CN CRA NotebookCRA 閱讀筆記
Last reviewed 25 Apr 2026最後校閱 2026-04-25 · 17 min read閱讀 17 分鐘 · Close reading細讀 · Standing校正

An SBOM is a mirror of your supply chain, not a document about it. SBOM 是供應鏈的鏡子,不是關於供應鏈的文件。

The SBOM you can actually produce is a measurement of how much of your own supply chain you can see. The CRA requires the document. The document only matters because of what it forces you to know. 你真正能產出的 SBOM,揭露了你能看見自己供應鏈到什麼程度。CRA 要求那份文件,但文件之所以重要,是因為它逼你必須先知道那些東西。

An industrial gateway ODM somewhere in the APAC manufacturing belt receives a polite, two-page request from one of its larger European brand customers. The customer wants a Software Bill of Materials for the gateway product line. The format is specified: CycloneDX 1.5, with SPDX identifiers, dependencies enumerated to three levels, integrated into the ODM’s CI/CD pipeline. The deadline is two weeks. The engineering manager forwards the request to the software team and goes back to other work.

Two weeks later the software team comes back with what looks like a partial response. The first level of dependencies is enumerated cleanly. The second level is mostly there. The third level has a hole in it, and the hole is in the same place where the entire RTOS lives. The team explains: the RTOS comes from a partner as a binary blob. Nobody at the ODM has ever opened it. There is no source available, no licence inventory, no list of internal components. They can list the blob as a single line item, but they cannot list what is inside the blob, because they have never been told.

That meeting is the moment the SBOM stops being a document and becomes a mirror. The question the team had been asked was not really “produce a document.” The question was “tell us what is in the product you have been selling.” And the answer turned out to be “we do not entirely know.”

§ 01The SBOM is the measurement, not the report

Most introductions to SBOM treat it as a deliverable — a thing you produce, a file you hand over, an artefact that closes a checkbox in a procurement form. That framing is operationally convenient and intellectually wrong. The SBOM is not a deliverable. It is a measurement.

What is being measured is the manufacturer’s visibility into its own supply chain. A complete SBOM, with every component traced down to its constituent libraries and licence terms, is the artefact a manufacturer with full supply-chain visibility can produce. An SBOM that lists top-level components clearly but goes blank below the second level is the artefact of a manufacturer with second-level visibility. An SBOM that lists everything except a binary blob from a partner is the artefact of a manufacturer who can see everything except the part their partner refuses to open. The thing being measured does not change with how cleanly the document is formatted. The document is just the readout.

This is the structural insight that makes the CRA’s SBOM requirement different from a marketing exercise. The legislator could have required a generic statement of supply-chain hygiene, a checklist of vendor questionnaires, an attestation. The legislator chose, instead, to require a specific machine-readable artefact in a known format. The choice is deliberate. A statement is something you write. An attestation is something you assert. An SBOM is something you produce by examining what is actually in the product. The legislator picked the artefact that maps most directly onto reality, and the artefact that exposes most directly what the manufacturer does not know.

For an APAC ODM in particular, the implication is uncomfortable but precise. The SBOM the company can produce on demand is the measurement of how much of its own product it actually understands. A thin SBOM is not a documentation problem. It is a knowledge problem. Fixing the document, without fixing the knowledge underneath, just makes the document misleading. The CRA does not reward misleading documents.

This reframing also clarifies why so many APAC manufacturers initially treat the SBOM requirement as smaller than it is. Read as a deliverable, the SBOM looks like a few weeks of tooling work. Read as a measurement, it is the visible end of a multi-quarter supply-chain restructuring exercise. Both readings cost effort, but the second one costs the right kind of effort.

The document is the measurement. The measurement is the obligation.

§ 02The “at the very least” trap in Annex I, Part II(1)

Annex I, Part II, point (1) of the CRA spells out the SBOM obligation in a way most readers misread on first pass. The text requires the manufacturer to identify and document vulnerabilities and components contained in the product, “including by drawing up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the product.”

The phrase doing most of the work in that sentence is “at the very least.” A manufacturer reading the clause for the first time tends to treat “top-level dependencies” as the operative requirement and “at the very least” as decorative throat-clearing. The opposite is closer to the truth. “Top-level” is the floor; “at the very least” is the legislator signalling that the floor is exactly that — a floor, not a ceiling, not a default, not the answer.

The reason the floor is not the answer becomes clear when you read the SBOM clause in conjunction with Article 13(8) through (13), which set out the manufacturer’s vulnerability-handling obligations through the support period. The manufacturer must identify and address vulnerabilities effectively, must apply security updates, must coordinate with vulnerability disclosures. None of these obligations can be discharged with a top-level-only SBOM. A vulnerability in a transitive dependency — a library three layers down — is still a vulnerability the manufacturer is obliged to address, and the manufacturer cannot address what the SBOM does not surface. The top-level requirement is the minimum format compliance; the vulnerability-handling obligation is the actual depth requirement. They have to be read together.

Industry practice has converged, in the years since SBOM tooling matured, on a working depth heuristic. Most security teams and SBOM tooling vendors treat “top-level plus transitive close to a meaningful depth” as the working standard for being able to perform vulnerability analysis with reasonable coverage. The exact depth varies with the technology stack — firmware with embedded RTOS components is different from a Linux-based gateway, which is different from a containerised cloud service — and there is no single magic number. But the direction is consistent: top-level alone is the floor, transitive depth is where the analysis becomes operationally meaningful, and the CRA’s vulnerability-handling obligations land closer to the latter than the former.

What the legislator did not do is specify the exact depth. That decision sits with the manufacturer, who has to be able to defend it — against a market surveillance authority, against a customer audit, against a notified body in the conformity assessment for an important or critical product. The defence rests not on the floor but on whether the chosen depth actually supports the vulnerability-handling work the regulation requires. A manufacturer who picked “top-level only” because Annex I’s text appeared to permit it, and who cannot then show how it traces vulnerabilities in transitive dependencies, has answered the wrong question.

Anchor — downstream activation Annex I, Part II(1): SBOM “at the very least” covering top-level dependencies, in a commonly used and machine-readable format. Article 13(8)–(13): vulnerability-handling obligations through the support period — the obligations the SBOM has to be deep enough to support. Recital 27: the SBOM must enable the identification and analysis of vulnerabilities throughout the support period. The floor in Annex I is a format-compliance floor; the operational depth requirement comes from Article 13.

§ 03The SBOM is a live document, not a release snapshot

An SBOM is meaningful only in relation to the version of the product that is actually on the market. This is a sentence that sounds obvious and turns out, in operational practice, to be the source of a large fraction of CRA-compliance failures.

The pattern looks like this. The manufacturer ships firmware version 1.2.0 with SBOM A. A month later, a security patch updates an OpenSSL component, and the manufacturer ships version 1.2.1. The SBOM that accompanies version 1.2.1 must be SBOM B, reflecting the new OpenSSL version. Three months later, the firmware switches to a different RTOS subcomponent for unrelated engineering reasons; that becomes version 1.2.2 with SBOM C. Each version on the market needs its own SBOM, retrievable on demand, mapped one-to-one to the firmware artefact actually installed on customer equipment.

Most APAC ODMs do not have this discipline operationally. The SBOM, when it exists at all, tends to be produced once at major release, archived, and treated as static. Patch releases ship without an updated SBOM because the patch was “just a small change.” A market surveillance authority asking, twelve months later, for the SBOM of the version actually in field deployment receives an out-of-date document, and out-of-date documents are operationally indistinguishable from missing documents. The SBOM has to be a release artefact that ships every time anything ships, generated by the build pipeline and stored alongside the firmware binary. Tooling to do this exists in mature form: Syft, the CycloneDX generator family, SPDX tooling, language-specific dependency scanners. The tooling is not the bottleneck. The release process is the bottleneck.

Two structural changes follow from treating the SBOM as a live document. First, the release pipeline has to gate on SBOM generation. A firmware build that does not produce a current SBOM is not a release candidate. Second, the SBOM has to be archived against version identifiers in a way that supports query-by-version, because the question that arrives from a market surveillance authority or a customer is always “send us the SBOM for version X” — never just “send us your SBOM.” A manufacturer with thirty product lines and several hundred firmware versions in field deployment has a non-trivial archive problem to solve, and solving it after the first information request arrives is much more expensive than solving it in advance.

Anchor — downstream activation Article 13(25): the manufacturer’s obligation to ensure that the SBOM made available to market surveillance authorities reflects the product as placed on the market. Article 14(1): when an actively exploited vulnerability is identified, the 24-hour reporting clock starts — and the manufacturer has to be able to identify, within those 24 hours, exactly which SBOM version is affected. Out-of-date SBOMs make that clock unmeetable.

§ 04The black boxes APAC supply chains are full of

The most painful part of producing an honest SBOM, for most APAC industrial manufacturers, is not the parts the company wrote itself. It is the parts the company received from upstream as binary, with no source, no documentation of internal composition, and frequently no contractual right to ask for either. Three categories of these black boxes show up repeatedly.

Black box 1 — BMC firmware blobs. Server boards, industrial PCs, edge gateways, and a wide range of networked equipment carry baseboard management controllers. The BMC firmware on most of these comes pre-built from a small number of upstream vendors, integrated by the platform builder, and shipped as a binary image with limited or no visibility into its internal composition. When CVE-2024-54085 became public in March 2025, manufacturers across APAC discovered, in real time, that they did not have an answer to “is this CVE in our product” without going back to the BMC firmware vendor and asking. Some vendors answered quickly. Others took weeks. The CRA timeline does not allow weeks. The SBOM has to surface BMC firmware contents as a structural matter, not as something arranged in an emergency.

Black box 2 — UEFI BIOS images. The UEFI firmware on x86-based industrial platforms comes from independent BIOS vendors, with portions licensed and integrated from multiple upstream sources, and ships as a binary image carrying internal modules whose origins and versions are not always documented to the platform OEM. UEFI vulnerabilities are not theoretical: the LogoFAIL family of vulnerabilities in 2023, the BootHole vulnerabilities before that, and a steady stream of UEFI module CVEs in between have all required platform OEMs to trace components back through several layers of supplier relationships to identify exposure. A CRA-compliant SBOM cannot leave the BIOS image as one opaque line.

Black box 3 — chip-vendor SDKs and reference firmware. Connected products built on SoC platforms from major chip vendors typically integrate vendor-supplied SDK components for wireless stacks, cryptographic libraries, USB and networking drivers, and bootloader chains. These SDKs frequently incorporate open-source components whose versions, patch levels, and licensing are documented internally by the chip vendor but are not always exposed to the OEM in machine-readable form. The Realtek CVE-2021-35394 disclosure in 2021 exposed this category sharply: a vulnerability in chip-vendor SDK code propagated, silently, into hundreds of OEM products whose makers had no clear inventory of what SDK version they were shipping. SBOM compliance forces this inventory to be made explicit.

The pattern across all three categories is the same. The black box is comfortable, commercially, as long as nobody is asking what is inside. The CRA asks. The asking is now a regulatory obligation, not a customer’s preference. And the manufacturer cannot answer the question without contractual leverage on the upstream supplier — leverage which, in many APAC supply-chain relationships, has historically not existed.

Anchor — downstream activation Article 13(4): the manufacturer’s due-diligence obligation when integrating components, including third-party components, into a product with digital elements. Annex I, Part I(2): the requirement to deliver products without known exploitable vulnerabilities — an obligation that cannot be discharged for components the manufacturer cannot inspect.

§ 05The SBOM forces a contract rewrite, in two directions

The SBOM obligation is not just a technical obligation. It is a trigger for contract revision — upstream with component suppliers, and downstream with brand customers. APAC ODMs that have lived comfortably with informal supplier relationships need to revisit those contracts with specific clauses, and ODMs that have lived comfortably with informal brand-customer arrangements need to negotiate the SBOM ownership question explicitly.

Upstream — the ODM’s contracts with its component and firmware suppliers. The minimum clause set: each component supplier must deliver, alongside the component itself, an SBOM in CycloneDX 1.5 or SPDX 2.3 format covering the component to a specified depth; the supplier must deliver an updated SBOM whenever the component is updated; the supplier must respond to vulnerability notifications within a defined timeframe; the supplier must provide remediation timelines for confirmed vulnerabilities. The contract has to specify what happens when the supplier does not comply — rejection of delivery, payment hold, contract termination. None of this is exotic in mature software supply chains; it is exotic in many APAC industrial supply chains because the relationships predate the regulatory environment that now requires it.

Downstream — the ODM’s contracts with its European brand customers. The negotiation here turns on a question that is rarely surfaced explicitly: who is named as the manufacturer on the EU Declaration of Conformity for the integrated product? The party named there owes the Article 13 obligations, including the obligation to produce a current SBOM on demand. If the brand customer is named, the SBOM has to be assembled by the brand from the ODM’s SBOM plus the brand’s own integration layer. The contract has to specify the format the ODM delivers in, the update cadence, the licensing terms for redistribution, and the parties’ respective responsibilities when an Article 14 incident triggers a 24-hour reporting clock that requires SBOM lookup at speed.

The structural error most APAC manufacturers make in these conversations is to treat the SBOM as a technical artefact rather than as a contractual one. The SBOM is the evidence object that flows through three contractual relationships — supplier-to-ODM, ODM-internal, ODM-to-brand — and the regulatory obligations attach to specific parties at specific points in that chain. Getting the contracts right is the prerequisite to getting the document right; getting the document right without the contracts is, at best, a temporary arrangement.

Anchor — downstream activation Article 13: the manufacturer obligations that attach to whoever is named as the manufacturer of the integrated product. Arts. 21 and 22: the rebranding/substantial-modification regime that can move manufacturer status, with all its SBOM obligations, between parties when integration or rebranding occurs — Article 21 for importers and distributors, Article 22 for everyone else. Article 14: the 24-hour reporting clock that depends on the SBOM being retrievable in time.

§ 06What the SBOM obligation is really for

The engineering manager from the start of this essay is, by the time he understands the situation, looking at something larger than a two-week deliverable. He is looking at the visible portion of a years-long supply-chain restructuring exercise. The SBOM the European customer asked for is not the work. The work is becoming the kind of company that can produce the SBOM honestly — a company with contractual leverage on its component suppliers, with internal release processes that gate on SBOM generation, with archives that support version-specific retrieval, with vulnerability-handling pipelines that traverse the SBOM rather than guess about it.

The CRA, read at its most demanding, asks APAC manufacturers to make a transition that the European market has been moving toward, on its own, for a decade. That transition is from being an opaque assembler of components into a defined product, to being an explicable owner of a supply chain that someone else can audit. The transition is unglamorous. It involves contractual conversations with suppliers who have not historically had to answer these questions, internal process changes in release engineering, archive infrastructure that did not previously exist, and budget allocations that were not previously needed.

It is also, for APAC industrial manufacturing in particular, a structural upgrade. The companies that complete this transition will be measurably more capable than they were before — not just in CRA-compliant ways, but in ways that show up in customer trust, in incident response time, in the speed of integrating into critical-infrastructure procurement processes, in the simple ability to answer the question “what is in this product” in less than a day. The companies that do not complete the transition will, increasingly, be unable to ship into the European market at all.

The SBOM the European customer asked for is the readout. The work it forces is the becoming.

APAC 製造業某個角落,一家工業閘道 ODM 收到歐洲一家大品牌客戶寄來的、客氣的兩頁要求。客戶要這條閘道產品線的 Software Bill of Materials。格式寫得明白:CycloneDX 1.5、附 SPDX 識別碼、依賴關係列到第三層、接進 ODM 的 CI/CD 流程。期限兩週。工程主管把單子轉給軟體團隊、回去忙別的。

兩週後軟體團隊回報,能交的只是半套。第一層依賴列得乾淨、第二層大致都在、第三層有個洞——洞剛好開在整個 RTOS 那一塊。團隊解釋:RTOS 是合作廠商賣給他們的 binary blob。ODM 從來沒人打開過、沒原始碼、沒授權清單、沒內部元件列表。他們可以把整塊 blob 列成一行,但裡面是什麼列不出來——因為從沒有人告訴他們。

那場會議就是 SBOM 從文件變成鏡子的時刻。團隊接到的題目其實不是「產出一份文件」、是「告訴我們你一直在賣的這個產品裡面到底有什麼」。而答案是「我們不完全知道」。

§ 01SBOM 是揭露、不是報告

大部分對 SBOM 的介紹把它當交付物——你產出來的東西、你交出去的檔案、採購表單上勾掉的成品。這個框架操作上方便、概念上錯。SBOM 不是交付物、是一次揭露。

被揭露的,是製造商對自家供應鏈的可見度。一份完整的 SBOM(每個元件追到構成它的函式庫跟授權條款),是具備完整供應鏈可見度的製造商能交出的成品。一份「上層元件清楚、第二層以下空白」的 SBOM,是只有第二層可見度的製造商交得出的成品。一份「除了合作廠商的 binary blob 之外什麼都列得出」的 SBOM,是「能看見一切、除了合作廠商不肯打開的那塊」的製造商交得出的成品。被揭露的東西,不會因為文件排版整齊就改變。文件只是把它顯出來。

這就是 CRA 的 SBOM 要求跟行銷練習不一樣的結構性差別。立法者大可以要一份泛泛的供應鏈衛生聲明、一張供應商問卷、一份切結書。立法者選了要一份特定的、機器可讀的、已知格式的成品。這個選擇是刻意的。聲明是你寫的。切結是你主張的。SBOM 是你檢視產品實際內容之後才產得出來的。立法者選了最直接對應現實的成品——也是最直接揭露製造商不知道什麼的成品。

對 APAC ODM 來說,含義不舒服但精確:公司在主管機關要求時能立刻交出的 SBOM、揭露了公司對自家產品實際理解到什麼程度。一份薄的 SBOM 不是文件問題、是知識問題。修文件而不修底下的知識、只會讓文件變成誤導。CRA 不獎勵誤導性文件。

這個重新框定也說明了為什麼許多 APAC 製造商一開始把 SBOM 義務看得比實際小。當交付物來讀,SBOM 看起來是幾週的工具配置工作。當揭露來讀、它是跨幾季供應鏈重組工程的可見終點。兩種讀法都費力,但第二種費的是對的力。

文件就是揭露。揭露就是義務。

§ 02附件一第二部分第 (1) 點的「at the very least」陷阱

CRA 附件一第二部分第 (1) 點把 SBOM 義務寫得很清楚,但大部分人第一遍會讀錯。條文要求製造商識別並文件化產品所含弱點與元件、「包括以通用的機器可讀格式製作 software bill of materials、至少涵蓋產品之上層依賴」。

這句話真正在出力的是「at the very least(至少)」。第一次讀的製造商通常把「上層依賴」當主要要求、把「至少」當裝飾性開場。實情剛好相反。「上層」是地板、「至少」是立法者在告訴你那真的就是地板、不是天花板、不是預設、不是答案。

地板為什麼不是答案、把 SBOM 條文配 Article 13(8)–(13) 的弱點處理義務一起讀就清楚了。製造商必須有效識別並處理弱點、必須提供安全更新、必須跟弱點揭露協調。這些義務沒有一個能用「只列上層」的 SBOM 履行。一個藏在 transitive dependency(第三層之下的某個函式庫)的弱點、仍是製造商有義務處理的弱點、而 SBOM 沒呈現的東西製造商沒辦法處理。上層要求是格式合規的最低門檻、弱點處理義務才是真正的深度要求。兩者必須一起讀。

SBOM 工具成熟以來這幾年、業界實務逐步收斂出一個能用的深度標準。多數資安團隊跟 SBOM 工具廠商把「上層加上 transitive 到有意義的深度」當作「能做到合理涵蓋的弱點分析」的工作標準。具體深度依技術堆疊不同——嵌入 RTOS 元件的韌體、Linux 為基底的閘道、容器化雲端服務之間都不一樣——沒有單一的神奇數字。但方向一致:只列上層是地板、transitive 深度才是分析開始實務上有意義的地方、CRA 的弱點處理義務落點偏後者。

立法者沒做的事,是規定確切深度。那個決定在製造商手上,而製造商必須能為它辯護:對市場監督機關、對客戶稽核、對 important 或 critical 產品符合性評鑑中的公告機構。辯護立基的不是地板、而是「所選深度是否實際支撐法規要求的弱點處理工作」。一個因為附件一文字看起來允許就選了「只到上層」,然後拿不出 transitive 弱點追蹤證據的製造商、回答的是錯的問題。

錨點:觸發對應條文 附件一第二部分第 (1) 點:SBOM「at the very least」涵蓋上層依賴、採通用的機器可讀格式。Article 13(8)–(13):support period 內的弱點處理義務——SBOM 必須有足夠深度才能支撐的義務。Recital 27:SBOM 須使 support period 內的弱點識別與分析成為可能。附件一的地板是格式合規的地板、操作深度要求來自 Article 13。

§ 03SBOM 是活文件、不是發行快照

SBOM 只有對應到「實際在市場上的那個產品版本」才有意義。這句話聽起來理所當然、實務上卻是 CRA 合規失效最大來源之一。

典型情境長這樣。製造商出貨韌體 1.2.0、附 SBOM A。一個月後安全修補更新一個 OpenSSL 元件、出貨 1.2.1。隨 1.2.1 出的 SBOM 必須是 SBOM B、反映新的 OpenSSL 版本。三個月後韌體因為跟資安無關的工程理由切換到不同的 RTOS 子元件、變成 1.2.2、附 SBOM C。每一個還在市場上的版本都需要自己的 SBOM、可被即時調閱、跟客戶設備上實際安裝的韌體成品一對一對應。

大部分 APAC ODM 操作上沒有這個紀律。SBOM 即便存在,也傾向只在主要發行時產出一次、歸檔、之後當靜態資產處理。修補版發行時不更新 SBOM——因為「只是個小變更」。十二個月後市場監督機關問「現場部署版本的 SBOM 是什麼」、收到一份過期文件。對主管機關來說,過期文件跟缺失文件沒兩樣。SBOM 必須是發行成品——每次韌體出貨都要附上、由建置流程自動產出、跟韌體 binary 一起儲存。能做這件事的工具早就成熟:Syft、CycloneDX 產生器家族、SPDX 工具、各語言的依賴掃描器。瓶頸不在工具、在發行流程。

把 SBOM 當活文件處理會帶出兩個結構性改變。第一、發行流程必須以 SBOM 產出為關卡。沒產出當前 SBOM 的韌體建置不是候選版本。第二、SBOM 必須對著版本識別碼歸檔、而且歸檔方式必須支援「依版本查詢」——因為市場監督機關或客戶送過來的問題永遠是「給我們版本 X 的 SBOM」、從來不是「給我們你們的 SBOM」。一家有三十條產品線、現場部署上百個韌體版本的製造商,要解的歸檔問題不容易、而第一份資訊調閱要求送來之後才解這個問題、比事先解貴得多。

錨點:觸發對應條文 Article 13(25):製造商有義務確保提供給市場監督機關的 SBOM 反映「投入市場時的產品」。Article 14(1):當主動受利用的弱點被識別時,24 小時通報時鐘啟動——製造商必須能在這 24 小時內精確識別「哪一個 SBOM 版本受影響」。過期 SBOM 讓這個時鐘無法滿足。

§ 04APAC 供應鏈到處是黑箱

對大部分 APAC 工業製造商來說,產出一份誠實 SBOM 最痛的部分、不是公司自己寫的那一塊。是公司從上游收到的、以 binary 形式交付、無原始碼、無內部組成文件、而且常常連索取上述兩者的合約權利都沒有的那一塊。三類黑箱反覆出現。

黑箱 1:BMC 韌體 blob。伺服器主板、工業 PC、邊緣閘道、以及一大類連網設備都搭載 baseboard management controller。這些 BMC 韌體大多由少數上游廠商預先建置、由平台製造商整合、以 binary image 形式出貨、內部組成的可見度有限或沒有。CVE-2024-54085 在 2025 年 3 月公開時、APAC 的製造商當下發現他們答不出「這個 CVE 在不在我們產品裡」——必須回頭問 BMC 韌體供應商。有些供應商回得快、有些拖了幾週。CRA 時程容不得幾週的拖延。SBOM 必須在結構上呈現 BMC 韌體內容、不是事到臨頭才安排。

黑箱 2:UEFI BIOS 映像。x86 工業平台上的 UEFI 韌體來自獨立的 BIOS 廠商、部分授權整合自多個上游來源、以 binary image 形式出貨、內含的內部模組來源跟版本不一定對平台 OEM 文件化。UEFI 弱點不是理論:2023 年的 LogoFAIL 弱點家族、之前的 BootHole 弱點、以及這之間穩定流出的 UEFI 模組 CVE、都要求平台 OEM 透過幾層供應商關係追溯元件以識別暴露。一份合 CRA 規定的 SBOM 不能把整個 BIOS 映像當成一個不透明的黑盒列出來。

黑箱 3:晶片廠 SDK 與參考韌體。建構在主要晶片廠 SoC 平台上的連網產品、通常整合廠商提供的 SDK 元件——無線堆疊、密碼函式庫、USB 與網路驅動、bootloader 鏈。這些 SDK 常含有開源元件、其版本、修補等級、授權由晶片廠內部文件化,但不一定以機器可讀格式對 OEM 揭露。Realtek CVE-2021-35394 在 2021 年的揭露把這個類別的問題擺到檯面上:晶片廠 SDK 程式碼裡的弱點悄悄傳遞到上百件 OEM 產品——而 OEM 自己對出貨的 SDK 版本沒有清楚清單。SBOM 合規迫使這個清單必須被攤開來。

三個類別共通的模式是同一個。商業上、黑箱在「沒人問裡面是什麼」時很舒服。CRA 開始問。這個提問現在是法規義務、不是客戶的偏好。而製造商沒有對上游供應商的合約籌碼,就答不出問題——而在許多 APAC 供應鏈關係裡,這種籌碼歷來都沒有。

錨點:觸發對應條文 Article 13(4):製造商對整合進具數位元素產品的元件(含第三方元件)的盡職調查義務。附件一第一部分第 (2) 點:交付產品時不得帶有已知 exploitable 弱點——對自己看不見的元件,這項義務無法履行。

§ 05SBOM 迫使合約改寫、雙向

SBOM 義務不只是技術義務、是合約改寫的觸發器——上游對元件供應商、下游對品牌客戶。習慣了非正式供應商關係的 APAC ODM 必須帶具體條款回去重談;跟品牌客戶有非正式安排的 ODM 必須明確談判 SBOM 歸屬問題。

上游:ODM 對其元件與韌體供應商的合約。合約至少要寫進這幾條:每個元件供應商交付元件時必須同時交付一份 CycloneDX 1.5 或 SPDX 2.3 格式的 SBOM、涵蓋元件至約定深度;供應商更新元件時必須交付更新的 SBOM;供應商必須在約定時間內回應弱點通知;供應商必須對確認弱點提供修補時程。合約必須規定供應商不遵守時的後果——拒收、扣款、終止合約。在成熟的軟體供應鏈裡這些都是常識,在許多 APAC 工業供應鏈裡卻是異類——因為這些關係的形成早於現在要求它們的法規環境。

下游:ODM 對其歐洲品牌客戶的合約。這裡的協商,關鍵在一個很少被擺上檯面的問題:誰被列為整合產品 EU Declaration of Conformity 上的 manufacturer?被列名的那一方擔負 Article 13 義務、包括即時產出當前 SBOM 的義務。如果品牌客戶被列名,SBOM 必須由品牌商把 ODM 的 SBOM 加上品牌自己的整合層組起來。合約必須規定 ODM 交付的格式、更新節奏、再分發的授權條款、以及 Article 14 事件觸發 24 小時通報時鐘要求快速 SBOM 查詢時雙方的責任分配。

大部分 APAC 製造商在這些對話裡犯的結構性錯誤,是把 SBOM 當技術成品、而不是當合約成品處理。SBOM 是流經三層合約關係——供應商-到-ODM、ODM 內部、ODM-到-品牌——的證據物件、而法規義務在這條鏈上的特定點附加於特定方。把合約處理對,是把文件處理對的前提;把文件處理對而合約沒處理對、頂多只是個臨時安排。

錨點:觸發對應條文 Article 13:附加於整合產品所列名 manufacturer 的製造商義務。Arts. 21 與 22:重貼標/實質修改機制——當整合或重貼品牌發生時,可以把 manufacturer 身分(連同其 SBOM 義務)在各方之間移轉——Article 21 適用於進口商與經銷商、Article 22 適用於其他人。Article 14:依賴 SBOM 可被即時調閱的 24 小時通報時鐘。

§ 06SBOM 義務真正存在的目的

本文開頭那位工程主管、等他理解情況時、看著的是比兩週交付物大得多的東西。他看著的是一個跨多年的供應鏈重組工程的可見部分。歐洲客戶要的 SBOM 不是工作。工作是「成為一家能誠實產出那份 SBOM 的公司」——一家對元件供應商有合約籌碼、發行流程以 SBOM 產出為關卡、歸檔支援按版本調閱、弱點處理流程依靠 SBOM 查證、不是靠猜的公司。

CRA 在最高要求的讀法下,是在要求 APAC 製造商完成歐洲市場過去十年自發進行的轉型。那個轉型是從「不透明的元件組裝者、把零件組成一個成型的產品」、轉成「能對自己供應鏈說得清楚的擁有者、可以被別人稽核」。這個轉型不光鮮。它涉及跟歷史上沒被問過這些問題的供應商重新對話、發行工程的內部流程改變、以前不存在的歸檔基礎建設、以前沒編列的預算分配。

對 APAC 工業製造業來說這也是一次結構性升級。完成這個轉型的公司會比之前可被量化地強大——不只是合 CRA 規定的方式強、是顯現在客戶信任、事件回應時間、整合進關鍵基礎設施採購流程的速度、以及光是「一天內回答出『這個產品裡有什麼』」這件事的能力。沒完成轉型的公司會逐漸無法把產品出貨到歐洲市場。

歐洲客戶要的那份 SBOM、是顯影。真正的工作、是公司本身的脫胎換骨。