Menu

Source-present is not the same as shipped: reviewing an embedded C/C++ SBOM
📰

Source-present is not the same as shipped: reviewing an embedded C/C++ SBOM

DEV Community: cpp·JIE SONG·about 7 hours ago
#0DcRqZFm
#devtocpp#devto#dev#build#evidence
Reading 0:00
15s threshold

Draft for author review. The example below is based on the project's documented workflow; this preparation session did not execute a firmware build or reproduce its benchmark results.

An embedded C/C++ source tree tells you which files are available. It does not, by itself, establish what reached the shipped firmware. SDKs may include optional dependencies, vendor forks and code discarded during linking.

Keep three kinds of evidence separate

Evidence What it helps establish What it does not establish alone

Source tree Candidate components and identification evidence Participation in a particular build

Compilation database Translation units and compiler commands for that build Final retention in the linked image

Linker map Link-time object and section information Complete upstream identity and version

A compilation database and a linker map complement component identification. None should silently substitute for the others.…

Continue reading — create a free account

Join HashtagPLUS to read full articles, follow hashtags, vote, and join the conversation.