在黑暗中摸索：为什么对组件的共同理解很重要
Poking Around in the Dark: Why a Shared Understanding of Components Matters
AI总结：
本文通过分析软件物料清单（SBOM）生成工具对组件的定义和识别机制，揭示了当前工具在组件覆盖和一致性上的不足，指出缺乏对组件的共同理解将导致SBOM无法保障软件供应链安全。
摘要：
通过列出应用程序中包含的组件，软件物料清单（SBOM）旨在支持及时识别易受攻击的组件并确保软件供应链的安全。然而，我们质疑其基本假设，即对SBOM中应列出的组件存在共识，并且当前技术足以保障软件供应链安全。首先，我们提出对软件开发生命周期中的组件包含机制（CIM）进行自下而上的分析。然后，我们系统分析了四种流行的SBOM生成工具：cdxgen、syft、trivy、ORT以及Microsoft的sbom-tool，以了解它们如何定义和识别相关组件。最后，我们使用跨编程语言Python、Java、Go、PHP、Rust和C的基准真值对这些工具进行评估。虽然当今的工具在识别组件方面迈出了一步，但我们的结果表明，没有工具覆盖所有已识别的CIM，并且工具之间存在共同的差距。我们证明，在当前模糊的定义和工具条件下，SBOM在组件包含方面表现出模糊性和盲点。因此，使用评估的工具无法实现安全级别的SBOM，需要进一步进展以确保软件供应链安全。我们需要回到绘图板，明确哪些组件应包含在SBOM中，并相应修订SBOM生成器。如果没有对组件是什么的共同理解，任何使用SBOM保障软件供应链安全的努力都将失败。
英文摘要：
By listing the components included in an application, Software Bills of Materials (SBOMs) are intended to support the timely identification of vulnerable components and ensure the security of the software supply chain. However, we question the underlying assumption that there is agreement on the components to be listed in an SBOM and that current technology is sufficient to secure the software supply chain. First, we propose a ground-up analysis of Component Inclusion Mechanisms (CIM) in the software's development lifecycle. Then we systematically analyze the four popular SBOM generation tools, cdxgen, syft, trivy, ORT, and the Microsoft sbom-tool, to understand how they define and identify relevant components. Finally, we assess these using a ground truth across the programming languages Python, Java, Go, PHP, Rust, and C. While today's tools are a step toward identifying components, our results show that no tool covers all identified CIMs and that common gaps exist across tools. We demonstrate that, under the current vague definitions and tooling, SBOMs exhibit ambiguity and blind spots in component inclusion. Thus, a security-grade SBOM is not achievable with the evaluated tools, necessitating further progress to ensure software supply chain security. We need to go back to the drawing board to clarify which components should be included in an SBOM and revise SBOM generators accordingly. Without a shared understanding of what a component is, any effort to secure software supply chains with SBOMs will fail.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
