Next Steps for Software Bill of Materials (SBOM) Generation in Zephyr
summary
Zephyr can emit SPDX SBOMs at build time by parsing CMake’s file based API JSON, running a west spdx step that calls compilers to list included headers, hashing source and artifacts, and exporting linked relationships and SPDX license IDs as spdx documents. The current merge produces useful per-source traceability and build-time evidence but assumes specific CMake/module layouts, misses some generated or external-module files, and needs community work to tighten scope, add NTIA minimum fields, and offer package-level vs source-level options.
AI-written summary · about
chapters (7)
- 0:00Start
- 0:46Software Bill of Materials
- 1:35Spdx
- 5:21Spdx License Identifier Tags
- 7:56Benefits
- 9:18License Information Management
- 12:35Can Spdx Include Git Hashes
related talks
28mGenerating SBOMs for IoT at Build Time
42mPractical SBOM Management with Zephyr and SPDX
42mPractical SBOM Management with Zephyr and SPDX
41mThe State of SBoMs in Embedded
01h 26mPractical Software Bill of Materials: From Generation to Distribution Workshop
35mBOF: SBOMs for Embedded Systems: What's Working, What's Not?
31mSoftware Bill of Materials (SBoM) for dummies
46mAn SBOM Primer: From Licenses to Security, Know What’s in Your Code, or Someone Else’s!