An STM32L073 project with vendored FreeRTOS, lwIP, FatFs, mbedTLS and libmodbus. No manifest, no rebuild, no network calls.
Toolchain-native, top to bottom
lynkctl names what it reads: GNU Make, CMake, and IAR Embedded Workbench at the build-system layer, and underneath, the actual gcc, clang, ld, iccarm, and ilink invocations they emit. Not a generic source scanner.
GNU Make
Makefile-driven C/C++ projects.
CMake
Generates Make, Ninja, or IDE projects from CMakeLists.txt.
IAR Embedded Workbench
Proprietary embedded IDE and toolchain; .ewp project files.
TI Code Composer Studio
Code Composer Studio for TI MCUs.
Keil µVision
ARM Cortex-M development environment.
MSBuild / WDK
IN THE WORKS
Windows driver projects built with Visual Studio and the WDK.
Eclipse
IN THE WORKS
Eclipse CDT-based embedded IDEs.
TASKING
IN THE WORKS
Automotive toolchain for AURIX and RH850.
gcc
Compiler · GNU
clang
Compiler · LLVM frontend
LLVM
Compiler infra · underlies Clang
ld
Linker · GNU
iccarm
Compiler · IAR for ARM
ilink / ilinkarm
Linker · IAR
Git
Component origin from .git repositories.
Git submodules
Submodule pointers resolved to upstream sources with commit pinning.
SVN
IN THE WORKS
Subversion repositories.
STM32
STMicroelectronics STM32 microcontrollers.
Infineon
Infineon PSOC and XMC microcontrollers.
NXP
NXP microcontroller families.
Nordic
IN THE WORKS
Wireless SoCs and microcontrollers.
Renesas
IN THE WORKS
Renesas microcontroller families.
Silicon Labs
IN THE WORKS
Silicon Labs wireless SoCs and microcontrollers.
Infineon AURIX
IN THE WORKS
Automotive safety MCUs.
vcpkg
IN THE WORKS
C/C++ package management.
Conan
IN THE WORKS
C and C++ package management.
FDA · 524B
Medical devices
FDA premarket submissions now require an SBOM under section 524B. lynkctl produces CycloneDX output with the evidence trail an auditor expects, and runs entirely on-premises so device firmware never leaves your build environment.
EU · CRA
Industrial & consumer
The EU Cyber Resilience Act requires manufacturers to maintain an SBOM across the supported lifecycle of every product. lynkctl's deterministic output and confidence scoring make CRA Annex I evidence reviewable, not just present.
ISO/SAE 21434 · UN R155
Automotive
Tier-1 and OEM suppliers face SBOM requirements down to the ECU. lynkctl’s IAR and CMake providers cover the toolchains most automotive embedded teams already use, without rewriting the build. TASKING support for AURIX and RH850 is in the works.
Source SCA tools fall into one of the three failure modes described above. Binary analysis is a different lane entirely, useful for opaque firmware, no help when you control the source. lynkctl is the fourth path: post-build, build-system-aware, no rebuild required. (How to judge firmware SBOM accuracy across these approaches →)
FDA · 524B
Want to do it yourself? We have an open-source option too.
Not every codebase fits a build-time introspector. Maybe your build system is exotic. Maybe most of your components are vendored, patched, or hand-stitched from upstream sources. Maybe you just want full editorial control over what ends up in the SBOM, without a commercial license in the loop.
bomtique is our open-source toolkit for hand-authored SBOMs. You write a small, reviewable manifest of your components; bomtique emits a deterministic CycloneDX or SPDX SBOM from it. Same reviewable evidence mindset as lynkctl, same air-gapped runtime, completely under your control. Apache 2.0, on GitHub.
lynkctl
COMMERCIAL
SBOM generator for embedded C/C++ toolchains. This page.
bomtique
OSS
Hand-authored SBOMs for projects where introspection won't fit.
sbomqs
OSS
SBOM quality scoring: verify what you produce.
sbomasm
OSS
Assemble multi-component SBOMs across products.
Why is generating an SBOM for C/C++ so hard?
C and C++ have no standard dependency manifest like package.json or go.mod. Components are vendored into the source tree, pulled through git submodules, or fetched by ad-hoc scripts, so no two projects look alike and generic tools miss most of the tree.