Pith. sign in

REVIEW 2 cited by

SBOM Generation Tools in the Python Ecosystem: an In-Detail Analysis

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2409.01214 v1 pith:DRLSQG73 submitted 2024-09-02 cs.CR cs.SE

Serena Cofano , Giacomo Benedetti , Matteo Dell'Amico This is my paper · ORCID
classification cs.CRcs.SE
keywords sbomecosystemsoftwarefilesgenerationmetadatatoolsanalysis
verification ladder T0 review T1 audit T2 compute T3 formal

Signed reviews

No signed human review yet.

0 comments
read the original abstract

Software Bills of Material (SBOMs), which improve transparency by listing the components constituting software, are a key countermeasure to the mounting problem of Software Supply Chain attacks. SBOM generation tools take project source files and provide an SBOM as output, interacting with the software ecosystem. While SBOMs are a substantial improvement for security practitioners, providing a complete and correct SBOM is still an open problem. This paper investigates the causes of the issues affecting SBOM completeness and correctness, focusing on the PyPI ecosystem. We analyze four popular SBOM generation tools using the CycloneDX standard. Our analysis highlights issues related to dependency versions, metadata files, remote dependencies, and optional dependencies. Additionally, we identified a systematic issue with the lack of standards for metadata in the PyPI ecosystem. This includes inconsistencies in the presence of metadata files as well as variations in how their content is formatted.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Package Managers \`a la Carte: A Formal Model of Dependency Resolution

    cs.PL 2026-02 reject novelty 6.0 of 10

    A core calculus for dependency resolution is proposed with reductions from package-manager extensions, aiming to enable cross-ecosystem dependency translation.

  2. Solving Package Management via Hypergraph Dependency Resolution

    cs.SE 2025-06 conditional novelty 5.0 of 10

    A hypergraph formalism with three edge types encodes package dependencies, conflicts, and optional deps, and a SAT-based solve can in principle span many package ecosystems in one pass.

Pith tools