It is interesting to compare this old post to what has happened since. There were roots placed in the standardisation process at that time which is still in pro

It is interesting to compare this old post to what has happened since. There were roots placed in the standardisation process at that time which is still in progress but with a good draft [1]. There was also a stronger push to use SBOMs from NIST [2] which was kind of dropped by Google. As for the OSS Google integrated NPM registry with the public Rekor which collects and signs info about packages in the ledger [3]. I am not sure if that integration helps much though as it is quite fiddly to work with Rekor signatures and proofs. AFAIK if you sell to the gov they will ask for SBOMs like NIST suggests. [1]: https://datatracker.ietf.org/group/scitt/about/ https://datatracker.ietf.org/group/scitt/about/ [2]: https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity/software-security-supply-chains-software-1 https://www.nist.gov/itl/executive-order-14028-improving-nat... [3]: https://slsa.dev/blog/2023/05/bringing-improved-supply-chain-security-to-the-nodejs-ecosystem https://slsa.dev/blog/2023/05/bringing-improved-supply-chain...