FOSSA

feed🛡️ Securityfossa.com ↗

1 post in the catalog

Each feed is checked for new posts. Every post is read, and those that belong here join the catalog. What Trove read and did not keep stays on file, not shown.

fossa.comarticle

Generating and Managing C and C++ SBOMs

A FOSSA blog post explaining why C/C++ SBOMs built from manifest-parsing alone are incomplete, since the ecosystem lacks a centralized package manager and relies heavily on vendored (copy-pasted) source and code snippets. It covers concrete generation paths: Conan's built-in conan.tools.sbom CycloneDX generator, Yocto/OpenEmbedded's native SPDX output via the create-spdx class, process-based tracking for vendored code (third_party/vendor path flagging, manual audits), and the differing snippet-support capabilities of SPDX versus CycloneDX.

SBOMCycloneDXSPDX+3

Supply Chain· 2026-09-29T00:00:00+00:00