SBOM support for Cyber Resilience Act compliance

[marcov]

But how one can identify the version that is affected to bug ?

You can't.  In most cases SBOMs are only a  legal requirement, not a technical solution. The critical part might not even be dynamically linked, and only the vendor can somewhat practically relink the main binary.

I think the DCU hashes are only maybe useful when communicating with the vendor, but more likely simply added to make it look impressive.

[gidesa]

@Lep ok, thanks.