example would be trying to create the sbom on a build server which is meant to produce the artifact. and you're only intersted in what your artifact needs (pull

example would be trying to create the sbom on a build server which is meant to produce the artifact. and you're only intersted in what your artifact needs (pulls in). How would any tool know what to include in an SBOM? because normally the sbom generation tool will try to query your package manager, whether thats rpm, dpkg or pypi and others to try to understand what it sees. so looking at the build stage might include a lot more (tool chain etc). most commercual tools eould cater for this b6 alliwing you to rectify incomplete or wrong information. the problem you mention, liability, is an important one. if the law requires the sbom to be correct then this is a problem humans need to verify. and tgats really annoying.