Unified SBOM Management via RDF Database Abstraction - Maira Papadopoulou

This project addresses the growing challenge of managing Software Bill of Materials (SBOM) data at scale. While SBOMs in the SPDX format are essential for software supply chain security, current file-based approaches (e.g., JSON or RDF/XML) are not well-suited for complex querying, or large-scale analysis. To overcome these limitations, this project proposes a set of tools that leverage RDF triplestores for storing and managing SBOM data. SPDX documents will be parsed into structured Python objects, transformed into RDF triples, and stored using a unified triplestore abstraction layer. This approach enables powerful querying through SPARQL while remaining database-agnostic, supporting multiple backends such as Apache Jena, GraphDB, Blazegraph, AllegroGraph, and Oxigraph. The project will deliver a complete pipeline for SBOM ingestion, storage, and reconstruction. Key deliverables include: (1) a CLI-based ingestion tool for importing SPDX documents into RDF databases, (2) an export tool for reconstructing valid SPDX documents from queried data, (3) management utilities for CRUD operations on SBOM data, (4) a comprehensive test suite to ensure correctness across multiple backends, and (5) detailed documentation for both users and developers. This approach transforms SBOM data from static documents into a structured, queryable knowledge graph, enabling more efficient retrieval and analysis across different systems and backends.