Modern software often relies on thousands of third-party components, creating dependency networks that complicate security. Current methods for tracking these inventories—relying on external scanners or self-reporting—often introduce gaps in visibility. By embedding metadata directly into the build process, the new CMake enhancements allow for authoritative dependency modeling and deterministic output, ensuring that security data remains as accurate as the build instructions themselves.

This development stems from the Enhanced Software Bill of Materials (SBOM) for the Optimized Software Sustainment (E-BOSS) program, funded by DARPA. By moving these capabilities into the build system, developers gain access to automated, reproducible results without the need for additional, disconnected tooling. The project aims to streamline vulnerability triage across government and industry, effectively reducing the risk of supply-chain attacks while allowing agencies to tailor their security posture to specific mission requirements.