Yocto & Buildroot
Image and licence manifests from Yocto, and Buildroot’s legal-info, with host and target kept apart. Tools that only run on the build machine are marked as such, so they are never mistaken for what ships.
Embedded & container builds
Read the build you ship, not just its package list.
Connected products are built with Yocto, Buildroot and Zephyr, not only with npm and pip. SBOMFlow reads those builds directly, together with container images and the language lockfiles around them, and records every component with where it came from.
What one run reads
Embedded builds, not just package managers.
A connected product is not a web app with firmware attached. One run reads 15 build and package families across 22 manifest formats, including the embedded build systems general-purpose SBOM tooling tends to skip.
Embedded & firmware
Yocto · Buildroot · Zephyr (west) · PlatformIO · Arduino · CMake · vcpkg
Language ecosystems
Python · npm · Cargo · Go · Maven · Gleam
Containers & images
Dockerfile · Compose · OCI image evidence (opt-in)
Whatever else you ship
Product, firmware and host manifests as first-class inputs — an unrecognised file is warned about, never silently dropped
That is 7 embedded and firmware build systems and 6 language ecosystems, plus containers and generic manifests. Every family is an input the engine supports today, not a marketing list; the inputs reference names each format.
Where it goes deep
The parts of a device build other tools leave out.
Zephyr & microcontrollers
Zephyr west manifests and Zephyr’s own SPDX output, PlatformIO projects, Arduino libraries and ESP-IDF components. A shape the reader does not recognise is warned about, never guessed.
C and C++ dependencies
Sources declared in CMake, and packages from vcpkg and Conan, recorded with the pinned source and checksum they declare. Nothing is fetched and CMake is never run.
Secure boot & updates
MCUboot images and update manifests from RAUC, SWUpdate, Mender and Uptane, kept as their own evidence beside the release when you point the run at them.
Containers
Image tarballs and unpacked root filesystems with their Debian, Alpine or RPM package lists, and Dockerfile base images with every floating tag called out. OCI image evidence is available with an opt-in flag.
The software around the firmware
Lockfiles from npm, pnpm, Yarn, Cargo, Go, Poetry, Pipenv, uv, Gradle, NuGet, Composer, Bundler, Swift, Dart, Elixir, Nix and more, with the dependency graph between them.
When a build is messy
Gaps stay visible. Nothing is invented.
Recognised, not read
An input it recognises but does not read, such as a device-tree source file or a Maven pom.xml, is hashed and named in a warning. It is never silently dropped.
Missing stays missing
A version, licence or origin the build does not state stays empty and is reported. It is never made up from a branch name or a guess.
Standard formats out
What it reads becomes validated CycloneDX and SPDX, reproducible byte for byte from the same inputs, and part of the release record.
See it on your own firmware build.
A first run is one command. It works offline on a laptop and writes the full record from your real build — a record of what was observed, not a claim that your evidence is complete. v0.5.0 is available to approved private testers.