Well, we were discussing tooling that could be used to check if the declared SBOM is correct, not producing the original SBOM. This kind of checking with today

Well, we were discussing tooling that could be used to check if the declared SBOM is correct, not producing the original SBOM. This kind of checking with today's practices is necessarily going to be imperfect, just like the BOMs in the physical manufacturing realm where the idea originates in. But if today's 99% solution turns out to be sufficiently useful, we could start making things in a way that are 100% verifiable (stuff like reproducible builds, etc) In security we've long ago let go of the idea of risk and turst as binary issues, the same thing applies here. Just about every other tool we have to improve security has bigger holes in it than this one.