Zephyr sbom west spdx

[hdxtreeem]

Hi,
I am running zephyr nrf sdk 2.5.3 and trying to perform cve check due to new RED EN 18031 regulation requiring cve checks on the SW. However I am not able to run any cve check on the spdx files generated by west due to missing some paramters in the generated spdx file. I get 3 files from the software (app.spdx, build.spdx and zephyr.spdx). Everytime I run cve-bin-tool it returns an empty list and guess that it did not resolve any of the entries in the file (zephyr.spdx).

Anyone that has any knowledge how to perform cve checks?

[kartben]

I am not able to run any cve check on the spdx files generated by west due to missing some paramters in the generated spdx file

can you please be more specific? "missing some parameters" is really vague :)
Also, please open this as an issue, not a discussion, IF you can reproduce with Zephyr -- bug reports about nRF SDK should be directed to Nordic Semiconductor please.

[hdxtreeem]

For instance this is the entry I see in the zephyr.spdx, I assume that there should be cpe? productversion? etc..

FileName: ./zephyr/lib/crc/crc7_sw.c
SPDXID: SPDXRef-File-crc7-sw.c
FileChecksum: SHA1: 1c00a29fbff0e72e2dd8cc6045276f4ea8fa097a
FileChecksum: SHA256: 300095eddb9ea52a7bf3cbbdc0de6fe910e7fc95fcf2afe055ebc91c211a6720
LicenseConcluded: Apache-2.0
LicenseInfoInFile: Apache-2.0
FileCopyrightText: NOASSERTION

Is it even correct to use the zephyr.spdx in the cve-bin-tool? Or should I use app or build file?
cve-bin-tool --sbom spdx --sbom-file "zephyr.spdx" -S medium

[kartben]

https://youtu.be/PVqSHgXf4LE is probably a useful resource
Also, 'zephyr' itself will now have a CPE as this was addressed with #101879

[hdxtreeem]

Thanks, I have watched this video already and confirm that it works to generate these 3 spdx and is getting populated. However, the content seems to be incomplete missing the packageversion for instance when generating for an nrf project using west. Maybe it is better to ask in the nordic devzone forum?

west spdx --init --build-dir project/build
west build --build-dir project/build project --board nrf52840 --no-sysbuild -- -DCONFIG_BUILD_OUTPUT_META=y
west spdx --build-dir project/build

[migdomingo]

Not a Zephyr/nRF user myself so I can't debug the missing PackageVersion issue directly, but the RED/EN 18031 angle is exactly what I've been working on, so a couple of things that might help regardless of whether the SPDX gets fixed upstream:

Even with a complete SPDX (or CycloneDX) file, matching packages to CVEs reliably is its own problem: PURL vs CPE mismatches, vendor-name inconsistencies (mbedtls vs trustedfirmware, arm vs the actual upstream) trip up scanners even when the metadata is technically present. So, the problem with cve-bin-tool returning empty can mean either missing metadata ormetadata that doesn't match the DB's naming, worth checking both.

On the RED/EN 18031 side specifically: once you do get CVEs matching, the regulation also wants them ranked/prioritized (CISA KEV + something like EPSS, not just a raw CVE count) and a human-readable status per vulnerability, not just a VEX code. In case that it may help, I built a free checker for that layer (https://sbomready.eu), which takes SPDX or CycloneDX. Doesn't fix the west/nRF metadata gap itself though, that part still needs to get resolved upstream or via Nordic DevZone as kartben suggested.