PRAGUE, October 7th / PRNewswire / -- On Open Source Summit Europe, Linux Foundation today announced the release of OpenChain Automotive Software Bill of Materials (SBOM) Framework 1.0. This is an open framework aimed at creating and sharing high-quality SBOM for the automotive industry by defining common methods.

As the importance of software in modern automobiles continues to increase, companies are faced with the challenge of enhancing the visibility of software components and dependencies while meeting the evolving regulatory and cybersecurity requirements. OpenChain Automotive SBOM Framework provides a practical foundation that can be adopted by the entire industry and further improved to address these challenges faced by the automotive sector.

The key components of this framework include:

• Provide a clear structure for describing the software components and dependencies in automotive SBOM.
• Provide guidance on the required and recommended data fields, including standards for completeness and quality.
• Align with the existing SBOM standard, for example, SPDX ( ISO / IEC 5962)
• For suppliers and the use cases of OEM, including data exchange in the automotive supply chain.

This framework provides guidance on how to use established formats to describe and exchange information about software components, enabling suppliers and OEM to generate SBOM that meets common expectations, and to achieve unified standards in terms of integrity, consistency, and usability. Its design objectives are to support practical application scenarios such as software transparency, supply chain communication, and regulatory preparedness.

OpenChain Project General Manager Mary Meixia Wang stated: "As the complexity of software-defined vehicles continues to rise, it has become increasingly crucial to improve transparency and traceability between software components. This first release provides practical guidance and helps to promote more consistent SBOM practices within the automotive ecosystem."

The initiative initially stemmed from early discussions among Keisuke Takase ( Toyota ), Ayumi Watanabe ( Hitachi Solutions , Ltd .), and the chairperson of Masato Endo ( OpenChain Automotive Working Group ), reflecting a common commitment by all parties to enhance transparency, traceability, and production efficiency in the automotive industry's software. Since then, the project has continued to develop with the collaboration of organizations, industry associations, and experts in the automotive and software ecosystems. Their inputs have helped to identify common challenges and to shape a practical framework with a wide range of applicability, based on real-world needs and emerging industry expectations.

The Automotive SBOM project is under the umbrella of OpenChain Automotive Working Group and aims to complement existing standards, such as SPDX ( ISO / IEC 5962). This framework does not replace these standards but rather provides guidance on how to apply them consistently within the automotive industry.

This project welcomes participation from organizations and individuals around the world and will continue to evolve based on industry feedback and adoption rates. To learn more about the OpenChain project, please visit the website or OpenChain Automotive SBOM Framework. Click here to do so.

Supporting quotes

Hitachi Solutions, Ltd. Senior Vice President and Executive Officer Jiro Watabe stated: "The release of OpenChain Automotive SBOM Framework marks an important milestone in the automotive industry. By establishing a common approach to creating and sharing high-quality, credible SBOM data, this framework enhances transparency and trust throughout the supply chain. We believe that its adoption will help improve supply chain reliability and drive greater engineering productivity and innovation in the automotive industry."

Toyota Motor Corporation, President of Advanced R&D and Engineering Company, stated: "With the development of software-defined vehicles, the scale and complexity of automotive software development continue to grow. It has become increasingly important to share reliable SBOM information within the supply chain. We expect OpenChain Automotive SBOM Framework to enable the industry to openly share effective processes and best practices, helping to create an environment where engineers can devote more time and expertise to creating value for customers."

Black Duck Software, Inc. The person in charge of software supply chain risk strategy, Tim Mackey, stated: "Effective use of SBOM is not just about generating or releasing them on demand. Differences in requirements and expectations among different organizations and regulatory agencies can lead to SBOM quality issues – and shared frameworks, along with clear data structures and quality guidelines, are helping to address this issue at a scaled-up level."

FossID CEO Stuart Dross stated: "Automotive SBOM provides an urgently needed common format for the industry to enhance transparency in the software supply chain. FossID We are delighted to support this framework by helping automotive teams generate, import, convert, and validate SBOM according to the new standards. Automating this process reliably is one of the ways we plan to help accelerate the adoption of Automotive SBOM by automotive manufacturers and their supplier ecosystems."

Nissan Motor Co., Ltd. General Manager of Software Platform and Architecture Engineering at the Software-Defined Vehicle Engineering Department, Sugimoto Kazma stated: "As vehicle development becomes more and more software-centric, including the advancement of software-defined vehicles, understanding the composition of software is becoming an important area of focus. By participating in this SBOM standardization initiative, Nissan will contribute to the construction of a common foundation for the industry."

Volvo Cars Head of Global Open Source Strategy Carl - Eric Mols states: " Volvo Cars has successfully implemented the ' Continuous SBOM ' project launched last year, integrating SBOM practices into the vehicle development process. By promoting a unified approach throughout the supply chain, we can enhance transparency and collaboration for everyone, while also helping to drive the evolution of automotive SBOM from focusing on license compliance and network security materials to a foundation based on software trust, origin, security, lifecycle governance, and supply chain intelligence."

About the OpenChain project

OpenChain project is hosted by Linux Foundation, focusing on building trust within the open-source supply chain. This project establishes open standards for open-source compliance and security, helping organizations manage software licensing and risks within the global ecosystem.

About Linux Foundation

Linux Foundation is a globally leading open-source software, hardware, standards, and data collaboration platform. The projects under Linux Foundation include Linux, Kubernetes, Model Context Protocol ( MCP ), OpenChain, OpenSearch, OpenSSF, OpenStack, PyTorch, Ray, RISC-V, SPDX, and Zephyr, providing support for global infrastructure. Linux Foundation is committed to applying best practices and meeting the needs of contributors, users, and solution providers in order to create a sustainable open collaboration model. For more information, please visit linuxfoundation.org.

Linux Foundation is a registered trademark and is in use. For a list of trademarks Linux Foundation, please refer to their trademark usage page: www.linuxfoundation.org / trademark-usage. Linux is a registered trademark of Linus Torvalds.

Media Contact

Linux Foundation