[sdv-wg] Safety Relevance Metadata for Automotive / Functional-Safety SB

[Devashri Datta <devashri.datta@xxxxxxxxx>]

Hello Eclipse SDV community,

I recently saw the Eclipse Technical Advisory Council discussion noting an open question around how Eclipse can integrate Safety Relevance Metadata into automotive and functional-safety SBOMs.

I have been working on this exact topic through SRAP/SRIL safety relevance metadata work, including related public discussions and proposals across OpenChain Automotive, SPDX, CycloneDX, and OpenSSF SBOM communities.

I also sent a short note to the Eclipse EMO / Security Team, but wanted to raise this here as well because Eclipse SDV seems like the most relevant community context.

Would there be interest in a concise public proposal or discussion note on how Safety Relevance Metadata could be represented in functional-safety SBOM guidance for Eclipse SDV projects?

Relevant public references:

• OpenChain Automotive discussion: https://github.com/OpenChain-Project/Automotive-Open-Source-Governance-Monthly/discussions/2
• CycloneDX safety relevance proposal: https://github.com/CycloneDX/specification/issues/954
• SPDX safety/risk annotation feedback: https://github.com/spdx/spdx-spec/issues/1354
• SPDX 3.1-dev SafetyContextRelationship: https://spdx.github.io/spdx-spec/v3.1-dev/model/FunctionalSafety/Classes/SafetyContextRelationship/

I would be happy to contribute a short draft, example metadata fields, or an issue/PR if there is a preferred Eclipse SDV repository or guidance area.

Regards,
Devashri Datta