# SBOM-2023

> Experimental Data about Java SBOMs https://arxiv.org/pdf/2303.11102.pdf

**Wikidata**: [Q127474937](https://www.wikidata.org/wiki/Q127474937)  
**Source**: https://4ort.xyz/entity/sbom-2023

## Summary
SBOM-2023 is a free software dataset and experimental resource focused on Software Bill of Materials (SBOMs) within the Java ecosystem. It serves as the accompanying data for the research paper titled "Challenges of Producing Software Bill of Materials for Java." The project is open-source, licensed under the MIT License, and is maintained by the chains-project on GitHub.

## Key Facts
- **Entity Type:** Software / Free Software
- **Primary Function:** Experimental data regarding Java SBOMs
- **License:** MIT License
- **Source Document:** Described by "Challenges of Producing Software Bill of Materials for Java" (arXiv:2303.11102)
- **Repository:** Hosted at github.com/chains-project/SBOM-2023
- **Latest Version:** 2.0.0 (Released August 4, 2023)
- **Initial Version:** 1.0.0 (Released March 31, 2023)

## FAQs
### Q: What exactly is SBOM-2023?
A: SBOM-2023 is a software tool and dataset classified as free software that provides experimental data on Java Software Bill of Materials (SBOMs). It is designed to support research and analysis regarding the creation and management of SBOMs for Java applications.

### Q: Where can I find the SBOM-2023 source code and data?
A: The source code and data for SBOM-2023 are available in a public repository located at https://github.com/chains-project/SBOM-2023.

### Q: What are the available versions of SBOM-2023?
A: As of the latest records, there are two stable versions: version 1.0.0, released on March 31, 2023, and the preferred version 2.0.0, released on August 4, 2023.

## Why It Matters
SBOM-2023 plays a critical role in the domain of software supply chain security by addressing the specific complexities of the Java ecosystem. While the concept of a "Software Bill of Materials" is industry-standard for tracking software components, generating accurate SBOMs for Java has historically been challenging due to the language's specific dependency management and compilation processes.

This project provides the empirical data necessary to understand these challenges. By releasing this data under an MIT License, the creators have enabled developers, security researchers, and toolmakers to reproduce findings and test the efficacy of SBOM generation tools against a verified dataset. The release of version 2.0.0 further indicates an active refinement of this data, making it a current and relevant standard for evaluating the state of Java software transparency.

## Notable For
- **Specialized Domain:** It specifically targets the gaps in SBOM generation for the Java programming language.
- **Open Access:** It is released under the MIT License, making it freely accessible for modification and distribution.
- **Academic Foundation:** It provides the experimental backing for the paper "Challenges of Producing Software Bill of Materials for Java."
- **Active Development:** The project saw two stable releases in 2023 (March and August), demonstrating iterative improvements.

## Body
### Project Overview
SBOM-2023 is a software entity classified as both "software" and "free software." It functions primarily as a repository of experimental data concerning Software Bill of Materials (SBOMs) for Java. The project aims to facilitate the study of how Java components are documented and tracked within the software supply chain.

### Version History
The project has documented two stable releases, with the later version marked as the preferred release:
- **Version 1.0.0:** Published on March 31, 2023.
- **Version 2.0.0:** Published on August 4, 2023.

### Academic Context
The dataset is intrinsically linked to the academic publication "Challenges of Producing Software Bill of Materials for Java," which is available via arXiv (pdf/2303.11102). The data serves as the evidence base for the findings presented in this paper.

### Repository and Licensing
The project is hosted on GitHub under the organization "chains-project." The entire codebase and associated data are distributed under the MIT License, ensuring that users can freely run, study, change, and distribute the software.

## References

1. [Release 1.0.0. 2023](https://github.com/chains-project/SBOM-2023/releases/tag/v1.0.0)
2. [Release 2.0.0. 2023](https://github.com/chains-project/SBOM-2023/releases/tag/v2.0.0)