https://github.com/anchore/syft is an easier to use alternative. Just point it at a container image, path or archive and it will generate the SBOM for you.

Salus seems to be more flexible - you can also feed the sources and the package manager files into it. I guess the results could be more accurate.