The State of SBoMs in Embedded
summary
Embedded builds already contain most SBOM inputs and practical options exist today: Yakto spits out per-step SPDX and merges them into a final SBOM, Buildroot can emit CycloneDX via an intermediate converter, Zephyr uses "west spdx" to produce SPDX 2.3, and reproducible-builds.org tools (diffoscope) help verify bites‑for‑byte reproduction. SPDX 2.3 can bloat outputs (100 MB rootfs → ~500 MB SPDX), while SPDX 3 single JSON reduces tooling friction; include CPEs, build‑time dependencies and license data to make SBOMs actionable.
AI-written summary · about
chapters (16)
- 0:00SBoMs in embedded systems
- 1:28What is a software bill of materials
- 6:01Software supply chain in embedded
- 9:55Supply chain visibility with host infrastructure
- 13:09Strengths of embedded supply chains
- 16:37Host isolation and SBoMs
- 18:01Key elements in embedded SBoMs
- 19:26Reproducible builds in embedded
- 21:13Embedded build systems and SBoM support
- 25:28Q&A: SPDX files
- 28:03Q&A: CVE databases
- 31:14Q&A: SBoM urgency for mid-market
- 34:49Q&A: Derivatives and SBoMs
- 36:58Q&A: Hardware and FPGA integration
- 37:43Q&A: SBoM relationship objects
- 40:15Closing remarks
related talks
35mBOF: SBOMs for Embedded Systems: What's Working, What's Not?
40mSBOMs: Essential for Embedded Systems Too!
42mPractical SBOM Management with Zephyr and SPDX
42mPractical SBOM Management with Zephyr and SPDX
27mSBOM: The Rest Of the Story
32mNext Steps for Software Bill of Materials (SBOM) Generation in Zephyr
29mThe Current State of SBOMs for End Users
38mThe State of SBOMs