Summary

A recent evaluation (as of Jun 6, 2025) of SBOM coverage indicates that some client libraries (.NET,  Node, Python, Go, PHP, Ruby, Rust, Java) have static SBOMs without any components defined. Our client libraries generally do not bundle third-party dependencies, but instead end-users make use of the ecosystem's package manager to install any dependencies.

Motivation

As we seek to improve the coverage of our third party vulnerability management, we’d like to raise the bar of how SBOMs are generated to increase transparency and enable proactive vulnerability management analysis. As a result, R&D Security recommends that we revise the previously accepted approach of SBOMs including bundled dependencies only (approach #1, approved in this scope in 2024:Scope: SSDLC Policy Conformance for Client Libs), and instead pursue approach #2 (full runtime dependencies).

R&D Security seeks to be in alignment with the NITA Minimum Elements for Software Bill of Materials and OWASP Software Component Verification Standard (SCVS). Both publications emphasize that all components used in creation of software are to be documented in an SBOM, including ecosystem-based dependencies, as a best practice.

Acceptance Criteria

Automated generation of a CycloneDX SBOM that includes all required and optional runtime components.