Policy-driven Software Bill of Materials on GitHub: An Empirical Study

2025-09-01

AI Summary

This study investigates the real-world security practices of policy-driven Software Bill of Materials (SBOM) in open-source projects—i.e., SBOMs intentionally generated to achieve security objectives such as transparency and compliance, excluding incidental, benchmarking, or academically generated instances. Method: Leveraging software repository mining and descriptive statistical analysis, we examine SBOMs and their dependencies across popular GitHub repositories. Contribution/Results: We find that only 0.56% of highly starred repositories deploy policy-driven SBOMs, revealing severe adoption lag. Our analysis of 2,202 unique CVEs and license metadata shows critical gaps: SBOM coverage is low, vulnerability traceability remains incomplete, and 22% of dependencies lack declared licenses. This work provides the first empirical evidence of SBOM quality bottlenecks and governance gaps in actual supply-chain security practice, offering actionable data to inform policy development and tool deployment.

Technology Category

• Constraint Satisfaction and Optimization: Solvers and Tools
• Application Domains: Security
• Search and Optimization: Combinatorial Optimization

Application Category

• Security and Privacy: Data transparency and provenance
• Web Mining and Content Analysis: Web data provenance, reliability, and authenticity
• Responsible Web: Consent frameworks and practices on the web

Abstract

Background. The Software Bill of Materials (SBOM) is a machine-readable list of all the software dependencies included in a software. SBOM emerged as way to assist securing the software supply chain. However, despite mandates from governments to use SBOM, research on this artifact is still in its early stages. Aims. We want to understand the current state of SBOM in open-source projects, focusing specifically on policy-driven SBOMs, i.e., SBOM created to achieve security goals, such as enhancing project transparency and ensuring compliance, rather than being used as fixtures for tools or artificially generated for benchmarking or academic research purposes. Method. We performed a mining software repository study to collect and carefully select SBOM files hosted on GitHub. We analyzed the information reported in policy-driven SBOMs and the vulnerabilities associated with the declared dependencies by means of descriptive statistics. Results. We show that only 0.56% of popular GitHub repositories contain policy-driven SBOM. The declared dependencies contain 2,202 unique vulnerabilities, while 22% of them do not report licensing information. Conclusion. Our findings provide insights for SBOM usage to support security assessment and licensing.

Problem

• Analyzing policy-driven SBOM adoption in open-source GitHub projects
• Investigating security vulnerabilities within declared software dependencies
• Assessing licensing compliance gaps in software bill of materials

Innovation

• Empirical study of policy-driven SBOMs
• Mining software repositories on GitHub
• Analyzing vulnerabilities and licensing information