Do I need all four SPDX files?

Upload all four. They refer to each other, and the merge needs the references to avoid counting the same module twice.

Why does my module version look like a hash?

west records the revision your west.yml pins, and that is often a commit. The mapping tables record how to turn it into a release where they can; where they cannot, the gap list says so.

Do my files leave my browser?

The files are read in your browser. When you ask for a vulnerability check, only component identifiers are sent, not the files.

Does a fixed SBOM mean my product meets the Regulation?

No. It is a better list to work from. Declarable prepares drafts for you to review; it does not assess or certify a product.

Platforms

Zephyr

A Zephyr SBOM that vulnerability databases can match

west spdx writes four separate SPDX documents (app, zephyr, build and modules-deps). Each one is only part of the picture, and they point at each other by document reference. Read one alone and you miss most of the product. The build document also lists the CMake targets as packages, so the list is long and mostly not software someone ships.

Where the documents do name the modules, the version is often a 40-character git commit and not a release, and many identifiers are NOASSERTION. A vulnerability database matches on a name and a release, so a commit hash finds nothing. The result looks like an SBOM but cannot answer "is this product affected?".

Check an SBOM, free Run it in CI →

The CI guide gives you the recipe for your Zephyr build, and says where the API key and product id come from. Uploading from CI is part of the Maker plan and above (see pricing).

An is the list your build writes.

The free check reads your file in your browser and sends only component names, versions and identifiers when you press Check. The CI path uploads the file to your account.

Getting the SBOM out of Zephyr

Run west spdx once before the build so it can record the build, then again after it:

west spdx --init -d build
west build -d build
west spdx -d build

What to upload

app.spdx, zephyr.spdx, build.spdx, modules-deps.spdx — the four documents west spdx writes into your build folder; upload all four
.config (optional) — shows which subsystems are compiled in, such as Bluetooth, MQTT or mbedTLS
west.yml (optional) — the module list with pinned revisions

What the check gives back

The four documents merged into one component list, with duplicates folded together
Identifiers added where the mapping tables know the component (package URL, CPE)
Compiled-in subsystems that no document names, found from the .config, including the C library (newlib or Picolibc)
A list of what is still missing, such as versions that are commits, and a fixed CycloneDX file to download

Check an SBOM, free

Questions

Do I need all four SPDX files?: Upload all four. They refer to each other, and the merge needs the references to avoid counting the same module twice.
Why does my module version look like a hash?: west records the revision your west.yml pins, and that is often a commit. The mapping tables record how to turn it into a release where they can; where they cannot, the gap list says so.
Do my files leave my browser?: The files are read in your browser. When you ask for a vulnerability check, only component identifiers are sent, not the files.
Does a fixed SBOM mean my product meets the Regulation?: No. It is a better list to work from. Declarable prepares drafts for you to review; it does not assess or certify a product.

Sources

Facts on this page checked on 2026-10-14.

Declarable prepares documentation for you to review. It is not legal advice and not certification. You sign your own declaration of conformity.

A Zephyr SBOM that vulnerability databases can match

The CI guide gives you the recipe for your Zephyr build, and says where the API key and product id come from. Uploading from CI is part of the Maker plan and above (see pricing).

An is the list your build writes.

The free check reads your file in your browser and sends only component names, versions and identifiers when you press Check. The CI path uploads the file to your account.