Jochwacht: the SBOM comes out of the build
Since 11 September 2026 the reporting duty under Article 14 of the Cyber Resilience Act has applied. An early warning is due within 24 hours of becoming aware. The question is not how bad the vulnerability is. It is this: does the affected component sit in a firmware version we shipped — and which one?
Jochwacht produces that answer where it originates — at compile time.
The problem
C and C++ have no manifest
Tools from the web world read package manifests. Statically linked libraries, vendored third-party sources and locally patched upstream versions appear in no such manifest. A scan after the fact guesses at those places.
A run without an error is not evidence
We ran two widely used open tools over the same project, libwebsockets. One returned three entries, all of them steps from the CI configuration. The other returned 260, of which 222 were the project’s own build targets. Neither run failed, and both produced a valid file.
The deadline asks about the component
24 hours from awareness leaves no room for an inventory. Teams that generate their SBOM only for the audit spend the first night searching instead of assessing.
Supplier and licence are often missing
In SBOMs received from others, both fields are frequently empty. Without a supplier you do not know whom to ask; without a licence, what you may pass on. The German BSI guideline TR-03183-2 requires both.
How Jochwacht works
From the build, not from a scan
CMake, Meson, Autotools, Yocto, Buildroot, Zephyr and vcpkg are read directly. What the build system already knows does not have to be guessed.
Enrichment from our own database
Missing fields are filled in. Measured on a supplied SBOM with 1,907 components: the supplier field went from 0 to 1,907. The licence field from 214 to 1,905.
Checked against two lists of actively exploited vulnerabilities
The CISA KEV catalogue and the EU vulnerability database EUVD are both ingested hourly. They count differently, which is why both are used.
Unchecked is not the same as unaffected
The field for active exploitation has three values: exploited, not exploited, not checked. A green light for something unchecked would be worthless.
Three limits belong with that. Jochwacht does not make a product compliant — that comes from its manufacturer’s own assessment. It does not promise completeness: generating from your own builds, the supplier field carries on average nine out of ten components, with Yocto fewer. Where a value is missing, the file says so instead of guessing. And the reporting duty stays with the manufacturer.
Try it yourself
The first check is free: one command in your project folder, a report within 24 hours. The collector is open source, and you can see beforehand what would be sent.