OSS + ELC EU 2026

SBOMs for embedded firmware are harder than simple dependency lists. A Zephyr-based product typically combines upstream Zephyr code, vendor HALs, out-of-tree modules, binary blobs, generated files, Kconfig and devicetree configuration, and of course user/application code. Some of these pieces end up in the final firmware image, some do not, and yet it is important to have a clear picture of what was used, what was changed, and what actually shipped. This is what helps teams avoid chasing false positives, while still knowing when a new CVE might really affect them.

In this talk, we will look at Zephyr’s SPDX-based SBOM generation, including its recently added support for SPDX 3.0. We will show why it is useful to describe not only _which_ components are present, but also _why_ they were pulled into the build and how they relate to each other.

We will also discuss how build-aware SBOMs can directly support vulnerability management and help prepare for regulations such as the Cyber Resilience Act.