Practical SBOM Management with Zephyr and SPDX
summary
Zephyr build can emit precise SPDX SBOMs by turning on West/CMake metadata and producing three SPDX files (sources, app, build) that include file hashes, origins and module identifiers. The demo uses sbom-to-doc, NIST checker, SBOM QS, GitHub gh sbom and a CPE-aware vulnerability scanner to cross‑reference components; building a Wi‑Fi sample for an ARM board surfaces three CVEs in mbed TLS 3.5.1. SPDX 3.0 is newly released and Zephyr tooling currently targets SPDX 2.x while work adds CPE/PEARL metadata for better matching.
AI-written summary · about
chapters (7)
- 0:00SBOM and Zephyr intro
- 7:30SBOM for embedded systems
- 13:56Generating SBOM with Zephyr
- 20:30Evaluating SBOM quality
- 26:05Tracking vulnerabilities with SBOM
- 31:03Future of SPDX 3.0
- 33:53Q&A
related talks
42mPractical SBOM Management with Zephyr and SPDX
32mNext Steps for Software Bill of Materials (SBOM) Generation in Zephyr
28mGenerating SBOMs for IoT at Build Time
41mThe State of SBoMs in Embedded
35mBOF: SBOMs for Embedded Systems: What's Working, What's Not?
53mAdvancing Transparency and Security in Software: A Deep Dive into SBOM and SPDX
38mSBOM Implementation Reality - the SPDX Lite Profile for First Step
40mSBOMs: Essential for Embedded Systems Too!