Consider dependency graphing tooling that can produce standardized output for downstream tools

[mrutkows]

One of the missing "tool types" (in existing SBOM tooling classification efforts) is dependency graphing tools.

These are tools which can create an independent dependency graph (across artifact types, language/package deps., base images, etc.) of components/resources that represent the hardware, software and services for an accurate inventory for an SBOM.

Today, most SBOM creation/generation tools tend to create their own proprietary graphs based upon domains-specific assumptions. In terms of language-specific SBOM tools, they are often coded to only a partial graph for files (package lists) they look for and can interpret. Effectively, we need a graphing tool that can be used for traversal for any language as almost all applications (and products) are composed of a plurality of languages.

[mrutkows]

(credit Aeva for noting this project)
Wanted to provide a link to the GitBom project which strives to do this: https://gitbom.dev/

For convenience, here is a copy of its goals/claims:

GitBOM is a minimalistic scheme for build tools to:

• Build a compact Artifact Dependency Graph (ADG), tracking every source code file incorporated into each built artifact.
• Embed a unique, content-addressable reference for that Artifact Dependency Graph (ADG), the GitBOM identifier, into the artifact at build time.

GitBOM is designed to:

• Consistently construct verifiable Artifact Dependency Graph (ADG)s across languages, environments, and packaging formats, with zero developer effort, involvement, or awareness
• Enable automatic, verifiable artifact resolution across today’s diverse software supply chains
• Complement SBOMs, such as SPDX, CycloneDX, or SWID
• Co-exist with, but not require, version control systems

[mrutkows]

Such graphing tools as GitBom (and others for different SBOM types) will be essential for constructing the most accurate inventory and data around components (resources) that go into an SBOM for downstream consumption (e.g., scanning, validation, analysis, etc.)