From #603 @pizza-ria > Consider adding https://www.cisa.gov/sbom to the resources. Good point - shouldn't we be mentioning SBOMs? What does @david-a-wheeler think?