Marketing capability and growth · Exploratory empirical mining study
On the adoption of software bill of materials in open-source software projects
Sabato Nocera, Simone Romano, Massimiliano Di Penta, Rita Francese, Giuseppe Scanniello (2025). Journal of Systems and Software.
Plain-English take
SBOM adoption is low but rising. SBOMs are mostly generated through build-integration tools or GitHub Actions; fewer than half of analyzed projects include them in version control or public release artifacts. Only a limited fraction contain minimum/recommended information, and some are noncompliant with existing SBOM standards. For a founder, use this as a question to test in your own context, not a universal playbook.
How much weight to give this
3.5/5 Useful evidence with meaningful caveats
The 1–5 evidence-check score is a practical reading aid, not a formal peer review or a probability that a conclusion is true. It combines design strength (2 points), sample reporting (1), comparison/control clarity (1), and how much of the paper could be checked (1). Access affects how confidently this directory can assess a study, not the study's underlying quality. Blinding is reported separately because it is not relevant to every design.
The described design supports the question, but it does not establish causal effects beyond the reported setting.
The reviewed source reports a sample or corpus size (186); size alone does not establish representativeness.
The source reports a comparison; check the original methods for its construction.
Firecrawl retrieved a full paper or full-text publisher page for this annotation.
Double-blind? Blinding was not established from the captured source; it may not apply to this study design.
Research question
What the authors investigated
How widely are SBOMs adopted by open-source projects, how are they generated/distributed, and how complete and standards-compliant are they?
Design
Mining study of GitHub repositories identified as using SPDX or CycloneDX SBOM-generation tools; the paper examines adoption, placement in version control/release artifacts, and SBOM information-field compliance.
Sample and setting
186 public GitHub software repositories using SPDX or CycloneDX generation tools. The publisher abstract does not report a human-participant sample.
Reported result
What the study found
SBOM adoption is low but rising. SBOMs are mostly generated through build-integration tools or GitHub Actions; fewer than half of analyzed projects include them in version control or public release artifacts. Only a limited fraction contain minimum/recommended information, and some are noncompliant with existing SBOM standards.
This is a paraphrase of the source. Check the original paper for definitions, estimates, statistical uncertainty and analysis details.
Scope and transfer
Limitations to keep in view
The publisher abstract does not provide a full limitations section. The observed repository set is limited to public GitHub projects identified through SPDX/CycloneDX tools, so the findings do not establish adoption rates for private, non-GitHub, or projects using other tooling; the source also cautions that SBOMs can be incomplete.
Possible founder application
Treat this as evidence for the specific marketing capability and growth question studied. Compare the setting and sample to your company before changing a growth decision; use a local experiment where the paper does not match your context.
Evidence access
Full text retrieved from publisher or linked open repository
Publisher full-text HTML supplies exact bibliographic data, authors, abstract, highlights, repository count, method, results, and data-availability statement. Evidence strength: strong for the 186-repository findings; moderate for broader ecosystem generalization because the abstract-defined frame is selective. Correction notices were not separately verified in this collection; consult the current publisher record before applying the findings.
If only an abstract or metadata was available, the profile is limited to claims supported there. A paper's paywall does not change its evidentiary status, but it limits what we can substantiate from accessible text.