HBOM tools: open-source building blocks for hardware and firmware inventory

No single open-source tool produces a complete HBOM. A small set of well-established projects, each covering one layer, can be combined into a reliable pipeline.

Think in layers, not products

An HBOM combines data from several vantage points: what the operating system can see, what the management controller reports out of band, what the firmware says about itself, and what the supplier declares. The open-source projects below each cover one of those layers. They are described as their maintainers describe them; none of them is an HBOM platform by itself.

Tool overview

dmidecode and lshw

dmidecode “reports information about your system’s hardware as described in your system BIOS according to the SMBIOS/DMI standard”, including manufacturer, model name, serial number, BIOS version and asset tag ^[1]. Its maintainers are candid about the limits: DMI data “have proven to be too unreliable to be blindly trusted” because dmidecode “does not scan your hardware, it only reports what the BIOS told it to” ^[1]. Treat it as a declaration, not proof.

lshw reports “exact memory configuration, firmware version, mainboard configuration, CPU version and speed, cache configuration, bus speed”, drawing on DMI, PCI, USB, SCSI and other sources, and can output plain text, XML or HTML ^[2]. Because it walks several buses, it can surface components that DMI tables omit.

fwupd and the LVFS

fwupd is “a system daemon to allow session software to update firmware” on Linux; fwupdmgr get-devices displays “all devices detected by fwupd” along with their firmware details ^[3]. The Linux Vendor Firmware Service is the portal through which hardware vendors upload firmware updates, run as a Series of LF Projects ^[4]. For HBOM purposes, fwupd is a practical source of device firmware versions on Linux endpoints and servers.

DMTF Redfish

Redfish is DMTF’s standard for “simple and secure management for converged, hybrid IT and the Software Defined Data Center” ^[5]. Its update service exposes two collections: FirmwareInventory, which contains platform firmware that does not execute within a host operating system, and SoftwareInventory, for components that execute in the host context such as drivers ^[6]. Entries carry properties including version, manufacturer, release date and related hardware resources, which map well to HBOM fields. Because Redfish works out of band, it can inventory servers without an agent in the host OS.

CHIPSEC

CHIPSEC is “a framework for analyzing the security of PC platforms including hardware, system firmware (BIOS/UEFI), and platform components”, running on Windows, Linux and the UEFI shell ^[7]. It answers a different question from the inventory tools (is this platform configured securely?) and its maintainers state it is “for security testing purposes. Use at your own risk” ^[7]. Use it in a lab or on representative samples, not as a fleet inventory agent.

uSWID and CycloneDX CLI

uSWID is “a tiny tool for embedding CoSWID tags in EFI binaries”, supporting PE, FIT and other firmware images and exporting to CycloneDX and SPDX ^[8]. It helps firmware producers ship SBOM metadata inside the image. The CycloneDX CLI provides validate, diff, merge, convert and signing commands ^[9], which cover the plumbing once hardware data is expressed as CycloneDX.

Putting them together

1. Use Redfish for servers with BMCs and fwupd, lshw or dmidecode for in-band detail.
2. Normalise the output into CycloneDX device and firmware components (see CycloneDX for hardware BOMs).
3. Validate and diff with CycloneDX CLI; use CHIPSEC for sampled integrity checks.
4. Reconcile against supplier HBOMs, as described in HBOM generation.

How IntelliXBOM helps

IntelliXBOM ingests CycloneDX and SPDX output from collection pipelines such as these, validates it against required-field policies and keeps version history and diffs. It correlates the resulting hardware and firmware inventory with vulnerabilities, EOL data and business services, and maps it to framework controls as evidence.