Techniques for validating safety agreement compliance using sboms

A system comprising:

• a memory;
• and
• a processing device operatively coupled to the memory, the processing device to:
• in response to a first version of an application being certified as compliant with a set of policies, generate a first software bill of materials (SBOM) associated with the first version of the application;
• in response to determining that the first version of the application has been updated to a second version of the application, generate a second SBOM corresponding to the second version of the application;
• and
• compare the first SBOM and the second SBOM to determine whether the second version of the application is compliant with the set of policies.

A non-transitory computer-readable medium having instructions stored thereon which, when executed by a processing device, cause the processing device to:

• in response to a first version of an application being certified as compliant with a set of policies, generate a first software bill of materials (SBOM) associated with the first version of the application;
• in response to determining that the first version of the application has been updated to a second version of the application, generate a second SBOM corresponding to the second version of the application;
• and
• compare, by the processing device, the first SBOM and the second SBOM to determine whether the second version of the application is compliant with the set of policies.