SBOMs: Essential for Embedded Systems Too!
summary
Claim: SBOMs are essential for embedded systems and often more critical than for other stacks because small firmware differences determine vulnerability. Projects show it works: Zephyr’s west command emits three SBOMs from a one-line change (sources, app, build), Yocto/OpenEmbedded exports SPDX from recipe metadata, and a Zephyr dashboard already shows images and SBOMs for 350+ boards. Standards and policy back it—SPDX/CycloneDX accepted, SPDX is ISO, and US procurement requires SBOMs for government buys.
AI-written summary · about
chapters (11)
- 0:00Start
- 8:16What does the SBOM represent?
- 10:13Challenge: Scaling up to the Open Source Ecosystem
- 11:21Motivation
- 15:25Embedded Projects Generating SBOMs
- 17:14One Line Config Change to Create SBOMs!
- 19:00Case Study: Yocto & OpenEmbedded
- 19:51Simplified Build Flow
- 20:27Recipe Metadata
- 25:07Yocto SPDX Features
- 30:17SPDX Relationships Connect Dependencies Between Components and Between SBOMs
related talks
35mBOF: SBOMs for Embedded Systems: What's Working, What's Not?
27mSBOM: The Rest Of the Story
41mThe State of SBoMs in Embedded
35mSBOMs: Navigating the Evolving Landscape of Software Bill of Materials
52mThe World on SBOMs
46mSBOMs Are Not Enough
16mKeynote: SBOM is Coming: Why You Should Care and How You Can Help
20mSBOMs in the Real World: Practical Guidance for Managing Three Common SBOM Sce...