[svnt]

How would yocto adjust their approach to improve their SBOM output?

It would seem to be a nearly impossible thing to automate.

[fathermarz]

To be clear, it isn’t just a yocto problem. It is an industry wide issue and usually requires resolution between binary, build, and manifest or SCA. But at the end of the day developers are still very creative.