Replication resources for paper: "A Large Scale Empirical Analysis on the Adherence Gap between Standards and Tools in SBOM"

Replication resources for paper: "A Large Scale Empirical Analysis on the Adherence Gap between Standards and Tools in SBOM"

Usage

The all-sboms.zip includes all the 26,194 SBOMs of 3,287 repositories generated by the six tools in either CycloneDX or SPDX standards as described in paper.

The run-on-test-sboms.zip includes codes and some SBOMs for fast test purpose.

Download and unzip run-on-test-sboms.zip, cd into the dir and run `pip install -r requirements.txt` and then run `python test-run.py`, you will get the analysis results on the test-sboms.

If you want to rerun the whole process of SAP on all SBOMs, download and unzip the all-sboms.zip(around 50GB after unzip), and change the dirs in test-run.py(need to follow the language dir structure) and rerun again(clean up of the results dir is recommended).