---
title: "Keep a bill of materials for every · Agent Wranglers"
url: https://agentwranglers.se/playbook/connected-devices/firmware-updates/firmware-sbom
id: IOT-39
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1126
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Keep a bill of materials for every firmware image

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Firmware updates](https://agentwranglers.se/playbook/connected-devices/firmware-updates.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: IOT-39
- Level: Recommended
- Chapter: [Firmware updates](https://agentwranglers.se/playbook/connected-devices/firmware-updates.md)
- Rule: Every firmware release ships with a machine-readable software bill of materials in SPDX or CycloneDX, stored next to the signed image. It lists the bootloader, the operating system or RTOS, the chip vendor's SDK and radio blobs, and every library, each with its version.
- Check: The release job fails when the image has no bill of materials, or when any listed part has no version. A query over the stored lists returns, for a given library and version, every model and firmware version that contains it.
- How: When a hole is published in a TCP/IP stack or a Wi-Fi driver, you must answer within hours which models and versions carry it. Firmware hides parts that package managers never see, such as vendor SDKs copied into the tree and binary radio firmware. Generate the list in the build, and add the parts no tool detects from a hand-kept file. Fail the build when a part has no version. Build the image reproducibly, as [build the same bytes from the same commit](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/reproducible-builds.md) says, so the list matches what ships. The general method is [keep a bill of materials and provenance](https://agentwranglers.se/playbook/application-security/supply-chain/sbom-and-provenance.md). The Cyber Resilience Act asks for a bill of materials covering at least top-level dependencies in the [technical file](https://agentwranglers.se/playbook/compliance/security-laws/cra-technical-file.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Python example

```python
import json
import sys

def parts_without_version(sbom_path: str) -> list[str]:
    sbom = json.load(open(sbom_path))
    return [part["name"] for part in sbom.get("components", []) if not part.get("version")]

if missing := parts_without_version(sys.argv[1]):
    sys.exit(f"Firmware bill of materials has parts without a version: {missing}")
```

### Go example

```go
type component struct {
	Name    string `json:"name"`
	Version string `json:"version"`
}

func PartsWithoutVersion(sbomJSON []byte) ([]string, error) {
	var sbom struct {
		Components []component `json:"components"`
	}
	if err := json.Unmarshal(sbomJSON, &sbom); err != nil {
		return nil, err
	}
	var missing []string
	for _, part := range sbom.Components {
		if part.Version == "" {
			missing = append(missing, part.Name)
		}
	}
	return missing, nil
}
```

## Sources

- [NTIA, The Minimum Elements for a Software Bill of Materials](https://www.ntia.gov/report/2021/minimum-elements-software-bill-materials-sbom)
- [SPDX specification](https://spdx.org/specifications)
- [Cyber Resilience Act, Regulation (EU) 2024/2847, Annex I](https://eur-lex.europa.eu/eli/reg/2024/2847/oj)

## Related rules

- ENG-21 [Pin every version so builds repeat](https://agentwranglers.se/playbook/engineering/ci-and-supply-chain/reproducible-builds.md) in Engineering
- APS-75 [Publish what is in each release](https://agentwranglers.se/playbook/application-security/supply-chain/sbom-and-provenance.md) in Application security
- CMP-51 [Prepare the technical file and CE marking](https://agentwranglers.se/playbook/compliance/security-laws/cra-technical-file.md) in Compliance and governance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/connected-devices/firmware-updates/firmware-sbom">Agent Wranglers connected devices playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Install security updates automatically by default](https://agentwranglers.se/playbook/connected-devices/firmware-updates/automatic-updates.md)
- [Firmware updates](https://agentwranglers.se/playbook/connected-devices/firmware-updates.md)