There also needs to be a process to validate the SBOM matches the compiled software with an air gapped digital twin. ( you have to bypass a few things in the header - like time stamp and a unique I’d) so both versions of your compiled software have the same hash. Then you need to protect that file from interception and still validate every line change in every file. This patent addresses many of these issues with a self-referencing SBOM on the blockchain. https://patents.google.com/patent/EP3687107A1