  The rapid growth of software supply chain attacks has attracted considerable
attention to software bill of materials (SBOM). SBOMs are a crucial building
block to ensure the transparency of software supply chains that helps improve
software supply chain security. Although there are significant efforts from
academia and industry to facilitate SBOM development, it is still unclear how
practitioners perceive SBOMs and what are the challenges of adopting SBOMs in
practice. Furthermore, existing SBOM-related studies tend to be ad-hoc and lack
software engineering focuses. To bridge this gap, we conducted the first
empirical study to interview and survey SBOM practitioners. We applied a mixed
qualitative and quantitative method for gathering data from 17 interviewees and
65 survey respondents from 15 countries across five continents to understand
how practitioners perceive the SBOM field. We summarized 26 statements and
grouped them into three topics on SBOM's states of practice. Based on the study
results, we derived a goal model and highlighted future directions where
practitioners can put in their effort.
