lvgl/sbom/README.md

LVGL SBOM

This folder contains the Software Bill of Materials (SBOM) for LVGL in SPDX 3.0.1 JSON-LD format, plus the single source of truth it is generated from.

Files

File	Description
third_party.json	Single source of truth — every third-party dependency, its license, supplier and source
lvgl.spdx.json	Generated SPDX 3.0.1 SBOM
requirements.txt	Pinned tooling for validation / the CI gate
README.md	This file

Two artifacts are generated from third_party.json — do not edit them by hand:

• sbom/lvgl.spdx.json (this folder)
• COPYRIGHTS.md (repo root)

Regenerating

When a dependency is added, removed, or relicensed, edit sbom/third_party.json and regenerate both outputs:

python3 scripts/generate_copyrights.py    # -> COPYRIGHTS.md
python3 scripts/generate_sbom.py          # -> sbom/lvgl.spdx.json

The LVGL version is read from include/lvgl/lv_version.h and recorded inside the document, so the package version always tracks the checked-out tree. The file name itself is unversioned — the SBOM is bundled inside a given LVGL version anyway.

Validating

The SBOM is validated against the official SPDX 3.0.1 JSON Schema (SPDX's own recommended method) using check-jsonschema:

python3 -m pip install -r sbom/requirements.txt
python3 scripts/validate_sbom.py

CI

The Static Checks workflow (.github/workflows/static_checks.yml) fails the build if any generated file drifts from sbom/third_party.json or the SBOM is not schema-valid:

• generate_copyrights.py --check — COPYRIGHTS.md is up to date
• generate_sbom.py --check — SBOM is up to date (ignores the creation timestamp)
• validate_sbom.py — SBOM validates against the SPDX JSON Schema

third_party.json fields

Each entry in components:

field	used by	notes
key	SBOM	slug for SPDX element ids
name	SBOM + COPYRIGHTS	component title
paths	SBOM + COPYRIGHTS	in-tree locations
sources	SBOM + COPYRIGHTS	[{url, note?}]; array because e.g. TinyTTF has two upstreams. First url is the SPDX download location
note	SBOM + COPYRIGHTS	free-form note
version	SBOM	vendored snapshot version (from an in-tree version macro/string), or NOASSERTION when the upstream copy carries no version
license	SBOM	SPDX license expression (or LicenseRef-*)
license_file	SBOM	path to embed for a custom LicenseRef-* license
copyright	SBOM	upstream copyright statement (from the library's LICENSE/source header)
supplier	SBOM	{name, type} where type is person or organization
purl	SBOM	Package URL identifier
purpose	SBOM	SPDX software_primaryPurpose
third_party	SBOM	false marks LVGL's own code — omitted from the SBOM component list (COPYRIGHTS.md renders every entry)

Notes on the data

• The inventory was curated from COPYRIGHTS.md, the LV_USE_* toggles in lv_conf_template.h, and the src/libs/**/LICENSE* files.
• FreeType is listed because LVGL ships its integration interface, but FreeType itself is not part of LVGL and must be provided by the integrator.
• In SPDX 3.0 a package has no license field; licensing is expressed as Relationship elements (from package → hasDeclaredLicense / hasConcludedLicense → to license expression). This is why the SBOM contains Relationship nodes.