Developer experience · Exploratory empirical mining study
On the adoption of software bill of materials in open-source software projects
Journal of Systems and Software · 2025
Summary
SBOM adoption is low but rising. SBOMs are mostly generated through build-integration tools or GitHub Actions; fewer than half of analyzed projects include them in version control or public release artifacts. Only a limited fraction contain minimum/recommended information, and some are noncompliant with existing SBOM standards. For a founder, use this as a question to test in your own context, not a universal playbook.
For your marketing
Possible founder application
Treat this as evidence for the specific marketing capability and growth question studied. Compare the setting and sample to your company before changing a growth decision; use a local experiment where the paper does not match your context.
Reported result
What the study found
SBOM adoption is low but rising. SBOMs are mostly generated through build-integration tools or GitHub Actions; fewer than half of analyzed projects include them in version control or public release artifacts. Only a limited fraction contain minimum/recommended information, and some are noncompliant with existing SBOM standards.
Research question
What the authors investigated
How widely are SBOMs adopted by open-source projects, how are they generated/distributed, and how complete and standards-compliant are they?
Design
Mining study of GitHub repositories identified as using SPDX or CycloneDX SBOM-generation tools; the paper examines adoption, placement in version control/release artifacts, and SBOM information-field compliance.
Sample and setting
186 public GitHub software repositories using SPDX or CycloneDX generation tools. The publisher abstract does not report a human-participant sample.
Scope and transfer
Limitations to keep in view
The publisher abstract does not provide a full limitations section. The observed repository set is limited to public GitHub projects identified through SPDX/CycloneDX tools, so the findings do not establish adoption rates for private, non-GitHub, or projects using other tooling; the source also cautions that SBOMs can be incomplete.
Research sources
Publisher full-text HTML supplies exact bibliographic data, authors, abstract, highlights, repository count, method, results, and data-availability statement. Evidence strength: strong for the 186-repository findings; moderate for broader ecosystem generalization because the abstract-defined frame is selective. Correction notices were not separately verified in this collection; consult the current publisher record before applying the findings.