Enhancing Visibility of Components and Dependencies Across Diverse IT Environments with Open-Source Software-Bill-of-Materials Generation Tools

This paper explores the escalating adoption of Open-Source Software (OSS) and its implications on traditional software assets inventory practices. While OSS offers undeniable benefits in terms of flexibility and cost, it also introduces complexities, especially in managing intricate dependency structures within the software supply chain. In response to this, the concept of Software Bill of Materials (SBOM) is proposed as a potential solution, aiming to bring transparency by documenting software components and dependencies. This paper presents an empirical study that evaluates the effectiveness and efficiency of a set of SBOM generation tools across diverse IT infrastructures and software inventory tools. It highlights SBOM's tools advantages, such as discovering OSS components installed without reliance on OS package managers, and providing component dependencies' information. By addressing this, we aim to deepen the understanding of SBOM's significance in modern software management practices and provide insights for optimizing SBOM generation tools usage.