一句话：首个面向SBOM实践者的实证研究，归纳26条实践现状陈述并构建目标模型，指出采用挑战与未来方向。
软件供应链攻击激增使软件物料清单（SBOM）备受关注；SBOM 是提升供应链透明度和安全性的关键构件。然而，实践者如何认知 SBOM、在实际采用中面临哪些挑战仍不清晰，现有 SBOM 研究也偏零散且缺乏软件工程视角。为此，作者开展首个 SBOM 实证研究，采用定性与定量混合方法，访谈 17 位实践者并调查 65 位受访者，覆盖 15 个国家、五大洲。研究归纳出 26 条陈述，并将其归为三个主题以刻画 SBOM 实践现状；基于结果，作者提出目标模型，并指出实践者可投入的未来方向。
The rapid growth of software supply chain attacks has attracted considerable attention to software bill of materials (SBOM). SBOMs are a crucial building block to ensure the transparency of software supply chains that helps improve software supply chain security. Although there are significant efforts from academia and industry to facilitate SBOM development, it is still unclear how practitioners perceive SBOMs and what are the challenges of adopting SBOMs in practice. Furthermore, existing SBOM-related studies tend to be ad-hoc and lack software engineering focuses. To bridge this gap, we conducted the first empirical study to interview and survey SBOM practitioners. We applied a mixed qualitative and quantitative method for gathering data from 17 interviewees and 65 survey respondents from 15 countries across five continents to understand how practitioners perceive the SBOM field. We summarized 26 statements and grouped them into three topics on SBOM's states of practice. Based on the study results, we derived a goal model and highlighted future directions where practitioners can put in their effort.
DOI 原文 · arXiv · PDF（开放获取） · DBLP
@inproceedings{abs-2301-05362,
title = {An Empirical Study on Software Bill of Materials: Where We Stand and the Road Ahead},
author = {Boming Xia and Tingting Bi and Zhenchang Xing and Qinghua Lu and Liming Zhu},
booktitle = {ICSE},
year = {2023},
doi = {10.1109/icse48619.2023.00219}
}