[candiddevmike]

Additionally, from what I can tell a lot of SBOM tooling is manual/honor based, and the automated ones don't recurse dependencies well.

Trusting the current state of SBOMs seems sketchy