SBOM

The 2021 U.S. Presidential Executive Order (EO 14028) requires federal software suppliers to provide a Software Bill of Materials (SBOM).

An SBOM is a structured inventory that lists all components of a piece of software, including direct and transitive dependencies, version numbers, and licenses.

美国政府在SolarWinds和Log4Shell事件后发布行政令要求推行软件物料清单（SBOM），欧盟推出《网络弹性法案》将开源软件安全责任纳入监管框架

SBOM (Software Bill of Materials) is gradually becoming infrastructure in vulnerability response; without it, organizations cannot determine within hours whether they are affected.

Model weights should be brought into the scope of software bill of materials (SBOM) management, clarifying which model versions have passed security assessment and which are prohibited from use in production agents.

Most current SBOM toolchains do not parse model weight formats (such as safetensors and GGUF), and they lack a standard process for comparing weight hashes against official release versions, which lets abliteration-processed model variants easily bypass routine dependency audits.

Currently, SBOM support in the PHP ecosystem is still inconsistent; although Composer can export a dependency tree, plugins, themes, and custom-modified code often fall outside the list.

A software bill of materials (SBOM) is the practice of recording in a machine-readable format all components and their versions contained in a system, used to quickly locate affected assets after a vulnerability disclosure.

Modern security practices emphasize software bills of materials (SBOM) and continuous monitoring of dependencies to help organizations quickly determine whether they are affected by a given component vulnerability.

A software bill of materials (SBOM) is a tool for listing all components and dependencies of software, and extending the SBOM concept to the AI field has given rise to practices such as the AI bill of materials (AI-BOM) and model cards.

In the current ecosystem, the completeness and standardization of model-source metadata (such as model fingerprints, license declarations, and dependency lists) remain limited, which is the technical root of the complexity of compliance judgments.

The US government drove the trend toward mandatory SBOMs after the Log4Shell incident in 2021.

After the Log4j vulnerability incident in 2021, the United States pushed SBOM into the regulatory spotlight, with an executive order requiring software vendors supplying the federal government to provide SBOMs.

When an event like Log4Shell occurs, being able to confirm within seconds from the SBOM whether you are affected is much faster than grepping through the repository.

The self-update mechanism breaks enterprises' software bills of materials (SBOMs) and version pinning strategies.

Artifact provenance refers to recording in software releases the origin of build artifacts, dependency versions, compilation environment, and signing information, with common practices including generating SBOMs, checksums, and build logs.

An SBOM lists all open-source and third-party components and their version information in a software product in machine-readable format, enabling rapid assessment of whether a device is affected when new vulnerabilities are disclosed.

In its 2023 cybersecurity guidance, FDA explicitly requires medical device manufacturers to submit an SBOM (Software Bill of Materials) prior to market approval.

Container security recommendations include using Trivy to scan for vulnerabilities, verifying signatures with Cosign, and attaching an SBOM file.

Leveraging dependency scanning tools, software bills of materials (SBOM), and signature verification mechanisms can enable timely detection of known vulnerabilities and anomalous changes.