Microsoft SBOM Tool

On this page, we will analyze the SBOM generated by the Microsoft SBOM Tool tool for the PyTorch GitHub Repository. The overall analysis for Microsoft SBOM Tool is available here.

The SPDX SBOM was generated in the JSON format and converted to RDF/XML using pyspdxtools. It is a valid spdx file and can be validated using the spdx online validator.

SBOM size

kg = kglab.KnowledgeGraph()
kg.load_rdf("../../../data/tools_cs1/sboms/rdf/pytorch-sbomtool-spdx22.rdf.xml", format="xml")

print("Files:", len(get_files_data(kg)))
print("Packages:", len(get_package_data(kg)))
print("relationships:", len(get_relationship_data(kg)))
Files: 0
Packages: 229
relationships: 229

Is this SBOM NTIA minimum element conformant? False

Individual elements Status
All component names provided? True
All component versions provided? True
All component identifiers provided? True
All component suppliers provided? False
SBOM author name provided? True
SBOM creation timestamp provided? True
Dependency relationships provided? True

Components missing an supplier: terminado, fastimage, google-auth, google-apis-iamcredentials_v1, cffi, expecttest, exceptiongroup, deprecated, dataclasses, widgetsnbextension, google-apis-androidpublisher_v3, claide, mistune, google-cloud-core, networkx, google-cloud-storage, notebook, websocket-client, attrs, xcpretty, jupyter-core, pyparsing, webrick, sphinx, unicode-display_width, artifactory, GitPython, PyGithub, google-cloud-env, faraday-patron, jupyter-server-terminals, grpcio, jwt, memoist, mini_mime, ipython-genutils, mpmath, faraday-retry, multipart-post, types-dataclasses, public_suffix, sortedcontainers, zipp, astunparse, jupyterlab-pygments, charset-normalizer, aws-sigv4, signet, colorama, bs4, rake, aws-partitions, rubyzip, urllib3, oauthlib, pyasn1-modules, future, tty-spinner, aws-sdk-s3, sphinxcontrib.katex, defusedxml, jupyter-sphinx, pywinpty, argon2-cffi-bindings, jupyterlab-widgets, markdown, nbformat, fastjsonschema, overrides, bleach, requests, rsa, faraday-net_http_persistent, json, contourpy, jupyter-server-mathjax, requests-oauthlib, tty-screen, colored2, ruby2_keywords, pyyaml, faraday_middleware, nbclient, faraday, kiwisolver, typing-extensions, lxml, gh_inspector, atomos, importlib-metadata, sphinx, aws-eventstream, babosa, Send2Trash, appnope, multi_json, pillow, optparse, jmespath, beautifulsoup4, xcodeproj, charset-normalizer, python-etcd, nest-asyncio, faraday-em_http, docutils, naturally, jupyter-cache, webencodings, traitlets, urllib3, httpclient, MarkupSafe, gitdb, sphinx, security, xcpretty-travis-formatter, myst-parser, tinycss2, prometheus-client, googleauth, exhale, declarative, faraday-multipart, word_wrap, google-auth-oauthlib, urllib3, google-cloud-errors, bundler, tensorboard-plugin-wit, google-apis-core, enum34, pygments, jupyter-server, domain_name, pandocfilters, Jinja2, colored, typing-extensions, myst-parser, jupyter-client, typing, faraday-em_synchrony, hypothesis, cachetools, fastlane, http-cookie, smmap, pyzmq, mini_magick, filelock, tornado, faraday-excon, nbconvert, nbdime, IPython, google-apis-storage_v1, faraday-net_http, argon2-cffi, matplotlib, faraday-httpclient, psutil, mdit-py-plugins, breathe, digest-crc, markdown-it-py, attrs, entrypoints, CFPropertyList, google-apis-playcustomapp_v1, pynacl, plist, sympy, sqlalchemy, addressable, faraday-rack, numpy, sphinx-panels, idna, sphinx_copybutton, protobuf, terminal-table, retriable, tensorboard, tqdm, nanaimo, jinja2, dotenv, unf, faraday-cookie_jar, emoji_regex, ipykernel, rouge, simctl, certifi, aws-sdk-kms, sphinx-copybutton, highline, rexml, ipywidgets, excon, nbclassic, representable, fsspec, aws-sdk-core, absl-py, ptyprocess, docutils, commander, sphinx-togglebutton, tensorboard-data-server, python-dateutil, trailblazer-option, terminal-notifier, myst-nb, fonttools, uber, os, pyasn1, numpy, cycler, pycparser, packaging, unf_ext, tty-cursor, werkzeug, notebook-shim, six

Source: ntia_checker

Quality Score

dir_qs = "../../../data/tools_cs1/sbomqs/"
sbomqs_df, feature_qscores = sbomqs_scores(dir_qs)
display_qscores_with_descriptions(feature_qscores, tool_list=['Microsoft.SBOMTool'])

Tool: Microsoft.SBOMTool (avg score: 6.36)

Category: Structural (avg score: 10.00)

feature score description tool
0 sbom_spec 10.0 provided sbom is in a supported sbom format of... Microsoft.SBOMTool
1 sbom_spec_version 10.0 provided sbom should be in supported spec vers... Microsoft.SBOMTool
2 sbom_spec_file_format 10.0 provided sbom should be in supported file form... Microsoft.SBOMTool
3 sbom_parsable 10.0 provided sbom is parsable Microsoft.SBOMTool

Category: NTIA-minimum-elements (avg score: 8.58)

feature score description tool
4 comp_with_supplier 0.04 1/229 have supplier names Microsoft.SBOMTool
5 comp_with_name 10.00 229/229 have names Microsoft.SBOMTool
6 comp_with_version 10.00 229/229 have versions Microsoft.SBOMTool
7 comp_with_uniq_ids 10.00 229/229 have unique ID's Microsoft.SBOMTool
8 sbom_dependencies 10.00 doc has 229 relationships Microsoft.SBOMTool
9 sbom_authors 10.00 doc has 2 authors Microsoft.SBOMTool
10 sbom_creation_timestamp 10.00 doc has creation timestamp Microsoft.SBOMTool

Category: Semantic (avg score: 3.33)

feature score description tool
11 sbom_required_fields 10.0 Doc Fields:true Pkg Fields:true Microsoft.SBOMTool
12 comp_with_licenses 0.0 0/229 have licenses Microsoft.SBOMTool
13 comp_with_checksums 0.0 0/229 have checksums Microsoft.SBOMTool

Category: Quality (avg score: 2.85)

feature score description tool
14 comp_valid_licenses 0.00 0/229 components with valid license Microsoft.SBOMTool
15 comp_with_primary_purpose 0.00 0/229 components have primary purpose specified Microsoft.SBOMTool
16 comp_with_deprecated_licenses 0.00 no licenses found Microsoft.SBOMTool
17 comp_with_restrictive_licenses 0.00 no licenses found Microsoft.SBOMTool
18 comp_with_any_vuln_lookup_id 9.96 228/229 components have any lookup id Microsoft.SBOMTool
19 comp_with_multi_vuln_lookup_id 0.00 0/229 components have multiple lookup id Microsoft.SBOMTool
20 sbom_with_creator_and_version 10.00 1/1 tools have creator and version Microsoft.SBOMTool

Category: Sharing (avg score: 10.00)

feature score description tool
21 sbom_sharable 10.0 doc has a sharable license free 1 :: of 1 Microsoft.SBOMTool

Dependencies

# get the relationship graph to be visualized
graph = visualize_relationship_graph(kg)

# optional: set the physics layout of the network
graph.force_atlas_2based()
graph.set_edge_smooth('dynamic')

# show graph
graph.show("../../figs/cs1-Microsoft.SBOMTool.relationship_full.html")
../../figs/cs1-Microsoft.SBOMTool.relationship_full.html