topic Re: SBOM / SPDX support for Checkpoint products in General Topics

SBOM / SPDX support for Checkpoint products

Matthias42 — Thu, 30 Jul 2026 08:19:53 GMT

Hi,

i am in the process of planing for a SBOM project. SBOM is about securing the supply chain for software products.

Details see here: https://www.cisa.gov/resources-tools/resources/2026-minimum-elements-software-bill-materials-sbom

Part of this is to get a list of all vendor supplied files with their checksums, to be able to do periodic (automatic) audits, identifiy patch needs, etc. That includes my Checkpoint firewalls.

This software/files/checksum info is typically in SPDX format (see https://spdx.dev/). This info is not just needed, but has to come via the software supply chain, and has to be electronically signed by the vendor, e.g. Checkpoint.

Typical RPM packages (e.g. from RHEL) satisfy this requirement: the files are listed/there, with their checksum, the whole package is signed.

However Checkpoint products seem to use unsigned RPMs! And possibly some stuff outside of RPM, directly via the installer?

Questions:

Does Checkpoint have some other method of supporting SBOM/SPDX?

If so, how?

Why are the Checkpoint supplied RPMs not protected via a signature?

Best Regards

Matthias

On a normal RHEL, signatures are present:

# rpm -q --qf '%{NAME}-%{VERSION} %{SIGPGP:pgpsig} %{SIGGPG:pgpsig} \n' util-linux
util-linux-2.37.4 RSA/SHA256, Mo 06 Apr 2026 10:32:33 CEST, Key ID d36cb86cb86b3716 (none)

On Checkpoint servers signatures are missing:

# rpm -q --qf '%{NAME}-%{VERSION} %{SIGPGP:pgpsig} %{SIGGPG:pgpsig} \n' util-linux
util-linux-2.23.2 (not a blob) (not a blob)

# rpm -q --qf '%{NAME}-%{VERSION} %{SIGPGP:pgpsig} %{SIGGPG:pgpsig} \n' CPinfo
CPinfo-10 (not a blob) (not a blob)

# rpm -q -info CPinfo
Name : CPinfo Relocations: (not relocatable)
Version : 10 Vendor: Check Point Software Ltd.
Release : 00 Build Date: Sun Apr 21 10:28:50 2024
Install Date: Wed Oct 16 10:47:57 2024 Build Host: Lnx50BccCmp7.checkpoint.com
Group : Networking/Admin Source RPM: CPinfo-10-00.src.rpm
Size : 14934372 License: This Software is licensed to you from the Check Point Software Ltd.
Signature : (none)
Packager : Check Point Software Ltd.
URL : http://www.checkpoint.com
Summary : Check Point CPinfo
Description :
Check Point CPinfo for Linux.

# rpm -q -info CPsuite
Name : CPsuite Relocations: (not relocatable)
Version : R81.20 Vendor: Check Point Software Technologies Ltd.
Release : 00 Build Date: Wed Nov 16 12:27:02 2022
Install Date: Wed Apr 19 11:07:05 2023 Build Host: Lnx50BccCmp3.checkpoint.com
Group : Networking/Admin Source RPM: CPsuite-R81.20-00.src.rpm
Size : 1969463695 License: This Software is licensed to you from Check Point Software Technologies Ltd.
Signature : (none)
Packager : Check Point Software Technologies Ltd.
URL : http://www.checkpoint.com
Summary : Check Point R81.20.
Description :
Check Point Firewall-1(TM) and VPN-1(TM) for Linux.
The leading FireWall and VPN software for your Linux servers and embedded systems

Re: SBOM / SPDX support for Checkpoint products

PhoneBoy — Thu, 30 Jul 2026 13:41:25 GMT

This is probably an RFE and you should work with your local Check Point office to promote it.

Re: SBOM / SPDX support for Checkpoint products

Matthias42 — Fri, 31 Jul 2026 06:32:38 GMT

I filled out the RFE form. Lets see what happens.

The local Checkpoint office is kind of a dead end. I've dealt with them before. They are interested in one thing only: Provisions. They ask themself: how much extra provisions do i get, if an existing customer is happy about a new feature? zero?->plonk->end of story.

My guess is, lots of customers will want this. So i will just wait until somebody else does this fight.

Re: SBOM / SPDX support for Checkpoint products

Jan_Kleinhans — Fri, 31 Jul 2026 09:41:01 GMT

If I understand it correctly the european Cyber Resilance Act will need SBOM for any digital product in december 2027. I think that checkpoint is aware of this and will provide such lists in 2027.

Re: SBOM / SPDX support for Checkpoint products

Matthias42 — Fri, 31 Jul 2026 10:28:25 GMT

To my knowledge, CRA is applied to "products". That means Checkpoint has to take care of this internally for the stuff they sell. But CRA does not necessarily require Checkpoint to provide its customers this info.

However many "regulation" or "certification" bodys do require it for Checkpoints customers. E.g. Finance, Automotive, Government, NIS2?, etc.

But i am by no means an expert on the regulation rules, so my current knowledge may be wrong.