Replication Package of "Mind the SBOM Gap: Adoption and Compliance in Open Source Software"
Fuente:
Zenodo
Salvato in:
| Autore principale: | |
|---|---|
| Natura: | Recurso digital |
| Pubblicazione: |
Zenodo
2025
|
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866901604231282688 |
|---|---|
| author | Anonymous, Author |
| author_facet | Anonymous, Author |
| contents | <p>Replication Package Structure:</p> <p>The replication package contains all data and scripts necessary to reproduce the analyses and results presented in this study.</p> <p>replication_package/<br>├── data/<br>│ ├── sbom_repo_paths.csv<br>│ ├── sbom_project_features.csv<br>│ ├── non_sbom_project_features.csv<br>│ └── SBOM_files/ # Raw SBOM files collected from SBOM projects<br>│<br>└── code/<br> ├── RQ1_regression/<br> │ ├── regression.R # Main script to run the regression analysis (RQ1)<br> │ └── common.R # Shared R functions for feature filtering and formatting<br> │<br> └── RQ2_compliance/<br> ├── check_component_name.py<br> ├── check_component_version.py<br> ├── check_supplier.py<br> ├── check_unique_identifiers.py<br> ├── check_sbom_author.py<br> ├── check_timestamp.py<br> ├── check_dependency.py<br> ├── check_hash.py<br> ├── check_lifecycle_phase.py<br> ├── check_license.py<br> ├── check_vex.py<br> ├── check_transitive_dependency.py<br> ├── check_circular_dep.py<br> └── check_all_7_min_req_files.py</p> <p><br>Folder Descriptions:</p> <p>data/: Contains datasets and raw SBOM files used in the analysis.<br> - sbom_repo_paths.csv: Maps each SBOM file to its corresponding GitHub repository.<br> - sbom_project_features.csv: Contains 23 extracted features for each SBOM-using project.<br> - non_sbom_project_features.csv: Contains the same 23 features for matched non-SBOM projects.<br> - SBOM_files/: Includes all valid SBOM files collected from open-source projects, in SPDX or CycloneDX formats.</p> <p>code/: Contains source code for reproducing both research questions.<br> - RQ1_regression/:<br> - regression.R: Runs multivariate logistic regression across 100 bootstrapped samples.<br> - common.R: Defines helper functions for feature selection, multicollinearity removal, and LaTeX formatting of regression outputs.<br> - RQ2_compliance/:<br> - 14 Python scripts that check SBOM compliance against NTIA's minimum elements and best practices.</p> |
| format | Recurso digital |
| id | zenodo_https___doi_org_10_5281_zenodo_16109696 |
| institution | Zenodo |
| language | |
| publishDate | 2025 |
| publisher | Zenodo |
| record_format | zenodo |
| spellingShingle | Replication Package of "Mind the SBOM Gap: Adoption and Compliance in Open Source Software" Anonymous, Author <p>Replication Package Structure:</p> <p>The replication package contains all data and scripts necessary to reproduce the analyses and results presented in this study.</p> <p>replication_package/<br>├── data/<br>│ ├── sbom_repo_paths.csv<br>│ ├── sbom_project_features.csv<br>│ ├── non_sbom_project_features.csv<br>│ └── SBOM_files/ # Raw SBOM files collected from SBOM projects<br>│<br>└── code/<br> ├── RQ1_regression/<br> │ ├── regression.R # Main script to run the regression analysis (RQ1)<br> │ └── common.R # Shared R functions for feature filtering and formatting<br> │<br> └── RQ2_compliance/<br> ├── check_component_name.py<br> ├── check_component_version.py<br> ├── check_supplier.py<br> ├── check_unique_identifiers.py<br> ├── check_sbom_author.py<br> ├── check_timestamp.py<br> ├── check_dependency.py<br> ├── check_hash.py<br> ├── check_lifecycle_phase.py<br> ├── check_license.py<br> ├── check_vex.py<br> ├── check_transitive_dependency.py<br> ├── check_circular_dep.py<br> └── check_all_7_min_req_files.py</p> <p><br>Folder Descriptions:</p> <p>data/: Contains datasets and raw SBOM files used in the analysis.<br> - sbom_repo_paths.csv: Maps each SBOM file to its corresponding GitHub repository.<br> - sbom_project_features.csv: Contains 23 extracted features for each SBOM-using project.<br> - non_sbom_project_features.csv: Contains the same 23 features for matched non-SBOM projects.<br> - SBOM_files/: Includes all valid SBOM files collected from open-source projects, in SPDX or CycloneDX formats.</p> <p>code/: Contains source code for reproducing both research questions.<br> - RQ1_regression/:<br> - regression.R: Runs multivariate logistic regression across 100 bootstrapped samples.<br> - common.R: Defines helper functions for feature selection, multicollinearity removal, and LaTeX formatting of regression outputs.<br> - RQ2_compliance/:<br> - 14 Python scripts that check SBOM compliance against NTIA's minimum elements and best practices.</p> |
| title | Replication Package of "Mind the SBOM Gap: Adoption and Compliance in Open Source Software" |
| url | https://doi.org/10.5281/zenodo.16109696 |