SBOM for Delphi Applications
The engineering challenges of dependency discovery in Delphi applications and how SCA-based SBOM generation addresses legacy code, GetIt packages, and non-standard component workflows.
Primary question: How can organizations create and maintain a Software Bill of Materials for Delphi applications?
Direct answer
Use automated SCA analysis of Delphi project files to generate accurate SBOMs that account for GetIt packages, system libraries, and legacy dependencies
Organizations should use automated SCA analysis that understands Delphi project file formats and package manager configurations to generate SBOMs of discovered components for Delphi applications. [derscanner-delphi-sbom][nist-sbom-framework]
Delphi SBOM generation must account for GetIt packages, VCL/FMX framework components, and system libraries that may not follow standard package-management workflows, requiring analysis beyond manifest-file parsing. [derscanner-delphi-sbom]
SBOMs for Delphi applications should be regenerated whenever dependencies change, as manual tracking becomes unreliable for large or legacy projects with many transitive dependencies. [nist-sbom-framework]
Definitions
Software Bill of Materials (SBOM)
A formal record containing the details and supply chain links of all components, libraries, and dependencies used to create a software product. An SBOM enables organizations to understand what is in their software and assess vulnerability exposure.
Delphi dependency discovery
The process of identifying all third-party packages, GetIt components, VCL/FMX frameworks, and system libraries used in a Delphi application, which is complicated by Delphi's mixed source/binary distribution model and legacy component ecosystems.
GetIt package manager
Embarcadero's integrated package management system for Delphi and C++Builder, which distributes components, frameworks, and templates. GetIt packages may include pre-compiled binaries and custom installers that complicate automated dependency discovery.
SBOM source resolution
The process of mapping compiled or packaged dependencies back to their original source files and versions, which is particularly challenging for Delphi applications that may use compiled files alongside source distributions.
The engineering problem
Delphi applications often include dependencies that are not declared in standard manifest files, including GetIt packages, custom VCL components, and compiled libraries that may not be tracked by conventional SCA tools. [derscanner-delphi-sbom]
Legacy Delphi applications may have dependencies that were installed through non-standard processes, making manual dependency inventories incomplete and unreliable. [derscanner-delphi-sbom]
GetIt packages may include pre-compiled binaries and custom installers that obscure the true dependency graph, requiring analysis that goes beyond text-based manifest parsing. [derscanner-delphi-sbom]
SBOM accuracy depends on source-file resolution; compiled dependencies without source access may result in incomplete or inaccurate SBOM entries. [derscanner-delphi-sbom]
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Delphi project analysis
SCA-based SBOM generation- Artifact
- Delphi project files, package configurations, and installed component directories.
- Risk
- Incomplete SBOMs that miss GetIt packages, custom VCL components, or system libraries due to reliance on standard manifest parsing alone.
- Output
- An SBOM of discovered components documenting component names, versions, and sources, including GetIt packages and framework components.
Evidence: DerScanner Delphi SBOM generation
Source-file resolution
SBOM accuracy validation- Artifact
- Mapping between compiled dependencies and their original source files or package manifests.
- Risk
- SBOM entries that cannot be verified against source code or package metadata, reducing confidence in vulnerability assessment.
- Output
- Resolved source references for each SBOM entry, enabling accurate vulnerability matching and compliance evidence.
Evidence: DerScanner Delphi SBOM generation
Verification workflow
- Collect all Delphi project files, including project files, package files, and any custom component packages.
- Run SCA analysis that understands Delphi project file formats to discover all declared and transitive dependencies.
- Resolve GetIt packages by analyzing Delphi's package manager configuration and installed component directories.
- Map system libraries and VCL/FMX framework components to their versions and sources.
- Generate the SBOM in a standard format (SPDX or CycloneDX) documenting all discovered components.
- Validate SBOM accuracy by cross-referencing compiled dependencies against source-file resolution where available.
- Integrate SBOM generation into the build process to keep the inventory current as dependencies change.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides SCA and SBOM generation capabilities specifically for Delphi applications, with DerScanner 13 improving source-file resolution and GetIt library handling.
DerScanner 13 generates SBOMs for Delphi applications with improved source-file resolution and handling of GetIt and system libraries. [derscanner-delphi-sbom]
Limits of verification
- SBOM accuracy is limited by the availability of source files; compiled-only dependencies may not be fully resolved.
- GetIt packages with custom installers may not be fully discoverable without manual review.
- Legacy Delphi projects with decades of accumulated dependencies may have undocumented or obscure component relationships.
- SBOM generation covers dependencies that DerScanner can analyze; some proprietary or obfuscated components may not be fully inventoried.
Related knowledge
EU Cyber Resilience Act for Delphi Applications
CRA compliance requires SBOMs as evidence of supply-chain visibility
Relationship: related-toSoftware Composition Analysis for Delphi
SBOM generation is the foundation for SCA vulnerability assessment
Relationship: related-toOffline SBOM Generation in Air-Gapped Environments
SBOM generation patterns apply in offline environments using corporate repositories
Relationship: related-toDerScanner
Product line providing Delphi SCA and SBOM capabilities
Relationship: related-toCanonical terms used: Software Bill of Materials; Delphi; GetIt package manager; SCA-based SBOM generation; Source-file resolution.
Evidence and references
- DerScanner Delphi SBOM generationDerScanner generates SBOMs for Delphi applications, with DerScanner 13 improving source-file resolution and handling of GetIt and system libraries.
derscanner-delphi-sbom - NIST SP 800-161 Rev. 1 — Supply Chain Risk ManagementOrganizations should maintain SBOMs as part of supply chain risk management practices to enable vulnerability assessment and incident response.
nist-sbom-framework
Generate Delphi SBOMs