Provide data for Software Bill of Materials (SBOM)

[ReinhardKeil]

The Problem To Be Solved

Some development processes require the generation for a SBOM. There are existing frameworks such as CycloneDX that organize these data.

As the cbuild.yml files contain already information about license, pack, and software component, this information could be provided to such systems. Below is an example:

Questions:

• what can be done by CMSIS-Toolbox to simplify generation of SBOMs? Is there information missing that could be easily added?
• are there existing tools that help to collect the information? Could these tools be used to extract the information from cbuild.yml or .PDSC XML files?

Example of cbuild.yml license information

  licenses:
    - license: <proprietary> END USER LICENSE AGREEMENT FOR ARM SOFTWARE DEVELOPMENT TOOLS
      license-agreement: ${CMSIS_PACK_ROOT}/Keil/MDK-Middleware/8.0.0/license_terms/license_agreement.txt
      packs:
        - pack: Keil::[email protected]
      components:
        - component: Keil::USB&MDK:[email protected]
        - component: Keil::USB&MDK:Device:[email protected]
        - component: Keil::USB&MDK:[email protected]
    - license: Apache-2.0
      packs:
        - pack: ARM::[email protected]
        - pack: ARM::[email protected]
        - pack: ARM::[email protected]
        - pack: ARM::[email protected]
        - pack: Keil::[email protected]
        - pack: Keil::[email protected]
      components:
        - component: ::CMSIS Driver:GPIO(API)
        - component: ::CMSIS Driver:I2C(API)
        - component: ::CMSIS Driver:SPI(API)
        - component: ::CMSIS Driver:USART(API)
        - component: ::CMSIS Driver:USB Device(API)
        - component: ::CMSIS Driver:VIO(API)
        - component: ::CMSIS-Compiler:STDERR(API)
        - component: ::CMSIS-Compiler:STDIN(API)
        - component: ::CMSIS-Compiler:STDOUT(API)
        - component: ::CMSIS:OS Tick(API)
        - component: ::CMSIS:RTOS2(API)
        - component: ARM::CMSIS-Compiler:[email protected]
        - component: ARM::CMSIS-Compiler:STDERR:[email protected]
        - component: ARM::CMSIS-Compiler:STDIN:[email protected]
        - component: ARM::CMSIS-Compiler:STDOUT:[email protected]
        - component: ARM::CMSIS:[email protected]
        - component: ARM::CMSIS:OS Tick:[email protected]
        - component: ARM::CMSIS:RTOS2:Keil RTX5&[email protected]
        - component: Keil::CMSIS Driver:[email protected]
        - component: Keil::CMSIS Driver:[email protected]
        - component: Keil::CMSIS Driver:[email protected]
        - component: Keil::CMSIS Driver:[email protected]
        - component: Keil::CMSIS Driver:USB [email protected]
        - component: Keil::CMSIS Driver:VIO:[email protected]
        - component: Keil::Device:[email protected]

[ReinhardKeil]

As there is no further feedback we suggest not to proceed.