Systems and processes for facilitating edits to software bill of materials
Systems are provided for generating, modifying and using SBOMs for facilitating risk assessment and threat mitigation for corresponding programs, and particularly for large programming builds. The creation and modification of the SBOMs includes processes for omitting declarations referenced in chunk SBOMs of program chunks incorporated into a final programming build associated with a build SBOM, but which are not actually utilized by the final programming build, as well as processes for adding new declarations for code segments that are not declared in the related chunk SBOMs, even though the code segments are utilized by the final programming build. Systems are also configured to use SBOMs in combination with configuration restriction records to assess and resolve threat events in a manner that can prevent unnecessary remedial actions for threat events that appear to be relevant to one or more files or dependencies incorporated into a program.
1. A method for facilitating edits to an SBOM (software bill of materials), the SBOM including file declarations for files that are incorporated into a corresponding program associated with the SBOM, and dependency declarations associated with one or more of the files, the method comprising:
identifying a program that includes a plurality of files;
identifying the SBOM, which corresponds to the program and which includes file declarations for at least some of the files that are incorporated into the program, as well as dependency declarations associated with one or more of the files;
parsing the program to identify a plurality of code segments contained in the plurality of files;
searching one or more repositories of open-source code that is not referenced in the file declarations of the SBOM for any undeclared code segments determined to be within a predetermined threshold of similarity to one or more of the identified plurality of code segments contained in the plurality of files;
for at least one undeclared code segment determined to be within the predetermined threshold of similarity to the one or more identified plurality of code segments, generating a new declaration associated with the at least one undeclared code segment to be added to the SBOM to indicate at least author or source information for the at least one undeclared code segment which is at least partially incorporated into the program; and
generating a modified SBOM by adding the new declaration to the SBOM.
2. The method of claim 1 , wherein adding the new declaration to the SBOM includes:
appending the new declaration to the SBOM;
generating a new identifier for the modified SBOM; and
creating or amending a digital record in an index that associates the new strong-identifier with the program.
3. The method of claim 2 , wherein the method includes amending an existing record in the index that associates a previous identifier of the SBOM with the program.
4. The method of claim 3 , wherein amending the existing record includes adding the new identifier for the modified SBOM to the existing record along with the previous identifier of the SBOM, so that the SBOM and the modified SBOM are both associated with the program by the index.
5. The method of claim 1 , wherein the new declaration comprises an identification of a reference file that is not directly incorporated into the program, but which preceded the program, and which contains the undeclared code segment.
6. The method of claim 1 , wherein the new declaration comprises an identification of the undeclared code segment as a dependency that is relied upon by the one or more of the identified plurality of code segments.
7. The method of claim 1 , wherein the new declaration comprises an identification of a dependency that is relied upon by the undeclared code segment.
8. The method of claim 1 , wherein the method further includes, prior to parsing the program, verifying the program based at least in part on an analysis of an identifier.
9. The method of claim 1 , the method further comprising generating a notification for one or more entities that have installed or acquired the program prior to the new declaration being added to the SBOM, the notification including the modified SBOM.
10. The method of claim 1 , wherein the method further includes generating the SBOM during a build of the program and wherein the generating the modified SBOM occurs prior to deployment of the program to one or more end-users.
11. The method of claim 1 , wherein adding the new declaration to the SBOM includes creating a new SBOM with the new declaration, the new SBOM comprising the modified SBOM and including the new declaration along with a reference to an identifier of the SBOM.
12. A computing system comprising:
one or more hardware processors; and
one or more storage devices having stored computer-executable instructions that are executable by the one more hardware processors for configuring the computing system to perform the following:
identify a program that includes a plurality of files;
identify an SBOM (software bill of materials), which corresponds to the program and which includes file declarations for at least some of the files that are incorporated into the program, as well as dependency declarations associated with one or more of the files;
parse the program to identify a plurality of code segments contained in the plurality of files;
search one or more repositories of open-source code that is not referenced in the file declarations of the SBOM for any undeclared code segments determined to be within a predetermined threshold of similarity to one or more of the identified plurality of code segments contained in the plurality of files;
for at least one undeclared code segment determined to be within the predetermined threshold of similarity to the one or more identified plurality of code segments, generate a new declaration associated with the at least one undeclared code segment to be added to the SBOM to indicate at least author or source information for the at least one undeclared code segment which is at least partially incorporated into the program; and
generate a modified SBOM by adding the new declaration to the SBOM.
13. The computing system of claim 12 , wherein adding the new declaration to the SBOM includes:
appending the new declaration to the SBOM;
generating a new identifier for the modified SBOM; and
creating or amending a digital record in an index that associates the new identifier with the program.
14. The computing system of claim 13 , wherein the computer-executable instructions are further executable for configuring the computing system to amend an existing record in the index that associates a previous identifier of the SBOM with the program.
15. The computing system of claim 12 , wherein the new declaration comprises an identification of a dependency that is relied upon by the undeclared code segment.
16. The computing system of claim 12 , wherein the new declaration comprises an identification of a reference file that is not directly incorporated into the program, but which preceded the program, and which contains the undeclared code segment.
17. The computing system of claim 12 , wherein the computer-executable instructions are further executable for configuring the computing system to generate a notification for one or more entities that have installed or acquired the program prior to the new declaration being added to the SBOM, the notification including the modified SBOM.
18. The computing system of claim 12 , wherein the computer-executable instructions are further executable for configuring the computing system to generate the SBOM during a build of the program and wherein the generating the modified SBOM occurs prior to deployment of the program to one or more end-users.
19. The computing system of claim 12 , wherein adding the new declaration to the SBOM includes creating a new SBOM with the new declaration, the new SBOM comprising the modified SBOM and including the new declaration along with a reference to an identifier of the SBOM.
20. A computer program product comprising one or more storage devices having stored computer-executable instructions that are executable by one more hardware processors of a computing system for configuring the computing system to:
identify a program that includes a plurality of files;
identify an SBOM (software bill of materials), which corresponds to the program and which includes file declarations for at least some of the files that are incorporated into the program, as well as dependency declarations associated with one or more of the files;
parse the program to identify a plurality of code segments contained in the plurality of files;
search one or more repositories of open-source code that is not referenced in the file declarations of the SBOM for any undeclared code segments determined to be within a predetermined threshold of similarity to one or more of the identified plurality of code segments contained in the plurality of files;
for at least one undeclared code segment determined to be within the predetermined threshold of similarity to the one or more identified plurality of code segments, generate a new declaration associated with the at least one undeclared code segment to be added to the SBOM to indicate at least author or source information for the at least one undeclared code segment which is at least partially incorporated into the program; and
generate a modified SBOM by adding the new declaration to the SBOM.