An SBOM should represent the actual protected, distributed package. A source-repository inventory alone may be incomplete.
Evaluation approach
Include native libraries, security SDKs and post-build additions. Bind the SBOM to artifact identity.
Application example
After an advisory, identify affected mobile versions promptly.
Limits and considerations
A listed component does not by itself establish reachability or actual impact.
Are post-build additions visible?
Compare final delivery with the inventory when protection adds components. Keep their versions and licensing information available for review.
Checks and decisions
- Use the final package
- Include native components
- Link versions
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.