Hi,
With the EU Cyber Resilience Act applying from December 2027, products
in scope of the CRA will need an SBOM. I would like to add SBOM
generation to newt, and I am looking for feedback on the approach.
Newt:
- "newt target sbom <target>" for bootloaders and development builds
- "newt create-image ... --sbom" for release images
- CycloneDX (JSON or XML) and SPDX 2.3 (JSON) output
- one SBOM per target; the target is built first, and no SBOM is
generated if the build fails
- contents come from the actual build (compiler dependency files and
linker map)
Proposed changes in core and nimble:
1. Add an SPDX-License-Identifier line to source files. It would sit
above the existing ASF header, and bundled third-party files would
carry their real license.
2. Add "license" and optionally "cpe" to repository.* blocks. "license"
is for external repos that have no SPDX tags. "cpe" is the product ID
used by the NVD vulnerability database, which scanners use to match
CVEs. It cannot be derived from the repo name, so it would be added
for security-relevant repos only. It is stored without a version, and
newt appends the version found in the checkout:
repository.mbedtls:
type: github
vers: v3.6.7-commit
user: Mbed-TLS
repo: mbedtls
cpe: "cpe:2.3:a:trustedfirmware:mbed_tls"
3. Add a pkg.bundled block to pkg.yml describing third-party code copied
into a package. Today this is only recorded in the LICENSE file, as
prose, so scanners cannot see it. For example, in
hw/drivers/rtt/pkg.yml:
pkg.bundled:
- name: SEGGER RTT
paths: ["src/**", "include/**"]
origin: "https://www.segger.com/";
version: "x.yy"
Files from the build that match "paths" are listed as a separate
component instead of as part of core. Entries that match nothing are
left out, so the SBOM only lists what the target actually uses.
"cpe" is also supported here. Licenses still come from the file tags.
Licenses are resolved per file: SPDX tag first, then the repo
declaration, otherwise unknown. Unknown licenses produce a warning and
the SBOM is marked incomplete, so this can land step by step.
Comments welcome.
--
pozdrawiam
Szymon K. Janc
