一句话：提出 VeriSBOM，用零知识证明实现不泄露敏感信息的可验证 SBOM 共享与策略合规检查。
SBOM 常包含敏感信息，组织不愿完整披露，但明文共享会破坏隐私与机密性。论文提出 VeriSBOM，一个无需信任的 SBOM 框架，利用零知识证明提供密码学可验证性：第三方可验证软件是否包含由官方包管理器分发的真实依赖，且这些依赖满足策略约束。验证过程除底层密码原语可靠性外无需信任 SBOM 发布者，第三方可基于公开密码承诺独立验证证明。作者设计并实现 VeriSBOM，分析其安全性，并在真实包注册表和 SBOM 上评估性能，同时评估可用性。
SBOMs often contain sensitive information that organizations are unwilling to disclose in full. To avoid disruption of privacy and confidentiality in delivering plaintext SBOMs, we present VeriSBOM, a trustless SBOM framework that provides cryptographic verifiability of SBOMs using zero-knowledge proofs, i.e., third-parties can validate if software contains authentic dependencies distributed by official package managers and that the same dependencies are compliant with policy constraints. The verification process requires no trust in the SBOM publisher beyond the soundness of the underlying primitives, and third parties can independently check proofs against the public cryptographic commitments. We design and implement VeriSBOM, analyze its security, evaluate its performance on real-world package registries and SBOMs, and evaluate its usability.