超越合规性：关于GitHub软件物料清单完整性和一致性的大规模研究
Beyond Compliance: A Large Scale Study on the Completeness and Consistency of the GitHub SBOMs
AI总结：
研究针对GitHub软件物料清单（SBOMs）展开，通过对10000个跨十种编程语言生态系统的GitHub仓库分析，对比其他工具，发现GitHub SBOMs存在问题，组件版本和许可信息依赖生态系统，还讨论了其潜在不足。
摘要：
现代软件开发严重依赖开源组件，SBOMs提高供应链透明度。GitHub自动生成SBOMs，但能否用于漏洞和许可分析不明。为此对10000个GitHub仓库进行大规模分析，对比其他工具，发现GitHub SBOMs缺乏NTIA合规性，组件版本和许可信息因生态系统而异，还讨论了相关不足。
英文摘要：
Modern software development relies heavily on open-source components. Reusing components accelerates innovation but increases exposure to supply-chain attacks exploiting known vulnerabilities. Software Bills of Materials (SBOMs) improve software supply chain transparency by enumerating components, their versions, and their provenance. GitHub, the largest open-source development hosting platform, now automatically generates SBOMs for repositories, providing valuable metadata for risk assessment. Yet, it is unclear whether GitHub SBOMs can serve as a reliable source for vulnerability and license analysis, and how incomplete or inconsistent metadata may affect different programming ecosystems. To address this, we conduct a large-scale analysis of 10,000 GitHub repositories across ten programming language ecosystems, evaluating GitHub SBOMs against three other popular SBOM generators: Syft, Trivy, and the Microsoft SBOM Tool. Our study finds a lack of NTIA compliance in GitHub SBOMs, though core metadata is consistently present. We also find that component version and license information availability is highly dependent on the programming ecosystem. Compared with the other three tools, GitHub yields results similar to the Microsoft SBOM Tool and often outperforms Syft and Trivy in providing version and license information. Finally, we discuss potential shortcomings of the GitHub SBOM Tool, directly related to how each ecosystem manages its dependencies.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
