SBOM

One common approach to help manage security in the software supply chain is the use of an SBOM. An SBOM is simply described as an inventory list of software components in a software package. An analogy for an SBOM is a list of ingredients for a processed food package that describes the contents. SBOMs are valuable for managing the software supply chain and are described in further detail as follows.

SBOM formats

There are various formats that can be used to express SBOMs. Some common formats include Software Package Data Exchange (SPDX) [8] and CycloneDX [9]. In its simplest form, an SBOM is nothing more than a JavaScript Object Notation (JSON) file. However, what types of fields and contents that are supposed to be included are defined by the SBOM format.

Please also note that there are different versions of the SBOM formats of SPDX and CycloneDX. Version 2.3 of SPDX is also defined as an ISO standard, namely ISO/IEC 5962:2021 [10]. The latest version at the time of...