Zephyr can produce an SPDX software bill of materials for a build with the west spdx command. Enable CONFIG_BUILD_OUTPUT_META, build the app, then run west spdx. You get four documents covering the app, Zephyr, the build and module dependencies, with file hashes and licenses where known.
The steps
Based on the Zephyr documentation:
- Set CONFIG_BUILD_OUTPUT_META in your project configuration.
- Build the application with west build, giving a build directory.
- Run west spdx with the same build directory.
Output lands in the spdx folder under the build directory unless you pick another with the -s option. For SPDX 3.0, set the spdx-version option to 3.0. With sysbuild, point the command at the application's subdirectory inside the build directory.
What you get
The command writes four BOM documents named app, zephyr, build and modules-deps. By default these are SPDX 2.3 tag-value files. SPDX 3.0 produces jsonld files, and in that mode the build document also carries a Build profile describing how artifacts were produced, including the tools.
The documents record source files, build artifacts and the relationships between them, and fill in license, copyright and file hashes.
Useful options
- The analyze-includes option also works out which header files each C file includes. It takes longer.
- The include-sdk option adds an sdk document for SDK headers, used together with the previous option.
- -n sets a namespace prefix for the documents.
- The spdx-version option selects 2.2, 2.3, 3.0 or 3.1. The 3.1 option is marked experimental.
Zephyr's page also says the command does not support the native_sim platform.
What the SBOM does not do for you
An SPDX file is an inventory. It tells you what went into the build. It does not say which components have known vulnerabilities, and the Zephyr page does not claim it does. You still need a step that matches component names and versions against vulnerability data, and a person or a rule that decides what to do with the result.
Also check how complete the document is for your project. Third party code vendored into your tree, binary blobs from a chip vendor and prebuilt libraries may need to be recorded by other means.
Making it routine
Generate the documents in CI for every release build, store them with the release artifacts, and keep them for as long as you support the product. When a new advisory lands, you can answer "is it in our firmware" from the file instead of from memory.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how a component list turns into a set of findings you can sort.
Quick check
Which SPDX version does west spdx write by default?
SPDX 2.3 tag-value files. Set the spdx-version option to 3.0 for jsonld output.
Does the SBOM list vulnerabilities?
No. It is an inventory of components and files, so you need a separate matching step.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, policies and gates, and compliance evidence automation. Feed it the SBOMs and manifests your build produces and use gates to hold a release that fails your rules. A free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
