Sbom cve check RED EN 18031

[Hdx]

Hello,

I am currently evaluating and trying to conform to the regulation regarding the RED EN 18031 vulnerabilites checks and I am having some problems due to that the  sbom spdx file is incomplete both when I run the "ncs-sbom" and west spdx directly. I get an spdx file that seem to few keywords such as cpe, PackageVersion and PackageSupplier.

I am running 2.5.3 sdk currently on nRF52840.

For cve check I use cve-bin-tool.

This is the output when I run the spdx file generated by west and ncs-sbom:

• Report Generated: 2026-03-31  13:11:55                                                                                                                                                                                                                                                                     
 • Time of last update of CVE Data: 2026-03-31  09:30:46                                                                                                                                                                                                                                                      
┏━━━━━━━━━━┳━━━━━━━┓
┃ Severity ┃ Count ┃
┡━━━━━━━━━━╇━━━━━━━┩
│ CRITICAL │ 0     │
│ HIGH     │ 0     │
│ MEDIUM   │ 0     │
│ LOW      │ 0     │
│ UNKNOWN  │ 0     │
└──────────┴───────┘
╭─────────────╮
│ CVE SUMMARY │
╰─────────────╯
╭─────────────╮
│ CPE SUMMARY │
╰─────────────╯
┏━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━━━┳━━━━━━━━━━━━━━━━━━┓
┃ Vendor ┃ Product ┃ Version ┃ Latest Upstream Stable Version ┃ CRITICAL CVEs Count ┃ HIGH CVEs Count ┃ MEDIUM CVEs Count ┃ LOW CVEs Count ┃ UNKNOWN CVEs Count ┃ TOTAL CVEs Count ┃
┡━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━━━╇━━━━━━━━━━━━━━━━━━┩
└────────┴─────────┴─────────┴────────────────────────────────┴─────────────────────┴─────────────────┴───────────────────┴────────────────┴────────────────────┴──────────────────┘
╭───────────────────────────────────────────────╮
│  Products with No Identified Vulnerabilities  │
╰───────────────────────────────────────────────╯
┏━━━━━━━━┳━━━━━━━━━┳━━━━━━━━━┳━━━━━━┳━━━━━━━━━━┓
┃ Vendor ┃ Product ┃ Version ┃ Root ┃ Filename ┃
┡━━━━━━━━╇━━━━━━━━━╇━━━━━━━━━╇━━━━━━╇━━━━━━━━━━┩
└────────┴─────────┴─────────┴──────┴──────────┘

[Benjamin]

I used the mcuboot_with_encryption sample, it was built using sysbuild and CONFIG_BUILD_OUTPUT_META=y. The only file I tested was modules-deps.spdx.

west spdx --init -d build/mcuboot_with_encryption
west build --build-dir /some/path/mcuboot_with_encryption/build /Users/bebo/workspace/mcuboot_with_encryption --board nrf54l15dk/nrf54l15/cpuapp --sysbuild
west spdx -d build/mcuboot_with_encryption
cve-bin-tool \
  --sbom spdx \
  --sbom-file /some/path/mcuboot_with_encryption/build/mcuboot_with_encryption/spdx/modules-deps.spdx

[Hdx]

Ok same as I do, the only difference is that the modules-deps.spdx does not exist for versions below ncs sdk 2.6.0 or 2.7.0 i think, so there is the problem. What is the solution in this case for us that use older version?

I only get 3 spdx files, build.spdx, zephyr.spdx, and app.spdx.

[Benjamin]

Hi,
Yes you are right, this was added in NCS v2.8.0. I don't have any quick fixes for making this work better with the cve-bin-tool. However I found this article online, you may want to have a look at that!

Benjamin