Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
The paper introduces sbom-unifier, a framework designed to enhance the completeness of Software Bills of Materials (SBOMs) by integrating outputs from multiple generation tools and enriching them at the file level. This approach addresses the common issue of incomplete or partially populated fields in existing SBOMs, which can hinder effective vulnerability management and license compliance. By applying a deterministic priority-based strategy to identify and complement missing values, sbom-unifier improves the fully covered rate of required fields by 8 percentage points and reduces the total missing rate by 11 percentage points across a diverse set of 90 open-source projects.
sbom-unifier boosts SBOM completeness significantly, making it a game-changer for vulnerability management and compliance in software development.
A Software Bill of Materials (SBOM) is a machine-readable inventory of software components, increasingly required for vulnerability management and license compliance. However, existing SBOM generation tools often leave many SPDX-defined fields missing or only partially populated, because different tools produce heterogeneous outputs with uneven field-level coverage. We present sbom-unifier, a framework that improves SBOM completeness through field-level integration and complementation of multiple tool outputs and file-level enrichment. Unlike existing tools that simply concatenate SBOMs without identifying records referring to the same component, sbom-unifier identifies components via Package URL (PURL), complements missing field values by a deterministic priority-based strategy, reconstructs cross-section references, and further enriches file-level fields. Across 90 open-source projects in 9 programming languages, sbom-unifier preserves high completeness for required fields and, over the 39 SPDX 2.3 required and optional fields, raises the fully covered rate by 8 percentage points and reduces the totally missing rate by 11 percentage points over the respective best-performing individual tools. sbom-unifier is available at https://github.com/MoriwakiYusuke/sbom-unifier.