SBOM generate with nRF SDK v17.1.0

RE: SBOM generate with nRF SDK v17.1.0

Andre012 — Mon, 09 Mar 2026 14:34:13 GMT

Hi Tai,

What tool did you eventually managed to use to generate the SBOM? I'm currently in a similar situation but with nRF5 SDK 12.3.0 and need to generate SBOM. Thanks

RE: SBOM generate with nRF SDK v17.1.0

Tai — Thu, 28 Aug 2025 18:29:58 GMT

Thanks Ben!

RE: SBOM generate with nRF SDK v17.1.0

Benjamin — Wed, 20 Aug 2025 15:48:10 GMT

Hi Tai,

Based on your reply, it seems you understood correctly. What I meant is that you may need to manually enter any details the third-party tool doesn’t capture.

Best regards,
Benjamin

RE: SBOM generate with nRF SDK v17.1.0

Tai — Tue, 19 Aug 2025 16:18:52 GMT

Benjamin Hi Benjamin. I'm looking forward to your reply. Thanks!

RE: SBOM generate with nRF SDK v17.1.0

Tai — Mon, 18 Aug 2025 18:40:18 GMT

[quote userid="145945" url="~/f/nordic-q-a/123653/sbom-generate-with-nrf-sdk-v17-1-0/545501"]This involves scanning your source and build outputs with a third party tool, then adding details such as toolchains and precompiled libraries yourself[/quote]

Can you elaborate this?

The following what I'm doing. Please advise if anything else needed or I'm missing:

Scanning .h header files included in each .c file of the project. These header files belong to libraries in the parent folder nRF5 SDK. It was advised just to include the parent folder, which is sufficient.
I'm using Segger Embedded Studio as the project's compiler and Segger-J-Link for debugging. I added these into the SBOM as well.
Specific SoftDevice version was also added to the SBOM (pre-compiled libraries).

Thanks!

RE: SBOM generate with nRF SDK v17.1.0

Benjamin — Wed, 13 Aug 2025 11:07:24 GMT

Hi Tai,
You’re correct that SBOM generation is not supported in the older nRF5 SDK. You can still create an SBOM, but the process will be manual. This involves scanning your source and build outputs with a third party tool, then adding details such as toolchains and precompiled libraries yourself. I’m not familiar with the specifics of each tool, but some components will always require manual entry.

Best regards,
Benjamin