cid 47555c0ddce5153361df601ac70df528f65fb18fc4722c8f78438e4d86babc26 · original · open access · via openalex
Title: The State of the SBOM Tool Ecosystems: A Comparative Analysis of SPDX and CycloneDX Authors: Zhimin Zhao; Abdul Ali Bangash; Tongxu Ge; Arshdeep Singh; Zitao Wang; Bram Adams Venue: arXiv (Cornell University) Year: 2025 Canonical: doi:10.48550/arxiv.2512.21781 URL: https://doi.org/10.48550/arxiv.2512.21781 Collector: openalex OA: true ABSTRACT Software Bills of Materials (SBOMs) improve software release transparency by documenting components and dependencies, but their practical value depends on the tools that generate, analyze, and manage them. This paper compares the tool ecosystems of the two dominant SBOM formats: SPDX and CycloneDX. We analyze 108 open-source and 62 proprietary SBOM tools, compare ecosystem-level health metrics across 470 SPDX and 171 CycloneDX tools, examine 36,990 issue reports from open-source tools, and study the top 250 open-source projects using each format. Our results show that CycloneDX-using projects often exhibit stronger developer engagement and selected project health indicators, while SPDX benefits from a larger, more mature tool ecosystem and broader industry adoption. These findings highlight the complementary strengths of both ecosystems and identify opportunities for improving SBOM tooling across formats.