Syft fallback

Bomly bundles Syft as the fallback detector. Syft lists packages by recognizing files on disk. It runs when no native detector applies, which is how Bomly covers operating-system package databases and ecosystems without a native graph resolver.

Package managers covered

These have no native Bomly detector, so Syft is the only chain entry.

Container operating systems

Syft also identifies the base operating system of a container image. That choice decides which package database Syft reads. The reader column is Syft's own name for the module that reads that database.

What Syft gives you

Syft lists packages by recognizing files: operating-system package databases, installed-package manifests, and the lockfiles it knows. It reports what is present, not how those packages relate to each other.

That difference matters for the rest of the pipeline:

• bomly explain needs edges to walk a path from your project to a package. Syft packages have no edges, so there is no path to show.
• Scope filters such as --direct-only rely on the direct-versus-transitive distinction, which comes from the graph. Syft results carry no such distinction.
• Vulnerability and license enrichment work as usual. Matchers key on package coordinates, which Syft does provide.

When Syft runs

Syft is the last entry in almost every detector chain. It runs when the native detector ahead of it cannot produce graph data. That happens when no lockfile is present, the build tool is missing from PATH, or the ecosystem has no native detector at all.

For container images it does most of the work. Bomly scans the layers, and native detectors only apply where a recognizable lockfile made it into the image.

Turning it off

Syft is a normal detector, so the standard selector grammar applies:

# Drop the Syft fallback: native detectors only
bomly scan --detectors -syft-detector

# Use only Syft
bomly scan --detectors syft-detector

Without Syft, a project it was covering resolves nothing, and the scan exits 3 with "no detector chain produced a graph". That is usually what you want in CI, where a flat package list could pass a gate that a real graph would fail.

See also

• Support matrix: every ecosystem and package manager, native and Syft-backed
• Scan targets: container images and the other input shapes Syft handles
• Detectors: chains, selection, and the native-versus-Syft comparison