> With modern package managers you can just generate your SBOM out of your that's how most of the sbom tools work, ... what is missing is a way to convince co

> With modern package managers you can just generate your SBOM out of your that's how most of the sbom tools work, ... what is missing is a way to convince companies who provide an SDK that includes 3rd party dependencies to ship a machine redable SBOM as part of every release. otherwise it'll be very hard to figure out how to make sense of that data.