Notes: Automatic Bill of Materials and runtime SBOM enforcement

Automatic Bill of Materials (2023) embeds source file hashes into binaries with compressed Bloom filters, making it easy to check whether known-vulnerable code is present.

It’s a great read alongside SBOM.EXE: Countering Dynamic Code Injection based on Software Bill of Materials in Java (2024), which proposes an index built with bytecode canonicalization and a JVM watchdog agent to make the SBOM an enforceable runtime contract.

This is also a great opportunity to mention Building a Runtime JAR Inspector in 10 Hours from Bruno Borges and team.

The themes connect to runtime integrity checks, dependency-aware enforcement, and SBOM and evidence portability. It’s also worth giving a fresh read to OmniBOR: A System for Automatic, Verifiable Artifact Resolution across Software Supply Chains (2024).