一句话：在40个开源项目的SBOM中补充依赖CVE信息，并通过PR与问卷评估其接受度与实用性。
软件物料清单（SBOM）正成为描述软件组成的重要方式，并常受政府法规推动。然而现有 SBOM 的消费支持有限，且除简单依赖关系外信息不足，尤其缺少软件漏洞信息。本文报告一项初步研究：对 40 个开源项目的 SBOM 进行增强，加入其项目依赖所暴露的常见漏洞和暴露（CVE）信息。作者通过向这些项目提交 pull request，并请项目所有者填写问卷来评估增强 SBOM。结果显示，多数增强 SBOM 未被直接接受，主要原因是维护者要求 SBOM 能够持续更新；不过收到的反馈表明这种 SBOM 增强具有实用性。
Software Bills of Material (SBOMs) are becoming a consolidated—and often enforced by governmental regulations—way to describe software composition. However, based on recent studies, SBOMs suffer from limited support for their consumption and lack information beyond simple dependencies, especially regarding software vulnerabilities. This paper reports the results of a preliminary study in which we augmented SBOMs of 40 open-source projects with information about Common Vulnerabilities and Exposures (CVE) exposed by project dependencies. Our augmented SBOMs have been evaluated by submitting pull requests and by asking project owners to answer a survey. Although, in most cases, augmented SBOMs were not directly accepted because owners required a continuous SBOM update, the received feedback shows the usefulness of the suggested SBOM augmentation.
@inproceedings{paperbot8971,
title = {Augmenting Software Bills of Materials with Software Vulnerability Description: A Preliminary Study on GitHub},
author = {Davide Fucci and Massimiliano Di Penta and Simone Romano and Giuseppe Scanniello},
booktitle = {FSE},
year = {2025},
doi = {10.1145/3696630.3728513}
}