Does Declarable support Buildroot?

Partly. Declarable reads the JSON that make show-info prints and builds a component list from it. It also reads a .config, for the package names and the few versions it states. It does not read the make legal-info manifest, so licences come only from what show-info states.

I only have a .config. What happens if I upload it?

It is read, and the packages you selected in menuconfig are listed. A .config states a version for only a few of them (usually the kernel, bootloader and C library), so the result names the versions it found, says the rest are missing, and says that a vulnerability check without them can only be a guess. To get versions, run make show-info > show-info.json in your Buildroot output directory and upload that file instead.

Can I use an SBOM from a third-party tool?

If a tool turns your Buildroot output into SPDX or CycloneDX, the SBOM check reads that file too. You do not need one: the make show-info JSON can be uploaded as it is.

Does Buildroot check CVEs itself?

It has its own package statistics target, make pkg-stats, which reports known CVEs per package. See the Buildroot manual.

Can I keep the file in CI?

Yes. The Buildroot CI page shows how to send the make show-info output on each build.

Platforms

Buildroot

Buildroot and the CRA: what the build gives you

Buildroot builds a Linux image from a list of packages, and it does not write an SPDX or CycloneDX file. What it writes instead is a package list: make show-info prints each package with its version as JSON, and make legal-info writes a manifest of packages and licences.

That list is not an SPDX or CycloneDX file that others can read, and the names are Buildroot package names, not the vendor and product pairs vulnerability databases use. Declarable reads the make show-info JSON as it is and does the mapping from package names to vendor and product pairs itself.

Check an SBOM, free Run it in CI →

The CI guide gives you the recipe for your Buildroot build, and says where the API key and product id come from. Uploading from CI is part of the Maker plan and above (see pricing).

An is the list your build writes.

The free check reads your file in your browser and sends only component names, versions and identifiers when you press Check. The CI path uploads the file to your account.

Getting the SBOM out of Buildroot

From your Buildroot tree, after configuring your image:

make show-info > packages.json

What to upload

output of make show-info — the package list with versions, as JSON
.config from your Buildroot output directory — the packages you selected in menuconfig. It states a version for only a few (usually the kernel, bootloader and C library), and the result names which got one, so a vulnerability check on the rest can only be a guess; send make show-info for every version
manifest.csv from make legal-info — not read today; it lists the same packages with their licences, and Declarable takes the package list from make show-info instead

What the check gives back

The packages and versions from make show-info, with the dependencies between them
From a .config alone: the package names you selected, with a version only where the .config states one. The result names which packages got one and which did not, and names make show-info as the file that has the rest
A CPE identifier for each package whose recipe states one, and for others where a mapping row of ours knows the package
The kernel, bootloader and C library (glibc, musl or uClibc-ng) recognised by name, so the declaration questions about them have an answer to start from. An external toolchain brings its own C library, which a .config does not name, and the result says so
Not read today: the make legal-info manifest and its licence columns

Check an SBOM, free

Questions

Does Declarable support Buildroot?: Partly. Declarable reads the JSON that make show-info prints and builds a component list from it. It also reads a .config, for the package names and the few versions it states. It does not read the make legal-info manifest, so licences come only from what show-info states.
I only have a .config. What happens if I upload it?: It is read, and the packages you selected in menuconfig are listed. A .config states a version for only a few of them (usually the kernel, bootloader and C library), so the result names the versions it found, says the rest are missing, and says that a vulnerability check without them can only be a guess. To get versions, run make show-info > show-info.json in your Buildroot output directory and upload that file instead.
Can I use an SBOM from a third-party tool?: If a tool turns your Buildroot output into SPDX or CycloneDX, the SBOM check reads that file too. You do not need one: the make show-info JSON can be uploaded as it is.
Does Buildroot check CVEs itself?: It has its own package statistics target, make pkg-stats, which reports known CVEs per package. See the Buildroot manual.
Can I keep the file in CI?: Yes. The Buildroot CI page shows how to send the make show-info output on each build.

Sources

Facts on this page checked on 2026-10-14.

Declarable prepares documentation for you to review. It is not legal advice and not certification. You sign your own declaration of conformity.

Buildroot and the CRA: what the build gives you

The CI guide gives you the recipe for your Buildroot build, and says where the API key and product id come from. Uploading from CI is part of the Maker plan and above (see pricing).

An is the list your build writes.

The free check reads your file in your browser and sends only component names, versions and identifiers when you press Check. The CI path uploads the file to your account.