Introduce Heads' SBOM (OSFF grant)

[tlaurion]

WiP, will edit before doing PRs

State of the Art (prior work done elsewhere that is significative)

• nix buildstack
  • https://arnout.engelen.eu/blog/nix-state-of-the-sbom/
    • sbomnix
    • nix-sbom-helper
• coreboot
  • Dasharo/coreboot: extending SBOM Extend SBOM Dasharo/coreboot#859
• linux
  • Linux kernel SBOM : https://lwn.net/Articles/1055009/
• Heads modules/* SBOM implementation:
  • https://docs.google.com/spreadsheets/d/1gKEWLxdLubOfgS1cqqY2umEX0ohYEoEy-B1i59HNVqg/edit?usp=sharing (@hughsie provided SoA)

---

Grant Grant https://opensourcefirmware.foundation/funding/

[tlaurion]

@hughsie i see a looooot of issues you opened like Mbed-TLS/mbedtls#9777. Do you have pointers to the ones that implemented what you were looking for?

This would give guidance for linuxboot/heads modules/* (without making modules/*'s SBOM non-compliance a Heads issue per se)

IE:

user@debian-13:~/heads$ ls modules/* -al | awk -F " " {'print $9'}
modules/bash
modules/busybox
modules/cairo
modules/coreboot
modules/coreboot-blobs
modules/cryptsetup
modules/cryptsetup2
modules/dasharo-ec
modules/dropbear
modules/e2fsprogs
modules/exfatprogs
modules/fbwhiptail
modules/flashprog
modules/flashrom
modules/flashtools
modules/frotz
modules/gpg
modules/gpg2
modules/hidapi
modules/hotp-verification
modules/io386
modules/ioport
modules/json-c
modules/kbd
modules/kexec
modules/libaio
modules/libassuan
modules/libgcrypt
modules/libgpg-error
modules/libhidapi-libusb
modules/libksba
modules/libnitrokey
modules/libpng
modules/libusb
modules/libusb-compat
modules/linux
modules/linuxboot
modules/lvm2
modules/mbedtls
modules/msrtools
modules/musl-cross-make
modules/ncurses
modules/newt
modules/nkstorecli
modules/npth
modules/openssl
modules/pciutils
modules/pinentry
modules/pixman
modules/popt
modules/powerpc-utils
modules/purism-blobs
modules/qrencode
modules/slang
modules/tpm2-tools
modules/tpm2-tss
modules/tpmtotp
modules/u-root
modules/util-linux
modules/zlib
modules/zstd

[hughsie]

@tlaurion does this help? https://docs.google.com/spreadsheets/d/1gKEWLxdLubOfgS1cqqY2umEX0ohYEoEy-B1i59HNVqg/edit?usp=sharing

[tlaurion]

@tlaurion does this help? https://docs.google.com/spreadsheets/d/1gKEWLxdLubOfgS1cqqY2umEX0ohYEoEy-B1i59HNVqg/edit?usp=sharing

That is a gem! Thanks @hughsie ! Edited OP.

[tlaurion]

Really relevant presentation for Heads SBOM https://fosdem.org/2026/schedule/event/ZXJD8E-sboms_for_embedded_firmware_the_zephyr_rtos_case_study/