Firmware release SBOM comparison
Baseline: harbor-gateway-hg100-1.4.2.cdx.json (15 components). New release: harbor-gateway-hg100-1.4.3.cdx.json (15 components). Generated at build time by the same comparison the tool runs locally.
Added
2
in the new release only
Removed
2
in the baseline only
Updated
2
same identity, new version
Unchanged
11
same identity and version
Every row the engine produced
| Change | Component | Baseline version | New version | Matched by |
|---|---|---|---|---|
| added | libmodbus | — | 3.1.10 | purl |
| added | lwip | — | 2.1.3 | purl |
| removed | lwip | unknown | — | purl |
| removed | vendor-bootloader | — | — | fallback |
| updated | @harbor/agent | 2.4.1 | 2.5.0 | purl |
| updated | libcurl | 8.4.0 | 8.5.0 | purl |
| unchanged | @harbor/ui-bundle | latest | latest | purl |
| unchanged | busybox | 1.36.1 | 1.36.1 | purl |
| unchanged | cJSON | 1.7.18 | 1.7.18 | purl |
| unchanged | dropbear | 2022.83 | 2022.83 | purl |
| unchanged | harbor-radio-fw | 1.2.0 | 1.2.0 | fallback |
| unchanged | harbor-telemetry | 1.9.0 | 1.9.0 | purl |
| unchanged | mbedtls | 2.28.8 | 2.28.8 | purl |
| unchanged | openssl | 3.0.13 | 3.0.13 | purl |
| unchanged | openssl-libcrypto | 3.0.13 | 3.0.13 | purl |
| unchanged | sqlite | 3.44.0 | 3.44.0 | purl |
| unchanged | zlib | 1.3.1 | 1.3.1 | purl |
17 rows · 0 duplicate identity+version occurrence(s) collapsed.
Read the removals carefully. The vendor bootloader disappears from the 1.4.3 declaration. That is more likely an under-declaration than a real removal, and it is exactly the kind of change a reviewer should catch before signing the release.
What this comparison does not tell you
- Whether the updated libcurl version is affected by any advisory.
- Whether the firmware image matches either SBOM.
- Whether the release was authorised, signed or shipped.
- Whether the new component is vulnerable, licensed correctly, or even needed.
How to compare firmware SBOM versions covers the interpretation method, including how identity changes create false add/remove pairs.