US 12,197,586 B2
Systems and processes for facilitating edits to software bill of materials
Frank Joseph Bussell, Issaquah, WA (US); Henry James Lyons, Seattle, WA (US); Nicholas Allan Schwerzler, Sammamish, WA (US); Sencer Nuri Yeralan, Seattle, WA (US); Dale Russel Rolf, Renton, WA (US); Minh Trong Tran, Bellevue, WA (US); David John Janson, Kirkland, WA (US); Thomas George Yaryan, Seattle, WA (US); and Ian James McCarty, Sammamish, WA (US)
Assigned to Microsoft Technology Licensing, LLC, Redmond, WA (US)
Filed by MICROSOFT TECHNOLOGY LICENSING, LLC, Redmond, WA (US)
Filed on May 16, 2022, as Appl. No. 17/745,695.
Prior Publication US 2023/0367882 A1, Nov. 16, 2023
Int. Cl. G06F 21/57 (2013.01)
CPC G06F 21/577 (2013.01) [G06F 2221/033 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method for facilitating edits to an SBOM (software bill of materials), the SBOM including file declarations for files that are incorporated into a corresponding program associated with the SBOM, and dependency declarations associated with one or more of the files, the method comprising:
identifying a program that includes a plurality of files;
identifying the SBOM, which corresponds to the program and which includes file declarations for at least some of the files that are incorporated into the program, as well as dependency declarations associated with one or more of the files;
parsing the program to identify a plurality of code segments contained in the plurality of files;
searching one or more repositories of open-source code that is not referenced in the file declarations of the SBOM for any undeclared code segments determined to be within a predetermined threshold of similarity to one or more of the identified plurality of code segments contained in the plurality of files;
for at least one undeclared code segment determined to be within the predetermined threshold of similarity to the one or more identified plurality of code segments, generating a new declaration associated with the at least one undeclared code segment to be added to the SBOM to indicate at least author or source information for the at least one undeclared code segment which is at least partially incorporated into the program; and
generating a modified SBOM by adding the new declaration to the SBOM.