Code Genome - Fingerprinting Code to Build Trustworthy SBOMs
summary
Project fingerprints functions by lifting binaries to LLVM IR canonicalization and producing semantically meaningful embeddings, then links those embeddings into a knowledge graph of open source artifacts to generate and verify CycloneDX SBOMs from binaries. Evaluation uses coreutils (105 programs, ~180 compile variants) with 250,000 positive and 250,000 negative function pairs; the IR-based genes approach reaches roughly 90% accuracy versus much lower byte-level baselines. Demo produces an SBOM from an RPM in about four minutes; a public scanning service is planned.
AI-written summary · about
chapters (4)
related talks
34mSBOMs: zero to hero in 25 mins!
43mUsing SBOMs for Linux Foundation Projects
34mTransforming SBOMs from Compliance Burden to Security Asset
35mTransforming SBOMs from Compliance Burden to Security Asset
47mThe Missing Link - How we collect and leverage SBOMs
34mSBOM Quality: We Need More Than a Simple “SBOM Button” for Compliance
26mSBOM X-Ray Superpowers: Making Better SBOMs, Using SBOMs
17mTrusted-SBOM: On the Critical Importance of Verifying SBOMs