Bill of Materials

A Bill of Materials is a list of all the parts that make up a product. The term comes from manufacturing: for a bicycle, it would list the frame, chain, brakes, tires, and every single screw. Each part comes with details such as manufacturer, model number, and quantity. In German, such a list is called a Stückliste. In the tech industry today, the term mainly appears in a special form: as a directory of the components of a computer program. This variant is called a Software Bill of Materials, or SBOM for short.

Why nobody knows anymore what’s inside their software

Modern programs are hardly ever written from scratch anymore. Developers build in ready-made building blocks that other people have programmed and released for free. Such building blocks are called libraries. A single app can contain hundreds of them, and these libraries in turn use their own libraries.

This creates a problem. If a security flaw is found in one of these building blocks, almost nobody knows who is even using that building block. This is exactly what happened at the end of 2021 with a library called Log4j. It was embedded in millions of systems worldwide, and government agencies and corporations alike spent weeks just trying to figure out whether they were affected.

A Bill of Materials turns this search into a database query that takes a few seconds. That’s why regulations now increasingly require that one exist. The US government has required an SBOM from software suppliers since 2021. The EU’s Cyber Resilience Act demands something similar for products with digital components.

What such a list contains

A Bill of Materials is not typed by hand. Special tools scan through the program code and the project’s build instructions. They automatically detect every included building block and record it, along with its version number, in a file.

The exact version matters a great deal here. Security vulnerabilities almost always affect only certain versions of a building block. The entry therefore typically contains the name, version, publisher, license, and a checksum. The checksum is a kind of digital fingerprint used to detect whether the file was altered along the way.

So that different programs can read these lists, fixed formats exist. The two common ones are called SPDX and CycloneDX. Both are machine-readable, not plain text meant for humans. Security software can thus check all of a company’s lists daily against a database of known vulnerabilities.

From the parts list to the AI ingredient list

Anyone who purchases software professionally today often receives the Bill of Materials along with the contract. This also affects end devices: a connected TV or a car contains software for which manufacturers will increasingly have to be accountable. In everyday life, these lists are rarely seen, but they lie behind security updates that suddenly appear for many devices at once.

In the AI industry, the idea is currently being expanded. For a language model, a list of software building blocks is not enough. Also of interest are the training data, the base model it builds upon, and the licensing terms. For this, the term AI-BOM or Model Card with provenance information is circulating.

A common misconception is that a Bill of Materials makes software secure. It does not. It is pure bookkeeping and only states what is inside, not whether it is good. Its value lies in the fact that, in an emergency, nobody has to guess.