Trusted-SBOM: On the Critical Importance of Verifying SBOMs
summary
Defines concrete metrics SBOM correctness (packages declared that appear in the binary) and SBOM completeness (files in the binary whose provenance is traced), implements an automated verifier that extracts package files and matches them to binaries and a semi‑automated provenance flow using heuristics plus large code provenance databases like Word of Code and Software Heritage, measures 100 Java projects and finds median correctness ≈0.31 (class‑file check 0.07) and median completeness ≈0.65, shows concrete cases (one project 0.27 correctness, JUnit 1.8.2 completeness 0.97, log4j zero matches), and proposes SBOM quality metrics, verification tools and a community “stamp” for attested SBOMs.
AI-written summary · about
chapters (7)
- 0:00Start
- 4:36How do we define the quality of an SBOM?
- 6:37A concrete case of verifying SBOM correctness
- 8:39A concrete case of verifying SBOM completeness
- 11:12Approach to verify SBOM correctness
- 12:00Approach to verify SBOM completeness
- 14:07SBOM Correctness is low in real world
related talks
34mSBOM Quality: We Need More Than a Simple “SBOM Button” for Compliance
39mTrust but Verify: Uncovering the Hidden Risks of Inaccurate SBOMs With J...
41mYour SBOM Is Lying To You – Let’s Make It Honest
32mSBOMit: Making SBOMs Accurate With Attestations
45mSmarter Than Your Average SBOM!
26mSBOM X-Ray Superpowers: Making Better SBOMs, Using SBOMs- 45mSmarter Than Your Average SBOM!
37mSBOMs Aren't Enough. Secure Your Software Supply Chain End-To-End