KernelSBOM: Reconstructing Linux Kernel Builds into Trusted SPDX Bills of Materi...
summary
KernelSBOM reconstructs the Linux kernel build graph by parsing .cmd files to recover exact commands, inputs and outputs, augments that with .S include parsing and a small set of hardcoded dependencies, and produces three interlinked SPDX 3.0 documents (source, build, output) serialized as JSON‑LD. Validation shows a 99.49% overlap with strace and a build-from-referenced-sources success. Limitations include out‑of‑tree source/build distinction, x86/ARM focus, and missing toolchain versioning; plan is to add a kernel make target and capture file hashes and config metadata. reconstructs .cmd files
AI-written summary · about
chapters (6)
- 0:00Introduction and project overview
- 1:49Analyzing kernel build artifacts
- 10:33Validating build completeness
- 15:26Generating SPDX SBOMs
- 24:29Reproducibility and next steps
- 27:44Q&A session
related talks
41mThe State of SBoMs in Embedded
28mLeverage Kubernetes SPDX Tools to Create Your SBOM
33mWe Built the Kubernetes SBOM and Now You Can Write Your Own!
38mSafe Systems with Linux
43mUsing SBOMs for Linux Foundation Projects
35mTransforming SBOMs from Compliance Burden to Security Asset
38mThe State of SBOMs
42mPractical SBOM Management with Zephyr and SPDX