一句话：通过问卷与访谈揭示五类利益相关者在创建和使用 SBOM 时面临的 12 项挑战，并提出 4 项可行解决方案。
软件物料清单（SBOM）用于管理依赖、漏洞、许可证和供应链，但实践采用仍不成熟。本文扩展既有研究，综合调查 SBOM 创建与使用中的利益相关者挑战。作者使用差异化问卷调研 138 名从业者，覆盖熟悉 SBOM 的从业者、关键开源项目成员、AI/ML、信息物理系统以及法律从业者五类群体，并访谈其中 8 人获取深入经验。研究识别出 12 项主要挑战，涉及 SBOM 内容、工具缺陷、维护与验证以及领域特定问题；据此提出并讨论 4 项可操作解决方案，并给出未来研发方向。
Software Bills of Materials (SBOMs) have emerged as tools to facilitate the management of software dependencies, vulnerabilities, licenses, and the supply chain. While significant effort has been devoted to increasing SBOM awareness and developing SBOM formats and tools, recent studies have shown that SBOMs are still an early technology not yet adequately adopted in practice. Expanding on previous research, this paper reports a comprehensive study that investigates the current challenges stakeholders encounter when creating and using SBOMs. The study surveyed 138 practitioners belonging to five stakeholder groups (practitioners familiar with SBOMs, members of critical open source projects, AI/ML, cyberphysical systems, and legal practitioners) using differentiated questionnaires, and interviewed 8 survey respondents to gather further insights about their experience. We identified 12 major challenges facing the creation and use of SBOMs, including those related to the SBOM content, deficiencies in SBOM tools, SBOM maintenance and verification, and domain-specific challenges. We propose and discuss 4 actionable solutions to the identified challenges and present the major avenues for future research and development.
@inproceedings{paperbot11323,
title = {BOMs Away! Inside the Minds of Stakeholders: A Comprehensive Study of Bills of Materials for Software Systems},
author = {Trevor Stalnaker and Nathan Wintersgill and Oscar Chaparro and Massimiliano Di Penta and Daniel M German and Denys Poshyvanyk},
booktitle = {ICSE},
year = {2024},
doi = {10.1145/3597503.3623347}
}