Post #4238157

@allanfriedman@infosec.exchange I think it's a mistake to add the component license to the minimum requirements. Different concern, use cases and workflow (licenses do not change with every release nor component version), different consumers (cyber vs IP), and none of the job of the CISA nor any other orgs listed as co-authors. At work, I fight every week with people mixing SBOM for cyber and SBOM for license. I don't have time to lose with that, "if you want a license SBOM or license info in the SBOM take care of it, because I won't do it for you". So tired of that.