Does ST provide a software bill of materials (SBOM) for code generated by STM32CubeMX ?

[JPetr.1]

I'm using STM32F2xx, STM32F4xx, STM32F7xx and STM32L0xx firmware supplied by STM32CubeMX. I need to generate an SBOM for cybersecurity purposes. Can ST provide that or provide documentaiton that can be referenced to generate the SBOM?

[Pavel A.]

OK so now we have a nice bot-generated manifest of components in the "cube" package. The file for STM32CubeU3

In that, we can find the IDs assigned to the CMSIS, BSPs for Nucleos, original and modified ThreadX libraries.... so much. Some 3rd party commercial libraries there are "evaluation version".

Will this stuff go into a real product firmware? Else, how much this BOM is going to help? Any patch or change or your own will invalidate the manifest reference.

The only genuine component there maybe are the ST device CMSIS files.

[debugging]

https://wiki.st.com/stm32mcu/wiki/Security:Deep_dive_on_CRA

For products placed on the market (1st sales) and made available on the market (after the CRA effective date),  -  really confusing terms - those products need to complay with CRA. the would mean if you have already released project that won't change but is still sold (imports), the SBOM is needed., But there is no SBOM xml data for these products  now (i.e F4). Even the products is not Class I, II or III,  still a self assessment is required.

How to generate this SBOM from existing projects ?