SPDX supports sharing component and license information. Matching inventories to final packages makes dependency decisions traceable.
Evaluation approach
Record the build, coverage and generating tool. Source dependencies may differ from packaged content, and dynamically added components require attention.
Application example
Reinspect the final package after protection. Include added native libraries, supplier components and license notices rather than delivering only a pre-protection inventory.
Limits and considerations
An SBOM does not establish that all vulnerabilities were found or that license compliance is complete. Missing versions weaken matching.
Checks and decisions
- Bind inventories to artifact hashes
- Check final-package coverage
- Verify license notices
Keep inventories useful for upgrades and incidents by making affected application versions discoverable.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.