Rivet : aplicação do padrão SPDX no gerenciamento da cadeia de suprimentos de software

Abstract

This work presents the development of a desktop application named Rivet, aimed at managing the software supply chain through the use of the SPDX standard. The system is designed to support the generation of Software Bills of Materials (SBOMs), as well as the identification of vulnerabilities and the analysis of license compliance associated with the components of a software project, contributing to greater transparency and security in the use of third-party dependencies. To support the proposal, a systematic literature mapping was conducted, through which concepts related to software supply chain security, the use of SBOMs, and existing solutions in the field were analyzed. Based on this foundation, the application was designed and implemented to integrate generation and analysis functionalities into a unified interface. As a result, a functional solution was obtained that facilitates the identification of security risks and licensing issues in software projects, constituting a practical contribution to software supply chain management and culminating in the registration of the developed software.