Establish whether SBOM divergence mechanisms generalize across ecosystems

Establish whether the identified SBOM-generation mechanisms—including design choices, representation differences, and uneven specification-field completeness—generalize to additional ecosystems and package managers beyond JavaScript and Rust, or whether they are ecosystem-specific.

Background

The study examines Syft, Trivy, and cdxgen only on JavaScript and Rust projects. Its conclusion identifies extending the comparison to ecosystems such as Python and Java as a way to test whether the observed causes of divergence are general properties of SBOM generation or specific to the ecosystems and package managers analyzed. This remains unresolved in the paper.

References

First, extending the comparison to additional ecosystems and package managers (Python, Java, ...) would help establish whether the mechanisms we identify here, design choices and representation differences, uneven field completeness, generalize beyond JavaScript and Rust, or are ecosystem-specific.

— Mind the Gap: How SBOM Specification Ambiguities Lead to Divergent Software Bills of Materials. An Empirical Tool Study  (2609.19920 - Prado et al., 17 Sep 2026) in Section 6, Conclusion, “Future work”