← 研踪 PaperTrailarXiv:2512.21781 · v3
The State of SBOM Tools: A Comparative Analysis of SPDX and CycloneDX
首次提交 2025-12-26 04:50
版本更新 2026-11-08 18:14
雷达观测 2026-11-10 12:16
摘要
A Software Bill of Materials (SBOM) provides transparency and accountability for software releases by documenting component metadata and dependencies, making it essential to modern development. Adoption and utility depend heavily on tools that generate, analyze, and manage SBOMs. SPDX and CycloneDX are the two leading formats, but tools supporting them differ in maturity, features, and community engagement. Understanding these differences is vital to improving SBOM practices. We quantitatively compare use cases for 108 open-source and 62 proprietary tools advertised for SPDX and CycloneDX, identifying feature gaps. We compare community-health metrics of OSS tool repositories on GitHub (145 CycloneDX and 456 SPDX observations, 573 distinct repositories). We analyze 26,853 issue reports since 2018 from these repositories, categorizing 26,772 using an LLM-assisted approach calibrated against manual annotations. We also compare community-health metrics of the top 250 OSS projects using CycloneDX tools versus the top 250 using SPDX tools. Findings reveal distinct characteristics: CycloneDX projects show higher developer engagement and certain community-health metrics, while SPDX has more OSS tool repositories. This research provides insights for developers, contributors, and practitioners on complementary strengths and opportunities for mutual enhancement across both formats.
作者备注：https://sailresearch.github.io/26-ali-sbom-emse
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v3 · 2026-11-08 18:14 · 最新观测版本
The State of SBOM Tools: A Comparative Analysis of SPDX and CycloneDX
A Software Bill of Materials (SBOM) provides transparency and accountability for software releases by documenting component metadata and dependencies, making it essential to modern development. Adoption and utility depend heavily on tools that generate, analyze, and manage SBOMs. SPDX and CycloneDX are the two leading formats, but tools supporting them differ in maturity, features, and community engagement. Understanding these differences is vital to improving SBOM practices. We quantitatively compare use cases for 108 open-source and 62 proprietary tools advertised for SPDX and CycloneDX, identifying feature gaps. We compare community-health metrics of OSS tool repositories on GitHub (145 CycloneDX and 456 SPDX observations, 573 distinct repositories). We analyze 26,853 issue reports since 2018 from these repositories, categorizing 26,772 using an LLM-assisted approach calibrated against manual annotations. We also compare community-health metrics of the top 250 OSS projects using CycloneDX tools versus the top 250 using SPDX tools. Findings reveal distinct characteristics: CycloneDX projects show higher developer engagement and certain community-health metrics, while SPDX has more OSS tool repositories. This research provides insights for developers, contributors, and practitioners on complementary strengths and opportunities for mutual enhancement across both formats.
查看此版本解读 →查看此版本原文 ↗