Code Audit & Software Supply Chain Security
Problem Statement
Organizations must maintain Software Bill of Materials (SBOM) inventories to comply with cybersecurity regulations (e.g., Executive Order 14028). Manually verifying compliance across thousands of open-source software licenses (e.g., GPL-3.0 vs. MIT) takes significant effort.
Goal
Build an agent that ingests CycloneDX or SPDX SBOM files, identifies restrictive viral licenses (e.g., GPL), and cross-references dependencies against vulnerability databases.
Outcome Measurement
- License Compliance Rate: 100% detection of open-source license violations in commercial software builds.
- SBOM Generation Velocity: Automated SBOM risk assessment in under 10 seconds per project release.
How the Code was Built
Ingests SBOM component lists and evaluates license risk compatibility against company distribution policies.
Executable Code
from pydantic import BaseModel, Fieldfrom langchain_openai import ChatOpenAIclass SBOMAuditResult(BaseModel): total_components: int compliant_licenses: bool license_violations: list[str] high_risk_dependencies: list[str]def audit_sbom_inventory(sbom_json_summary: str) -> SBOMAuditResult: llm = ChatOpenAI(model="gpt-4o", temperature=0) structured_llm = llm.with_structured_output(SBOMAuditResult) prompt = f""" Audit this Software Bill of Materials (SBOM) inventory for commercial distribution compliance: {sbom_json_summary} Flag viral copyleft licenses (AGPL, GPL) and vulnerable dependencies. """ return structured_llm.invoke(prompt)if __name__ == "__main__": sample_sbom = """ Components: 1. express@4.18.2 (License: MIT) 2. gnu-core-utils@8.32 (License: GPL-3.0) 3. lodash@4.17.21 (License: MIT) """ res = audit_sbom_inventory(sample_sbom) print(f"Compliant: {res.compliant_licenses}") print("License Violations:", res.license_violations)
Leave a Reply