Generating SBOMs for IoT at Build Time
summary
Build-time SBOM generation for Zephyr uses the CMake file-based API plus a small west extension called west spdx to output SPDX tag-value documents that record file hashes, SPDX license identifiers, and explicit relationships linking each source file and intermediate artifact to the final statically linked binary. It runs automatically as part of west build, optionally records included headers, currently has limited capture of SDK/toolchain versions, and produces usable SBOMs while noting NTIA-field alignment and broader dependency cases as next work.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:15What is Zephyr
- 1:56Zephyr Build Process
- 4:36PostBuild Analysis
- 7:13Goals
- 10:12Version 0 approach
- 11:50Leveraging metadata
- 13:25zephyr
- 14:10spdx
- 17:10Metadata
- 17:43Areas for Improvement
- 18:30Takeaways
- 21:26QA
related talks
32mNext Steps for Software Bill of Materials (SBOM) Generation in Zephyr
42mPractical SBOM Management with Zephyr and SPDX
42mPractical SBOM Management with Zephyr and SPDX
41mThe State of SBoMs in Embedded
35mBOF: SBOMs for Embedded Systems: What's Working, What's Not?
46mAn SBOM Primer: From Licenses to Security, Know What’s in Your Code, or Someone Else’s!
38mEnhancing SBOM Generation: Filling the Gaps To Make Actionable SBO...
52mThe World on SBOMs