sbom-unifier: Integration Framework for Heterogeneous SBOMs
2026-08-31 • Software Engineering
Software Engineering
AI summaryⓘ
The authors developed sbom-unifier, a tool that improves the completeness of Software Bill of Materials (SBOM) by combining outputs from different SBOM generation tools. Instead of just merging files, sbom-unifier matches components across tools using Package URLs and fills in missing information based on a priority strategy. They tested it on 90 open-source projects in various languages and found it increases coverage of important SPDX fields compared to single tools. This helps create more complete and accurate inventories of software components.
Software Bill of MaterialsSBOMSPDXPackage URLvulnerability managementlicense compliancesoftware componentsopen-sourcesoftware inventory
Authors
Yusuke Moriwaki, Tetsuya Kanda, Yuki Manabe, Shi Qiu, Shiyu Yang, Erina Makihara, Norihiro Yoshida, Katsuro Inoue
Abstract
A Software Bill of Materials (SBOM) is a machine-readable inventory of software components, increasingly required for vulnerability management and license compliance. However, existing SBOM generation tools often leave many SPDX-defined fields missing or only partially populated, because different tools produce heterogeneous outputs with uneven field-level coverage. We present sbom-unifier, a framework that improves SBOM completeness through field-level integration and complementation of multiple tool outputs and file-level enrichment. Unlike existing tools that simply concatenate SBOMs without identifying records referring to the same component, sbom-unifier identifies components via Package URL (PURL), complements missing field values by a deterministic priority-based strategy, reconstructs cross-section references, and further enriches file-level fields. Across 90 open-source projects in 9 programming languages, sbom-unifier preserves high completeness for required fields and, over the 39 SPDX 2.3 required and optional fields, raises the fully covered rate by 8 percentage points and reduces the totally missing rate by 11 percentage points over the respective best-performing individual tools. sbom-unifier is available at https://github.com/MoriwakiYusuke/sbom-unifier.