tern-tools/tern
Tern is a software composition analysis tool and Python library that generates a Software Bill of Materials for container images and Dockerfiles. The SBOM that Tern generates will give you a layer-by-layer view of what's inside your container in a variety of formats including human-readable, JSON, HTML, SPDX and more. observed · 2026-08-28
Health v2 · maintenance only
23/100
- Activity 0
- Release rhythm 8
- Longevity 100
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-03. Adoption (stars, forks) is never an input.
- gap_med: n/a
- age_days: 3201
- days_rel: n/a
- days_push: 904
- n_releases_24m: 0
Adoption not part of the score
1018 stars · 190 forks observed · 2026-08-28
What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded
Tern is a Python-based software composition analysis tool and library that generates a Software Bill of Materials (SBOM) for container images and Dockerfiles. It inspects each image layer to identify installed packages and their metadata, producing reports in human-readable, JSON, HTML, YAML, SPDX, and CycloneDX formats.
Use cases
- generate an SBOM for a docker image
- create a software bill of materials from a Dockerfile
- list packages installed in each container image layer
- export container dependencies in SPDX or CycloneDX format
- audit open source license compliance in container images
- scan container images for supply chain security
When to choose
- you need layer-by-layer package metadata for Docker images or Dockerfiles
- you need SBOM output in SPDX, CycloneDX, JSON, HTML, or YAML formats
- you want a Python library or CLI for container software composition analysis
When to avoid
- you need SBOMs for non-container artifacts like binaries or OS packages outside images
- you need active vulnerability scanning as the primary feature (extensions like cve-bin-tool are optional)
- you need a tool with frequent recent releases or broad runtime support beyond Linux/Docker
Facets
cli-tool · maturity maintenance
security developer-tools container-runtime parser security developer-tools python cli sbom spdx cyclonedx software-composition-analysis supply-chain-security dockerfile compliance oss-compliance containers devops linux docker
2 sources
- readme: https://github.com/tern-tools/tern · fetched 2026-08-28 · 616cd94a7f73
- registry_pypi: https://pypi.org/pypi/tern/json · fetched 2026-08-29 · 1e484586dba8
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| tern-tools/tern | main | 23 |
For agents
Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem