VeriSBOM: Secure and Verifiable SBOM Sharing via Zero-Knowledge Proofs

SBOMs often contain sensitive information that organizations are unwilling to disclose in full. To avoid disruption of privacy and confidentiality in delivering plaintext SBOMs, we present VeriSBOM, a trustless SBOM framework that provides cryptographic verifiability of SBOMs using zero-knowledge proofs, i.e., third-parties can validate if software contains authentic dependencies distributed by official package managers and that the same dependencies are compliant with policy constraints. The verification process requires no trust in the SBOM publisher beyond the soundness of the underlying primitives, and third parties can independently check proofs against the public cryptographic commitments. We design and implement VeriSBOM, analyze its security, evaluate its performance on real-world package registries and SBOMs, and evaluate its usability.