Both are widely accepted; cosign, trivy, grype, and most registries read either. The choice is about downstream expectations, not capability.

### In CI?

Pick the format your registry or attestation predicate type expects: cosign attest supports both spdxjson and cyclonedx predicate types. If you are unsure, CycloneDX JSON is the safe default for security pipelines; SPDX JSON is the safe default for compliance reporting.

### Common errors in CI?

A consumer rejecting an SBOM with "unsupported format" or "schema validation failed" usually got the wrong standard or an older spec version than it expects; regenerate in the format and version it wants.

---

Latchkey runs CI/CD that repairs its own failures. Agent entry points: https://latchkey.dev/agent.txt, https://latchkey.dev/openapi.json, https://latchkey.dev/llms.txt