An automotive SBOM framework reached version 1.0 under the Linux Foundation

The Linux Foundation announced on October 7, at Open Source Summit Europe in Prague, the release of the OpenChain Automotive Software Bill of Materials Framework 1.0. The version 1.0 tag was published in the project’s GitHub repository at 22:52 UTC on October 6.

The framework sets out a structure for describing software components and dependencies, guidance on required and recommended data fields including completeness and quality criteria, alignment with existing SBOM standards such as SPDX, published as ISO/IEC 5962, and usage scenarios for suppliers and carmakers exchanging data across the supply chain. It does not prescribe a document format, and names both SPDX and CycloneDX as supported.

The framework document draws the regulatory line itself. It states that UN R155 requires carmakers to monitor and track cybersecurity issues related to their vehicles, and that UN R156 requires an update mechanism for loading new software onto vehicles to fix vulnerabilities. It argues that traceability from the vehicle identification number to the corresponding bill of materials supports compliance once software delivered over the air leaves each vehicle with a different configuration after shipment. It also records that vehicles fall under sector-specific regulation and are generally exempt from the Cyber Resilience Act.

The contributor file names Keisuke Takase of Toyota, Ayumi Watanabe of Hitachi Solutions and working-group chair Masato Endo as principal contributors, with three Nissan engineers and Nokia’s Marc-Etienne Vargenau among the contributors, and records a review by the Japan Automotive ISAC. In the release, Volvo Cars open source strategy lead Carl-Eric Mols said the company had embedded SBOM practices in its vehicle development through a program launched last year.