SIT: An Accurate, Compliant SBOM Generator with Incremental Construction

SBOM (Software Bill of Materials) is a comprehensive list of components, relationships and metadata associated with software, essential for ensuring software component transparency in the software supply chain. The complexity of SBOM and the massive workload of writing SBOMs call for the assistance of automation. However, existing automated tools excessively rely on parsing dependency manifest and source code without verifying the accuracy of the information. Worse, existing SBOM generators sometimes fail to yield a specification-compliant SBOM. Additionally, existing SBOM generators can not compose a complete SBOM with information that developers know best and entries hidden in the dependencies' metadata in one go. To address the inaccuracy, non-compliance and incompleteness issues of SBOM generation, we propose SIT, an accurate, compliant SBOM generator with incremental construction. Through incremental construction, SIT aggregates manually maintained SBOMs and dependency SBOMs and exports SBOMs for editing, enhancing the correctness and completeness of SBOMs. This capability is built on SBOM IR, a flexible intermediate format that consolidates essential information and acts as a bridge for software representations. By integrating SBOM IR with official SBOM JSON schemas, SIT ensures all generated SBOMs are compliant to SBOM specifications. Additionally, SIT enhances SBOM accuracy with cross-validation, resolving inconsistencies with the real environment. SIT is publicly available at https://github.com/osslab-pku/SIT, and a demonstration video can be found at https://youtu.be/LbzslijVPLc.