Practical SBOM Management with Zephyr and SPDX
summary
Zephyr builds can emit three SPDX manifests (source, app, build) via the West meta tool by enabling build meta capture and CMake hooks; this is opt‑in and slightly slows builds. Practical tooling shown: Nia checker and sbomqs for quality, sbom-to-doc for readable manifests, GitHub CLI for repo SBOMs, and Intel’s scanner that matches captured artifacts to CVEs when modules carry CPEs/PEARLs. Current gaps: missing supplier metadata in generated SPDX and migration from SPDX 2.3 -> 3.0 to capture richer, profile‑specific data.
AI-written summary · about
chapters (7)
- 0:00SBOM introduction
- 7:28SBOMs for embedded systems
- 13:35Generating SBOMs with Zephyr
- 22:12Analyzing SBOM quality
- 26:52Tracking vulnerabilities with SBOMs
- 30:49Future of SPDX
- 33:00Q&A
related talks
42mPractical SBOM Management with Zephyr and SPDX
32mNext Steps for Software Bill of Materials (SBOM) Generation in Zephyr
28mGenerating SBOMs for IoT at Build Time
41mThe State of SBoMs in Embedded
35mBOF: SBOMs for Embedded Systems: What's Working, What's Not?
38mSBOM Implementation Reality - the SPDX Lite Profile for First Step
27mSBOM: The Rest Of the Story
53mAdvancing Transparency and Security in Software: A Deep Dive into SBOM and SPDX