The automotive SBOM framework shows automakers accepting that software supply chains now need the same rigour as physical parts
The Linux Foundation has published the OpenChain Automotive Software Bill of Materials (SBOM) Framework 1.0, a shared method for automakers and suppliers to compile and exchange inventories of vehicle software. Unveiled at Open Source Summit Europe in Prague, it defines how automotive SBOM data should be structured and which fields it should carry.
Pressure to account for every software component and dependency is growing with regulatory and cybersecurity demands. The framework adds completeness and quality criteria and sets out scenarios for passing data between suppliers and automakers.
It builds on the SPDX standard (ISO/IEC 5962), adding guidance on applying it consistently in automotive. Work began in talks between Keisuke Takase of Toyota, Ayumi Watanabe of Hitachi Solutions and Masato Endo, Chair of the OpenChain Automotive Working Group, which hosts the project.
Automaker backing gives the framework early weight. Nissan and Volvo Cars have endorsed it, with Volvo already running a Continuous SBOM programme in vehicle development, while tooling firm FossID plans to help teams generate and validate files to the standard.
In a statement, Mary Meixia Wang, General Manager of the OpenChain Project, said: “As software-defined vehicles grow in complexity, improving transparency and traceability across software components is becoming essential. This first release provides practical guidance and helps advance more consistent SBOM practices across the automotive ecosystem.”
Source: Linux Foundation
Source: www.automotiveworld.com
