Software Bill of Materials (SBOM) serves as a critical pillar in ensuring software supply chain security by providing a detailed inventory of the components and dependencies integral to software development. However, challenges abound in the sharing of SBOMs, including potential data tampering, hesitation among software vendors to disclose comprehensive information, and bespoke requirements from software procurers or users. These obstacles have stifled widespread adoption and utilization of SBOMs, underscoring the need for a more secure and flexible mechanism for SBOM sharing. This study proposes a novel solution to these challenges by introducing a blockchain-empowered approach for SBOM sharing, leveraging verifiable credentials to allow for selective disclosure. This strategy not only heightens security but also offers flexibility. Furthermore, this paper broadens the remit of SBOM to encompass AI systems, thereby coining the term AI Bill of Materials (AIBOM). This extension is motivated by the rapid progression in AI technology and the escalating necessity to track the lineage and composition of AI software and systems. Particularly in the era of foundational models like large language models (LLMs), understanding their composition and dependencies becomes crucial. These models often serve as a base for further development, creating complex dependencies and paving the way for innovative AI applications. The evaluation of our solution indicates the feasibility and flexibility of the proposed SBOM sharing mechanism, positing a new solution for securing (AI) software supply chains.

翻译：软件物料清单（SBOM）作为确保软件供应链安全的关键支柱，通过提供软件开发过程中组件与依赖关系的详细清单发挥作用。然而，SBOM的共享面临诸多挑战，包括潜在的数据篡改、软件供应商不愿披露完整信息，以及软件采购方或用户的定制化需求。这些障碍抑制了SBOM的广泛采用与利用，凸显出对更安全、灵活的SBOM共享机制的需求。本研究通过引入基于区块链的SBOM共享方法，利用可验证凭证实现选择性披露，为上述挑战提出创新解决方案。该策略不仅提升了安全性，还提供了灵活性。此外，本文拓展了SBOM的范畴以涵盖人工智能系统，由此提出"人工智能物料清单"（AIBOM）这一术语。这一延伸源于AI技术的快速进步，以及追踪AI软件与系统组成及来源的迫切需求。尤其在基础模型（如大型语言模型，LLMs）时代，理解其构成与依赖关系变得至关重要。这些模型常作为进一步开发的基础，形成复杂依赖关系，为创新AI应用铺平道路。本方案评估表明，所提出的SBOM共享机制兼具可行性与灵活性，为保障（AI）软件供应链安全提供了新方案。