Reproduce “Hidden Dependencies and Component Variants in SBOM-Based Software Composition Analysis” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Shawn Rasheed, Max McPhee, Lisa Patterson, Stephen MacDonell, Jens Dietrich
An evaluation of SBOM-based software composition analysis shows that incomplete dependency graphs and unrecognized component lineage can both distort vulnerability assessments. Across controlled Java benchmarks, scanners applied VEX statements inconsistently, missed cloned components in several SBOM representations, and benefited from bytecode-derived dependency enrichment for statically visible references.
Key insights
- Component-presence scanning reported the vulnerable artifact even when the application could not reach the vulnerable functionality, demonstrating that SBOM dependency graphs are not equivalent to code-level reachability graphs.
- VEX handling failed in opposite ways: Grype and CVE-Bin-Tool did not suppress the intended finding, while Trivy suppressed both unreachable and reachable cases because it applied the assertion too broadly.
- Variant metadata is useful only when consumers implement it: three scanners recognized the cloned component in SPDX with hasVariant, but none recognized it through CycloneDX pedigree.variants.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.