SBOM generate with nRF SDK v17.1.0

[Tai]

Hi everyone,

I'm trying to generate SBOM from the code based on nRF SDK v17.1.0. I noticed that SBOM feature was only supported with NRF Connect SDK. I did search for tools to generate SBOM. The following are popular ones:

• Syft — a CLI tool that allows you to efficiently create accurate SBOMs from container images and filesystems.
• FOSSA — an automated tool focused on open-source compliance and security, capable of generating SBOMs while ensuring adherence to licensing requirements.
• Tern — an open-source tool that inspects container images, providing insights into software components and their licenses and helping developers ensure compliance and security throughout the container lifecycle.
• CycloneDX — a widely recognized SBOM standard used across various tools and platforms to enhance software supply chain security. It is supported by numerous SBOM generation tools including Syft, OWASP Dependency-Track for Java and other languages, and GitLab for CI/CD pipelines. CycloneDX is versatile and applicable across different programming languages and environments.
• Microsoft’s SBOM Tool — a command-line utility that generates SBOMs for software projects, integrating with Microsoft’s security and compliance frameworks to enhance transparency and security across the software supply chain.

However, these are suitable for regular software solutions. I'm not sure if these are compatible for embedded software based on nRF SDK. Thus, I'd greatly appreciate if Nordic staff/forum members share your thoughts and solutions.

Thanks,

Tai 

[Benjamin]

Hi Tai,
You’re correct that SBOM generation is not supported in the older nRF5 SDK. You can still create an SBOM, but the process will be manual. This involves scanning your source and build outputs with a third party tool, then adding details such as toolchains and precompiled libraries yourself. I’m not familiar with the specifics of each tool, but some components will always require manual entry.

Best regards,
Benjamin

[Tai]

Benjamin said:

This involves scanning your source and build outputs with a third party tool, then adding details such as toolchains and precompiled libraries yourself

Can you elaborate this? 

The following what I'm doing. Please advise if anything else needed or I'm missing:

• Scanning .h header files included in each .c file of the project. These header files belong to libraries in the parent folder nRF5 SDK. It was advised just to include the parent folder, which is sufficient.
• I'm using Segger Embedded Studio as the project's compiler and Segger-J-Link for debugging. I added these into the SBOM as well.
• Specific SoftDevice version was also added to the SBOM (pre-compiled libraries).

Thanks!

[Tai]

Benjamin Hi Benjamin. I'm looking forward to your reply. Thanks!

[Benjamin]

Hi Tai,

Based on your reply, it seems you understood correctly. What I meant is that you may need to manually enter any details the third-party tool doesn’t capture.

Best regards,
Benjamin

[Tai]

Thanks Ben!

[Andre012]

Hi Tai,

What tool did you eventually managed to use to generate the SBOM? I'm currently in a similar situation but with nRF5 SDK 12.3.0 and need to generate SBOM. Thanks