arXiv:2607.22140 · v4
No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild
摘要
Software Bills of Materials (SBOMs) are read not only as inventories but as dependency graphs: vulnerability triage, reachability filtering and impact analysis traverse the edges an SBOM declares. We present the first population-scale study of the declared graph, over 78,612 SBOMs committed to public code (77,092 parseable). Of these, 52.9% omit the dependency-relationship field, although the NTIA minimum elements require it (42.3% once the 46.5% of files carrying the tool entry of a single generation harness are set aside), and a further 8.8% declare a graph in which most components are orphans, so for 61.7% a missing path says nothing about reachability. Scans of 11 large container images are all degenerate (91.4-98.0% orphans), through file entries. The format does not predict which documents these are; the producing tool does (eta^2 = 0.41-0.65), jointly with the ecosystem where a document describes one. CycloneDX completeness declarations appear in 0.10% of CycloneDX documents, and a widely used quality score separates the regimes only weakly. Reading such graphs closed-world, so that no declared path means unreachable, discards almost the whole inventory: under a production detector the median degenerate document would lose 96.4% of its components, which carry 29 version-confirmed known-exploited CVEs across 1,901 documents. Where graphs are informative, the veto touches 14 such CVEs across 164 documents, which measures its reach, not its correctness. On an 18-SBOM testbed scored with the KEV flag removed (EPSS retained), the veto suppressed 5 of 14 version-confirmed known-exploited instances, Log4Shell among them; reading silence as unknown restores them in this illustration. We release the scanner and the dataset.
作者备注：10 pages, 1 figure, 4 tables. v4 aligns this short version with the revised journal manuscript: producer attribution replaces first-tool keying, an ecosystem control replaces a per-document label, the quality score is assessed without its own dependency criterion, KEV counts are version-confirmed (the testbed is now an illustration), and a population-scale measure of the veto is added