SPDX looks Flat. But can it really represent a Hierarchical SBOM?
Hey SBOM enthusiasts 👋, If you’ve been working with SBOMs for a while, you already know that merging multiple SBOMs isn’t just about dumping all the components into one file. The real challenge is preserving the semantics meaning of each merge strategy. Are they dependencies? Are they sub-components of another component? Are they independent products being assembled together? Or are we simply trying to flatten everything into one unified component list? ...