Assessing java SBOM accuracy and completeness

1 . A computer-implemented method for assessing a software bill of materials (SBOM), the computer-implemented method comprising:

extracting package names from code of an application to identify first dependencies of a plurality of dependencies of the application;

extracting package names from accesses by the application to identify second dependencies of the plurality of dependencies of of the application;

generating a quality score for the SBOM of the application based on a comparison of contents of the SBOM to the first dependencies and the second dependencies, with each dependency of the first dependencies and the second dependencies being weighted according to a combination of a weight for missing dependencies or inaccurate dependencies, a weight of a type of the missing dependencies or the inaccurate dependencies, and a weight for a scope of dependencies; and

performing an action responsive to the quality score, wherein the performing of the action includes disabling execution of the application responsive to the quality score that is below a predetermined threshold.

2 . The computer-implemented method of claim 1 , wherein the extracting of the package names from the code includes determining package names from a string value of a class reference.

3 . The computer-implemented method of claim 2 , wherein the class reference is identified in a constant pool.

4 . The computer-implemented method of claim 2 , wherein the determining of the package names includes extracting all but a final label of the string value.

5 . The computer-implemented method of claim 1 , wherein the extracting of the package names from the accesses includes performing a code walk on a code method of a class file.

6 . The computer-implemented method of claim 5 , wherein the code walk includes identifying calls to methods from a list of targeted methods that accept a class as input.

7 . The computer-implemented method of claim 5 , wherein the class file is extracted from a JAVA® archive file.

8 . The computer-implemented method of claim 1 wherein the generating of the quality score includes dividing combined weight scores by a maximum weight score across a number of dependencies of the plurality of dependencies.

9 . A computer program product for assessing a software bill of materials (SBOM), the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions being executable by a hardware processor to cause the hardware processor to:

extract package names from code of an application to identify first dependencies of a plurality of dependencies of the application;

extract package names from accesses by the application to identify second dependencies of the plurality of dependencies of the application;

generate a quality score for the SBOM of the application based on a comparison of contents of the SBOM to the first dependencies and the second dependencies, with each dependency of the first dependencies and the second dependencies being weighted according to a combination of a weight for missing dependencies or inaccurate dependencies, a weight of a type of the missing dependencies or the inaccurate dependencies, and a weight for a scope of dependencies; and

perform an action responsive to the quality score, wherein the performance of the action includes disabling execution of the application responsive to the quality score that is below a predetermined threshold.

10 . A system for assessing a software bill of materials (SBOM), the system comprising:

a hardware processor; and

a memory that stores a computer program which, when executed by the hardware processor, causes the hardware processor to:

extract package names from code of an application to identify first dependencies of a plurality of dependencies of the application;

extract package names from accesses by the application to identify second dependencies of the plurality of dependencies of the application;

generate a quality score for the SBOM of the application based on a comparison of contents of the SBOM to the first dependencies and the second dependencies, with each dependency of the first dependencies and the second dependencies being weighted according to a combination of a weight for missing dependencies or inaccurate dependencies, a weight of a type of the missing dependencies or the inaccurate dependencies, and a weight for a scope of dependencies; and

perform an action responsive to the quality score, wherein the performance of the action includes disabling execution of the application responsive to the quality score that is below a predetermined threshold.

11 . The system of claim 10 , wherein the computer program further causes the hardware processor to determine the package names from a string value of a class reference.

12 . The system of claim 11 , wherein the class reference is identified in a constant pool.

13 . The system of claim 11 , wherein the computer program further causes the hardware processor to extract all but a final label of the string value.

14 . The system of claim 10 , wherein the computer program further causes the hardware processor to perform a code walk on a code method of a class file.

15 . The system of claim 14 , wherein the code walk includes identification of calls to methods from a list of targeted methods that accept a class as input.

16 . The system of claim 14 , wherein the class file is extracted from a JAVA® archive file.

17 . The system of claim 10 , wherein the computer program further causes the hardware processor to device combined weight scores by a maximum weight score across a number of dependencies of the plurality of dependencies.