Cybersecurity Dependency Security and SBOM

How it works

A software bill of materials lists components and relationships so affected software can be found. A lockfile helps reproduce a particular dependency resolution; it does not prove that every package is trustworthy. Review sources, integrity, supported versions and build-time code execution. Security advisories require context and should lead to an actual rebuild and verification.

Run the code

Save the complete source as dependency-security.py in a separate learning folder, then run python dependency-security.py. The reviewed runtime is Python 3.12.14 with the standard library; no third-party packages are required. These are local examples, not browser playground programs. Apache, MySQL and PHP are not needed.

Download the complete source

Local lab setup

Example

components = [{"name": "fictional-parser", "version": "1.4", "used_by": "attachment-worker"}, {"name": "fictional-mailer", "version": "2.1", "used_by": "reminders"}]
assert len({item["name"] for item in components}) == len(components)
affected = [item["used_by"] for item in components if item["name"] == "fictional-parser"]
assert affected == ["attachment-worker"]
print("review target: attachment-worker")

Expected result

review target: attachment-worker

The fixture uses fictional packages and versions; it is not a real advisory lookup. It demonstrates tracing a component to a deployment target. A real SBOM uses an established format and identifies transitive dependencies, licences and artefact versions so a maintainer can answer which release needs repair.