SBOM / SPDX support for Checkpoint products

[Matthias42]

Hi,

i am in the process of planing for a SBOM project. SBOM is about securing the supply chain for software products.

Details see here: https://www.cisa.gov/resources-tools/resources/2026-minimum-elements-software-bill-materials-sbom

Part of this is to get a list of all vendor supplied files with their checksums, to be able to do periodic (automatic) audits, identifiy patch needs, etc. That includes my Checkpoint firewalls.

This software/files/checksum info is typically in SPDX format (see https://spdx.dev/). This info is not just needed, but has to come via the software supply chain, and has to be electronically signed by the vendor, e.g. Checkpoint.

Typical RPM packages (e.g. from RHEL) satisfy this requirement: the files are listed/there, with their checksum, the whole package is signed.

However Checkpoint products seem to use unsigned RPMs! And possibly some stuff outside of RPM, directly via the installer?

Questions:

Does Checkpoint have some other method of supporting SBOM/SPDX?

If so, how? 

Why are the Checkpoint supplied RPMs not protected via a signature?

Best Regards

Matthias

On a normal RHEL, signatures are present:

# rpm -q --qf '%{NAME}-%{VERSION} %{SIGPGP:pgpsig} %{SIGGPG:pgpsig} \n' util-linux
util-linux-2.37.4 RSA/SHA256, Mo 06 Apr 2026 10:32:33 CEST, Key ID d36cb86cb86b3716 (none)

On Checkpoint servers signatures are missing:

# rpm -q --qf '%{NAME}-%{VERSION} %{SIGPGP:pgpsig} %{SIGGPG:pgpsig} \n' util-linux
util-linux-2.23.2 (not a blob) (not a blob)

# rpm -q --qf '%{NAME}-%{VERSION} %{SIGPGP:pgpsig} %{SIGGPG:pgpsig} \n' CPinfo
CPinfo-10 (not a blob) (not a blob)

# rpm -q -info CPinfo
Name : CPinfo Relocations: (not relocatable)
Version : 10 Vendor: Check Point Software Ltd.
Release : 00 Build Date: Sun Apr 21 10:28:50 2024
Install Date: Wed Oct 16 10:47:57 2024 Build Host: Lnx50BccCmp7.checkpoint.com
Group : Networking/Admin Source RPM: CPinfo-10-00.src.rpm
Size : 14934372 License: This Software is licensed to you from the Check Point Software Ltd.
Signature : (none)
Packager : Check Point Software Ltd.
URL : http://www.checkpoint.com
Summary : Check Point CPinfo
Description :
Check Point CPinfo for Linux.

# rpm -q -info CPsuite
Name : CPsuite Relocations: (not relocatable)
Version : R81.20 Vendor: Check Point Software Technologies Ltd.
Release : 00 Build Date: Wed Nov 16 12:27:02 2022
Install Date: Wed Apr 19 11:07:05 2023 Build Host: Lnx50BccCmp3.checkpoint.com
Group : Networking/Admin Source RPM: CPsuite-R81.20-00.src.rpm
Size : 1969463695 License: This Software is licensed to you from Check Point Software Technologies Ltd.
Signature : (none)
Packager : Check Point Software Technologies Ltd.
URL : http://www.checkpoint.com
Summary : Check Point R81.20.
Description :
Check Point Firewall-1(TM) and VPN-1(TM) for Linux.
The leading FireWall and VPN software for your Linux servers and embedded systems

[PhoneBoy]

This is probably an RFE and you should work with your local Check Point office to promote it.

[Matthias42]

I filled out the RFE form. Lets see what happens.

The local Checkpoint office is kind of a dead end. I've dealt with them before. They are interested in one thing only: Provisions. They ask themself: how much extra provisions do i get, if an existing customer is happy about a new feature? zero?->plonk->end of story.

My guess is, lots of customers will want this. So i will just wait until somebody else does this fight.

[Jan_Kleinhans]

If I understand it correctly the european Cyber Resilance Act will need SBOM for any digital product in december 2027. I think that checkpoint is aware of this and will provide such lists in 2027.

[Matthias42]

To my knowledge, CRA is applied to "products". That means Checkpoint has to take care of this internally for the stuff they sell. But CRA does not necessarily require Checkpoint to provide its customers this info.

However many "regulation" or "certification" bodys do require it for Checkpoints customers. E.g. Finance, Automotive, Government, NIS2?, etc.

But i am by no means an expert on the regulation rules, so my current knowledge may be wrong.