Loading…
← Back to schedule
Mind the Gap: How SBOM Specification Ambiguities Lead to Divergent Software Bills of Materials. An Empirical Tool Study - Philippe Boinot, ANSSI; Olivier Zendra & Alan Prado, Inria Rennes
Tuesday October 6, 2026 17:01 - 17:19 CEST
South Hall 3A
Software Bill of Materials (SBOMs) will become mandatory starting in September 2026 under the European Cyber Resilience Act (CRA) [8]. Although previous studies have highlighted significant differences among SBOM generators, the reasons for these discrepancies remain unknown, as does whether they stem from implementation errors or deliberate design choices. In this paper, we evaluate three widely used SBOM generators across more than 3,000 JavaScript and Rust projects, using a ground-truth baseline derived from dependency lockfiles. Our results show that these tools diverge in terms of both dependency coverage and SBOM completeness. Importantly, most of these discrepancies are systematic rather than accidental: they arise from differing assumptions regarding dependency scope, naming, provenance, and representation, while others reflect inconsistent support for fields defined in SBOM specifications. These findings demonstrate that many of the observed discrepancies cannot simply be "fixed": they require clearer standardization. As SBOM generation becomes a legal compliance requirement, the choice of tool itself can influence the resulting SBOM, potentially becoming a source of undetected non-compliance. We argue that future SBOM standards should define canonical rules regarding dependency scope, provenance, and representation to improve interoperability and compliance.
Speakers
PB

Philippe Boinot

Researcher, French National Cybersecurity Agency (ANSSI)
Dr Philippe Boinot joined the French National Cybersecurity Agency (ANSSI) in September 2024, where his research focuses on software security, with a particular interest in software supply chain security.
AP

Alan Prado

Research Engineer, Inria Rennes, France,
Alan Prado is a research engineer at Inria, Rennes, France, working on the evaluation and quality of Software Bill of Materials produced by open-source tools. Previously, he worked on SBOM-related topics at ANSSI.
Tuesday October 6, 2026 17:01 - 17:19 CEST
South Hall 3A
  SCORED Sessions, SBOM and Beyond

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Tweet Share

Get help with the event

Contact event planner Event login
View support guides Find upcoming events
Create an event you'd love to attend!
Explore why organizers choose Sched • Success stories
Event App • Event scheduling • Event registration • Event ticketing • Sched forms • Call for papers • Badges • Conferences
© 2026. SCHED LLC - All rights reserved - Helping events since 2008
Conference Scheduling Software • Privacy • Terms
Share Modal

Share this link via

Or copy link