Challenges of Producing Software Bill of Materials for Java
Authors:
- Musard BalliuMBMusard Balliu
- Benoit BaudryBBBenoit Baudry
- Sofia BobadillaSBSofia Bobadilla
- Mathias EkstedtMEMathias Ekstedt
- Martin MonperrusMMMartin Monperrus
- Javier RonJRJavier Ron
- Aman SharmaASAman Sharma
- Gabriel SkoglundGSGabriel Skoglund
- César Soto-ValeroCSCésar Soto-Valero
- Martin WittlingerMWMartin Wittlinger
- 31 August 2023
- journal article
- research article
- Published by Institute of Electrical and Electronics Engineers (IEEE) in IEEE Security & Privacy
- Vol. 21 (6) , 12-23
Abstract
Software bills of materials (SBOM) promise to become the backbone of software supply chain hardening. We deep-dive into six tools and the SBOMs they produce for complex open source Java projects, revealing challenges regarding the accurate production and usage of SBOMS.Keywords
All Related Versions
This publication has 11 references indexed in Scilit:
- An Empirical Study on Software Bill of Materials: Where We Stand and the Road Ahead2023
- The Multibillion Dollar Software Supply Chain of EthereumComputer, 2022
- What are weak links in the npm supply chain?2022
- The Ghost Commit Problem When Identifying Fix-Inducing Changes: An Empirical Study of Apache ProjectsIEEE Transactions on Software Engineering, 2021
- Technical Leverage: Dependencies Are a Mixed BlessingIEEE Security & Privacy, 2021
- A comprehensive study of bloated dependencies in the Maven ecosystemEmpirical Software Engineering, 2021
- Software reuse cuts both ways: An empirical analysis of its relationship with security vulnerabilitiesJournal of Systems and Software, 2021
- Readiness model for DevOps implementation in software organizationsJournal of Software: Evolution and Process, 2020
- Managing Your Open Source Supply Chain-Why and How?Computer, 2020
- Surviving software dependenciesCommunications of the ACM, 2019