Glossary
Software Bill of Materials (SBOM)
A software bill of materials lists the components — libraries, packages, their versions — that went into building a piece of software, similar in spirit to an ingredient list. It exists so that when a vulnerability is discovered in a widely used component, anyone with an accurate bill of materials can immediately check whether they're affected, instead of having to inspect the artifact directly to find out.
An SBOM is only as useful as it is trustworthy: a list a vendor could edit freely after the fact provides little more assurance than a claim. The stronger version ties the bill of materials to the specific build it describes through the same kind of signing used for other provenance claims.