Mind the Gap: How SBOM Specification Ambiguities Lead to Divergent Software Bills of Materials. An Empirical Tool Study

arXiv:2609.19920 · cs.CR, cs.SE · Submitted 2026-09-17 · Read on arXiv

cs.CR, cs.SE

Submitted: 2026-09-17

Updated: 2026-09-17

Journal ref: SCORED 2026 - Conference on Software Supply Chain Offensive Research and Ecosystem Defenses, Oct 2026, Prague, Czech Republic

Code: https://github.com/anchore/syft

License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/

Terminology

Software Bill of Materials — 10× in this paper
Provenance — 9× in this paper · explained in 3 episodes
Trace — 5× in this paper · explained in 2 episodes
Accuracy — 3× in this paper · explained in 1 episode
Benchmark — 2× in this paper · explained in 2 episodes
European Cyber Resilience Act — 2× in this paper
Software Composition Analysis — 2× in this paper
Alignment — 1× in this paper · explained in 1 episode
National Telecommunications and Information Administration — 1× in this paper
Robustness — 1× in this paper · explained in 5 episodes
Verification — 1× in this paper · explained in 2 episodes

Sources

Related papers