This will conflict with the `summary` configuration, unless we use the SBOM itself to generate the summary. And maybe we should?