Replication Package of "Mind the SBOM Gap: Adoption and Compliance in Open Source Software"

Replication Package Structure: The replication package contains all data and scripts necessary to reproduce the analyses and results presented in this study. replication_package/├── data/│ ├── sbom_repo_paths.csv│ ├── sbom_project_features.csv│ ├── non_sbom_project_features.csv│ └── SBOM_files/ # Raw SBOM files collected from SBOM projects│└── code/ ├── RQ1_regression/ │ ├── regression.R # Main script to run the regression analysis (RQ1) │ └── common.R # Shared R functions for feature filtering and formatting │ └── RQ2_compliance/ ├── check_component_name.py ├── check_component_version.py ├── check_supplier.py ├── check_unique_identifiers.py ├── check_sbom_author.py ├── check_timestamp.py ├── check_dependency.py ├── check_hash.py ├── check_lifecycle_phase.py ├── check_license.py ├── check_vex.py ├── check_transitive_dependency.py ├── check_circular_dep.py └── check_all_7_min_req_files.py Folder Descriptions: data/: Contains datasets and raw SBOM files used in the analysis. - sbom_repo_paths.csv: Maps each SBOM file to its corresponding GitHub repository. - sbom_project_features.csv: Contains 23 extracted features for each SBOM-using project. - non_sbom_project_features.csv: Contains the same 23 features for matched non-SBOM projects. - SBOM_files/: Includes all valid SBOM files collected from open-source projects, in SPDX or CycloneDX formats. code/: Contains source code for reproducing both research questions. - RQ1_regression/: - regression.R: Runs multivariate logistic regression across 100 bootstrapped samples. - common.R: Defines helper functions for feature selection, multicollinearity removal, and LaTeX formatting of regression outputs. - RQ2_compliance/: - 14 Python scripts that check SBOM compliance against NTIA's minimum elements and best practices.